Research

I travel a lot, and on occasion I’ll run Nmap or some other scanner from my hotel room to get an idea of what’s out there, and how dangerous these hotel networks really are. To be honest it’s not something I do all that much anymore since even scanning an open network is running the risk of being considered over the line. But I just discovered a new security tool. It’s free. And it even plays music! Yes, the ever venerable and recently updated iTunes turns out to be an honest to goodness, if limited, security scanner. How? Well, I arrived in my hotel room last night, connected to the network, and launched iTunes for some background working music. Very quickly I saw four shared iTunes libraries on the network (without even looking actively, if you have iTunes set to find shared libraries they pop up all on their own after that). Some of my fellow traveler’s musical tastes are fairly interesting. In three of the four libraries the users conveniently included their personal name in their shared library name. One user even had the word “Limewire” in his (judging by his real name) library name. Huh. I wonder if he acquired all the music legally? Thus iTunes is now my new network security tool- I can instantly tell if I’m connected to a switched or segregated network, and even pick up the names and listening habits of other hotel guests. Anyone know if the RIAA offers a bounty? I mean they sue grandmothers and children, I don’t see why they wouldn’t start a confidential informant project. (Update 9/16 : DM and Chris Pepper remind me this feature isn’t anything new. Actually, I’ve used it for years on my home network, but this is the first time I’ve noticed random users on a hotel network and I found it amusing.) Share:

Electronic voting seems to be popping up again thanks to our favorite digital ostrich, Diebold. Martin Mckeay’s also writing on this a bit, and it’s well worth reading. This isn’t the first time I’ve mentioned this, and I didn’t come up with the idea, but with the most recent Diebold gossip I think it bears repeating. Gambling systems, electronic or physical, undergo extensive testing, validation, and auditing. We’re not just talking hacking, they shock the darn things with cattle prods and attack them using such phenomenally creative techniques that I’m awestruck the few times they show it on Discovery channel specials. And it’s the complete system that’s tested and audited constantly- even the odds distributions among video poker clusters in casinos (which are audited externally by various gambling commissions in the sin city of your choice). What does this have to do with voting? Gambling systems are somewhat unique in that pretty much everyone involved has an incentive to cheat everyone else. Were talking about a system where no one can really trust anyone. Sure, casinos (at least in Vegas) are on the up and up, but do any of you really trust them? They sure can’t afford to trust us, and pretty much no one trusts the government. The result? Some fracking good security. So here we have a highly secure system of numerous specialized electronic devices operating in a networked (or non-networked) environment with near-perfect auditability. Hmm, where else might we want a similar system? Heck- they even already have testing labs and audit standards. Funny how closely related gambling and politics are. I wonder if cattle prods are illegal in voting booths? I wonder how long Diebold would survive in Vegas? (I’ll be the first to admit us security types have a habit of blabbing on any topic we can possibly stuff into the security bucket, but electronic voting happens to be one of the areas where our experience is directly applicable. I don’t know too many (any) security types that try to justify Diebold’s positions. They’re either criminal or mentally incompetent.) ((And speaking of casinos- one of my favorite memories of Defcon was how none of the stores in the casino would take credit cards during the event.)) Share:

I’m out on the road this week, right now spending two days at a strategic planning session with a large energy company. This is the kind of trip I actually enjoy- working with an end-user on strategic issues at the executive level where they really want to solve the problem. The theme of the day is major disruptions- how to stay in business in the face of massive disasters that go well beyond disaster recovery. I’m just one of about a dozen outsiders brought in to try and get people thinking in new directions. Someone saw one of my presentations on responding to Katrina (I’m a reservist on a federal team) and thought a little on the ground experience might liven the discussions. I’m more than happy to stay at a nice hotel and tell rescue war stories while drinking fine wine (as opposed to pissing off my friends telling the same damn story for the 50th time after too many drinks). One of the presentations on crisis communications was particularly interesting. No, not ham radios, but how do governments and organizations communicate with the public during a disaster? The academic they brought in had some very compelling examples ranging from nuclear power accidents, to the air quality in lower Manhattan after 9/11, to chemical spills, to product recalls. One message emerged load and clear- liars always get caught… eventually. But they’ll probably get away with it in the short term. I asked him directly if he knows of any successful cases where a corporation or government attempted to spin a situation through obfuscation or outright deception and actually got away with it. His answer? In the long term- no. In the short term- yes, but the long term impact is usually magnified when the truth emerges. The most successful crisis communications? Honesty, transparency, and openness (even if spun a little). Seems like a pretty valuable lesson to us in security. Any security professional will eventually deal with a breach, or on the vendor side with a bad vulnerability. The more we try and cover something up the worse it is for us in the long run. A few quick examples? Look at Cisco and the Mike Lynn situation. I hear there are some job openings at Ohio State. Choicepoint swapped CISOs after their breach, even though it wasn’t an IT security failure. We can go on and on- can anyone think of a single security breach or vulnerability disclosure where the organization involved didn’t get caught in a lie or cover up? Same goes for vendors exaggerating product capabilities. I know one that recently changed their entire management team because the old CEO thought he could fool the market just long enough to get bought. Too bad the board didn’t buy it. He’s out of a job (but I’m sure he got a nice package). The bad news is you can get away with it in the short term, but I’m not sure how that really helps you as an individual, or your company, if eventually you’ll get fired. You see lying is like crack- a short term high, but in the end you’ll end up naked in front of a dumpster with a crack pipe in an uncomfortable orifice. I suppose that’s okay if it’s what you’re into. Personally, I’ll stick to the truth and head downstairs for some free wine. (P.S.- the exception to all of this, of course, is politicians. I think it’s either because we’re lazy as voters, or because they all eventually smell the same. Probably a little of both) Share:

From http://www.september11victims.com/september11victims/victims_list.htm WORLD TRADE CENTER Gordon McCannel Aamoth, 32, New York, N.Y. Maria Rose Abad, 49, Syosset, N.Y. Edelmiro (Ed) Abad, 54, New York, N.Y. Andrew Anthony Abate, 37, Melville, N.Y. Vincent Abate, 40, New York, N.Y. Laurence Christopher Abel, 37 William F. Abrahamson, 58, Cortland Manor, N.Y. Richard Anthony Aceto, 42, Wantagh, N.Y. Erica Van Acker, 62, New York, N.Y. Heinrich B. Ackermann, 38, New York, N.Y. Paul Andrew Acquaviva, 29, Glen Rock, N.J. Donald L. Adams, 28, Chatham, N.J. Shannon Lewis Adams, 25, New York, N.Y. Stephen Adams, 51, New York, N.Y. Patrick Adams, 60, New York, N.Y. Ignatius Adanga, 62, New York, N.Y. Christy A. Addamo, 28, New Hyde Park, N.Y. Terence E. Adderley, 22, Bloomfield Hills, Mich. Sophia B. Addo, 36, New York, N.Y. Lee Adler, 48, Springfield, N.J. Daniel Thomas Afflitto, 32, Manalapan, N.J. Emmanuel Afuakwah, 37, New York, N.Y. Alok Agarwal, 36, Jersey City, N.J. Mukul Agarwala, 37, New York, N.Y. Joseph Agnello, 35, New York, N.Y. David Scott Agnes, 46, New York, N.Y. Joao A. Aguiar Jr., 30, Red Bank, N.J. Lt. Brian G. Ahean, 43, Huntington, N.Y. Jeremiah J. Ahen, 74, Cliffside Park, N.J. Joanne Ahladiotis, 27, New York, N.Y. Shabbir Ahmed, 47, New York, N.Y. Terrance Andre Aiken, 30, New York, N.Y. Godwin Ajala, 33, New York, N.Y. Gertrude M. Alagero, 37, New York, N.Y. Andrew Alameno, 37, Westfield, N.J. Margaret Ann (Peggy) Jezycki Alario, 41, New York, N.Y. Gary Albero, 39, Emerson, N.J. Jon L. Albert, 46, Upper Nyack, N.Y. Peter Craig Alderman, 25, New York, N.Y. Jacquelyn Delaine Aldridge, 46, New York, N.Y. Grace Alegre-Cua, 40, Glen Rock, N.J. David D. Alger, 57, New York, N.Y. Ernest Alikakos, 43, New York, N.Y. Edward L. Allegretto, 51, Colonia, N.J. Eric Allen, 44, New York, N.Y. Joseph Ryan Allen, 39, New York, N.Y. Richard Lanard Allen, 30, New York, N.Y. Richard Dennis Allen, 31, New York, N.Y. Christopher Edward Allingham, 36, River Edge, N.J. Janet M. Alonso, 41, Stony Point, N.Y. Anthony Alvarado, 31, New York, N.Y. Antonio Javier Alvarez, 23, New York, N.Y. Telmo Alvear, 25, New York, N.Y. Cesar A. Alviar, 60, Bloomfield, N.J. Tariq Amanullah, 40, Metuchen, N.J. Angelo Amaranto, 60, New York, N.Y. James Amato, 43, Ronkonkoma, N.Y. Joseph Amatuccio, 41, New York, N.Y. Christopher Charles Amoroso, 29, New York, N.Y. Kazuhiro Anai, 42, Scarsdale, N.Y. Calixto Anaya, 35, Suffern, N.Y. Jorge Octavio Santos Anaya, 25, Aguascalientes, Aguascalientes, Mexico Joseph Peter Anchundia, 26, New York, N.Y. Kermit Charles Anderson, 57, Green Brook, N.J. Yvette Anderson, 53, New York, N.Y. John Andreacchio, 52, New York, N.Y. Michael Rourke Andrews, 34, Belle Harbor, N.Y. Jean A. Andrucki, 42, Hoboken, N.J. Siew-Nya Ang, 37, East Brunswick, N.J. Joseph Angelini, 38, Lindenhurst, N.Y. Joseph Angelini, 63, Lindenhurst, N.Y. Laura Angilletta, 23, New York, N.Y. Doreen J. Angrisani, 44, New York, N.Y. Lorraine D. Antigua, 32, Middletown, N.J. Peter Paul Apollo, 26, Hoboken, N.J. Faustino Apostol, 55, New York, N.Y. Frank Thomas Aquilino, 26, New York, N.Y. Patrick Michael Aranyos, 26, New York, N.Y. David Gregory Arce, 36, New York, N.Y. Michael G. Arczynski, 45, Little Silver, N.J. Louis Arena, 32, New York, N.Y. Adam Arias, 37, Staten Island, N.Y. Michael J. Armstrong, 34, New York, N.Y. Jack Charles Aron, 52, Bergenfield, N.J. Joshua Aron, 29, New York, N.Y. Richard Avery Aronow, 48, Mahwah, N.J. Japhet J. Aryee, 49, Spring Valley, N.Y. Carl Asaro, 39, Middletown, N.Y. Michael A. Asciak, 47, Ridgefield, N.J. Michael Edward Asher, 53, Monroe, N.Y. Janice Ashley, 25, Rockville Centre, N.Y. Thomas J. Ashton, 21, New York, N.Y. Manuel O. Asitimbay, 36, New York, N.Y. Lt. Gregg Arthur Atlas, 45, Howells, N.Y. Gerald Atwood, 38, New York, N.Y. James Audiffred, 38, New York, N.Y. Kenneth W. Van Auken, 47, East Brunswick, N.J. Louis F. Aversano, Jr, 58, Manalapan, N.J. Ezra Aviles, 41, Commack, N.Y. Ayodeji Awe, 42, New York, N.Y Samuel (Sandy) Ayala, 36, New York, N.Y. Arlene T. Babakitis, 47, Secaucus, N.J. Eustace (Rudy) Bacchus, 48, Metuchen, N.J. John James Badagliacca, 35, New York, N.Y. Jane Ellen Baeszler, 43, New York, N.Y. Robert J. Baierwalter, 44, Albertson, N.Y. Andrew J. Bailey, 29, New York, N.Y. Brett T. Bailey, 28, Bricktown, N.J. Tatyana Bakalinskaya, 43, New York, N.Y. Michael S. Baksh, 36, Englewood, N.J. Sharon Balkcom, 43, White Plains, N.Y. Michael Andrew Bane, 33, Yardley, Pa. Kathy Bantis, 44, Chicago, Ill. Gerard Jean Baptiste, 35, New York, N.Y. Walter Baran, 42, New York, N.Y. Gerard A. Barbara, 53, New York, N.Y. Paul V. Barbaro, 35, Holmdel, N.J. James W. Barbella, 53, Oceanside, N.Y. Ivan Kyrillos Fairbanks Barbosa, 30, Jersey City, N.J. Victor Daniel Barbosa, 23, New York, N.Y. Colleen Ann Barkow, 26, East Windsor, N.J. David Michael Barkway, 34, Toronto, Ontario, Canada Matthew Barnes, 37, Monroe, N.Y. Sheila Patricia Barnes, 55, Bay Shore, N.Y. Evan J. Baron, 38, Bridgewater, N.J. Renee Barrett-Arjune, 41, Irvington, N.J. Arthur T. Barry, 35, New York, N.Y. Diane G. Barry, 60, New York, N.Y. Maurice Vincent Barry, 49, Rutherford, N.J. Scott D. Bart, 28, Malverne, N.Y. Carlton W. Bartels, 44, New York, N.Y. Guy Barzvi, 29, New York, N.Y. Irna Basina, 43, New York, N.Y. Alysia Basmajian, 23, Bayonne, N.J. Kenneth William Basnicki, 48, Etobicoke, Ontario, Canada Lt. Steven J. Bates, 42, New York, N.Y. Paul James Battaglia, 22, New York, N.Y. W. David Bauer, 45, Rumson, N.J. Ivhan Luis Carpio Bautista, 24, New York, N.Y. Marlyn C. Bautista, 46, Iselin, N.J. Jasper Baxter, 45, Philadelphia, Pa. Michele (Du Berry) Beale, 37, Essex, Britain Paul F. Beatini, 40, Park Ridge, N.J. Jane S. Beatty, 53, Belford, N.J. Larry I. Beck, 38, Baldwin, N.Y. Manette Marie Beckles, 43, Rahway, N.J. Carl John Bedigian, 35, New York, N.Y. Michael Beekman, 39, New York, N.Y. Maria Behr, 41, Milford, N.J. Yelena Belilovsky, 38, Mamaroneck, N.Y. Nina Patrice Bell, 39, New York, N.Y. Andrea Della Bella, 59, Jersey City, N.J. Debbie S. Bellows, 30, East Windsor, N.J. Stephen Elliot Belson, 51, New York, N.Y. Paul Michael Benedetti, 32, New York, N.Y. Denise Lenore Benedetto, 40, New York,

A few months ago I picked up a Western Digital external hard drive at Costco since my MacBook’s internal drive was a bit stuffed with digital photos. The WD drive is a pretty nice USB drive and really portable. The problem? I started having some intermittent failures on the drive. Since this is where I now keep my wedding photos (backed up somewhere else, of course) I decided to return it before it totally died on me. I got the replacement drive, packed up the original, and heading to the shipping store… … where I realized I hadn’t wiped the drive. While it’s just photos, and none of them are of an embarrassing nature, I still don’t relish the idea of seeing them “enhanced” and posted on MySpace. Lucky for me I use a Mac and safe erasing is an integral part of Disk Utility. I ran the program, clicked the security options button, and chose the 7 times overwrite option. 7x might be overkill for some non-sensitive photos, but I figured it would be a good test to see how long it takes. The answer is about 7 hours for a 120 GB USB 2.0 external drive. For the record. Oh well, I guess it isn’t going out today. But I’m darn glad I remembered to wipe the drive before shipping it back. I’d really hate to see any pictures of our cat show up on some sick kitty-porn site. And I’m really glad Apple makes it so easy. Microsoft also has secure formatting options, but generally you need a third party tool (or write your own script) to get the same degree of security. Unless the data is encrypted, without overwriting it’s pretty likely someone can recover it. Then again, smashing is probably faster. But Western Digital might not appreciate a smashed return. I’d probably lose my deposit. (edited 9/10 to add disk size of 120 GB) Share:

I’m sitting in the Martini Monkey in San Jose airport, by far the best airport bar in history and possibly my favorite bar anywhere in the US. This place is a seriously funky oasis for those of us banished to the purgatory of airport terminals and solitary $10 crap beers in our hotel rooms. Okay, I might be on my 2nd-ish beer. I just spent the past two days working with clients out in the Valley area. Both are security startups, both are in pretty exciting markets, and I’ve worked with both for a while now. One is about to kick serious donkey, the other may fail despite possibly the best technology in the market. What’s the difference? Giving the audience what they want. Many of the vendors I’ve worked with over the years will probably tell you I’m a royal pain in the ass. I consider my objectivity to be the most important asset I bring to the analyst market and I do everything I can to protect it. You’ll never see a custom quote in a press release out of me (any quotes are lifted from published research), I don’t take gifts over $10 (which limits me to t-shirts I’ll never wear or USB drives of dubious capacity), I rarely do dinners, and I tell all vendors, even the ones I like, that I assume nothing they tell me is true until I hear it from a client. I don’t even tell vendors I have this blog, won’t ever discuss a vendor I’m working with, and won’t talk about this site with anyone I cover. But there’s one way you vendors can influence me- it’s by making a good product that meets customer needs. Back to the two vendors (who hopefully aren’t reading this). As egotistical as I am the one point I consistently emphasize with vendors I work with is shame on you if you don’t validate every piece of advice I give you with your users. End users are a mixed blessing. As a former developer, they either save you or destroy you; especially when it comes to interfaces. This is particularly problematic in the security market where we deal with multiple demographics- ranging from highly technical security experts to some dude that’s just off the help desk. Users can drag you through development cycles where you’re constantly adding features or UI widgets to meet the specific needs of one individual, that don’t apply anywhere else. But the best product managers separate the wheat from the chaff, and rather than being distracted, focus efforts on those few fundamental features that appeal to the broadest client base. Why is this important? Because UI is everything. Not just because it makes your product look pretty, but because a good UI increases the productivity of your users. A bad UI can add hours to someone’s workday, hide the best features of your product, and banish you to the shelf. Not that some UI flash compensates for a lack of function, but a bad UI leads to an unmanageable product that’s nearly useless no matter its core functionality. One of the biggest transitions a startup can make is from an engineering-driven product, focused purely on technical functions to a polished product that slides right into an enterprise security arsenal. From “cool” to “useful” to “operational”. I know some of you command line geeks disagree, but today’s security professionals can barely keep up with enterprise demands and an effective management interface makes all the difference. Besides, when you’re looking at two nearly-functionally-identical products odds are you’ll choose the pretty one. My wife is an extremely intelligent and amazing individual, but the fact that she’s attractive sure didn’t hurt. (if she reads this I might be in a bit of trouble- damn Martini Monkey). Back to my vendors- what’s the difference? One of the vendors today showed me the most significant UI advancements in a short time I’ve ever seen- and definitely the biggest advancement I’ve seen in the security market. Aside from making a more marketable product, I believe these changes will seriously impact their user base and increase the usefulness of the product. It’s not perfect, but in one quarter these guys pulled off some hard core advancements- all validated with their user base. It’s not just looks- they now have a serious competitive advantage because the product is more useful. The best function in the world is worthless if the user can’t find it and use it effectively. And just think how much easier the sales cycle will be when clients see the first product demo and all the functionality is right in their face. The other vendor? They’ve also made some very significant product advances and have one of the best technologies in the market, but the UI still needs some big work. Not only is it hard for the users to find all the functions, but the UI limitations make it seriously hard to pull all the value out of the product. My rough estimate is some operations take 2-3 times as long as they need to. It’s an excellent product, functionally superior to most of the competition, but those functions are so hidden it hurts in both sales situations and day to day operations. In rescue work we spend an obsessive amount of time packing and repacking our gear. Our goal is to optimize our ability to operate by making our tools an extension of our body. When I’m hanging off a cliff face 1000 feet off the ground at night I need to know, intuitively, where every piece of gear is hanging off of me and I need to use them effectively blindfolded. Users shouldn’t have to spend weeks in training, and months in operations, to figure out security products. A well designed user interface can hide reams of functionality while increasing user productivity. It’s about helping the users get their day to day jobs done as efficiently as possible. Nothing else matters. Listen to

It’s been a while since Richard Stiennon and I worked together, and I’m learning one of the more enjoyable aspects of blogging is the opportunity to pick on him again. In a post today over at Threat-Chaos Richard states, Most of the premise of this week’s Security Standard conference in Boston appears to be that CIO’s, CSO’s and IT security practitioners have to treat security as a business process just like any other. My perspective is that treating IT security like a business process is like treating a tactical military strike force as a business. While maintaining the capability of military forces could be a process open for improvement by applying some business discipline, actually fighting battles and overcoming opposing forces does not have much of the “business process” about it. Security is much more akin to fighting a battle than it is to “aligning business objectives”. I admit I have a penchant for taking analogies a little too far, but I think comparing IT security to a military strike force might be a bit much. Sure, some of us have short haircuts and we like to talk in acronyms, but the whole never-getting-shot-at thing is a pretty significant difference. And the occasional conference t-shirt isn’t nearly as cool as all the free military swag. Richard is trying to make a valid point that tactical operations in security aren’t as amenable to business objectives and process as perhaps some other areas of IT. But I, of course, disagree. Back when I was a paramedic and firefighter we spent an inordinate amount of time optimizing our processes for dealing with crisis situations (I’ve moved onto firefighting instead of the military since my 4 years in NROTC probably don’t qualify as hardened battle experience). It was only by turning crisis (battle) into process that we could manage the challenges of life or death emergencies. It’s all about process. From the algorithms of CPR to the steps of rapid sequence intubation. Without process you have chaos. The more efficient you are at process, the more you can operationalize crisis management, the more effectively you can manage incidents. And these processes are even aligned to business objectives- some small (don’t kill the patient too much) some large (retain capacity for multiple operations, manage resources). Once everyday crisis is process it takes something really extreme to break operations and force you into incident management mode. I define incident management as “what you do when you’ve exceeded regular process”. This definition is stolen from what we refer to in emergency services as a “Mass Casualty Incident”; which is anything that exceeds your current capacities. In IT security the more incidents you can manage through efficient process, the less you spend on a day to day operational basis, and the more resources you have available for “the big one”. Security that isn’t optimized and aligned with the business is really expensive; and unsustainable in the long run. Even the Army can’t treat every battle as a one-off. It’s still all about business objectives… … and business is good. (bonus points to whoever identifies the source of the slaughtered paraphrase I used for the title) Share:

Really amusing considering our current discussions: How to Handle Security Problems in Your Products This is from Thomas H. Ptacek who’s blogging at matasano.com. I’m not sure how old it is. Ptacek seems to think I’m smart (which I’ll never argue with) but have nothing new to say on disclosure. He’s probably right, but since we still don’t have industry consensus around disclosure there’s still words to be written, and old thoughts to be repackaged in new ways. This is a pretty old debate; one where I don’t expect resolution just because Pete Lindstrom, Ptacek, myself, or anyone else drops some blog posts. There’s just too many competing interests… Share:

Last Friday I was packing up for a weekend trip with my wife to Tuscon when my faithful RSS reader chased me down with the latest post on Daring Fireball. I ignored it over the weekend, but think it’s time for a response. John Gruber, ever the poker player (his words, not mine) issued an open challenge to Dave Maynor and John Ellch to crack a stock MacBook. If they win, they keep it. If they can’t break in, they pay Gruber the retail price. Today John Gruber followed up with this post, upping the ante a bit and explaining why he feels this is a fair challenge. Adding to the data stream, John Ellch broke silence and released some details of a similar exploit using Centrino drivers (now patched) to the Daily Dave security mailing list. First some full disclosure of my own. I’ve been a fan of Daring Fireball for some time, John and I share a mutual friend, and we’ve traded a few emails over this. But I really wish he had handled this situation differently. I respect John, and hope this post isn’t taken out of context and used for flame bait. Now, why do I think Gruber is making a mistake? Because his challenge is putting good people in bad positions, it isn’t necessarily good for security, and he isn’t playing for the right stakes. Maynor, Ellch, and the security community in general should just ignore the challenge. Check out the original post, but John challenges Maynor and Ellch to take a stock MacBook with a basic configuration and delete a file off the desktop via remote exploit. John’s reason for the challenge? As for the earlier analogy to poker, I’m no fool. I don’t expect to lose this particular bet — but I don’t expect to win it, either. I expect to be ignored. I don’t think Maynor and Ellch have discovered such a vulnerability in the default MacBook AirPort card and driver, and so, if I’m right, they certainly won’t accept this challenge. I think what they’ve discovered — if they’ve in fact discovered anything useful at all — is a class of potential Wi-Fi-based exploit, which they demonstrated on a rigged MacBook to generate publicity at the expense of the Mac’s renowned reputation for security, but that they have not found an actual exploit based on this technique that works against the MacBook’s built-in AirPort. If I’m wrong, and they have discovered such a vulnerability, they may or may not choose to accept this challenge. But it’s a bet that they’ll only accept if they can win. It comes down to this. If I’m wrong, it’d be worth $1099 to know that MacBook users are in fact at risk. And if I’m right, someone needs to call Maynor and Ellch on their bullshit. John’s challenge is misplaced and he should drop it. Why? I know the demonstration from Black Hat is real. Why? Aside from being at the presentation I had a personal demo (over live video) or exactly what they showed in the video. I got to ask detailed questions and walk through each step. Maynor and Ellch haven’t bullshitted anyone- their demo, as shown in the video and discussed in their presentation, is absolutely real. End of story. Want to see for yourself? Read to the end and you’ll have your own opportunity. Using the third-party card for the demo is responsible: Why? Because their goal was to show a class of attack across multiple platforms without disclosing an unpatched vulnerability. By using an anonymous card no single platform is exposed. Why the Mac? Because it demonstrates that a poorly written device driver can expose even a secure system to exploit. The third-party card highlights device drivers, not the OS, as the point of weakness. They could have shown this on Windows but everyone would have assumed it was just another Windows vulnerability. But the Mac? Time to pay attention and demand more from device manufacturers. Responsible disclosure encourages staying silent until a patch is released, or an exploit appears. Why? If responsibility, protecting good guys, or potential legal issues aren’t good enough for you just understand it’s the accepted security industry practice. Some vendors and independent researchers might be willing to act irresponsibly, but I respect Maynor and Ellch for only discussing known, patched vulnerabilities. I won’t pretend there’s full consensus around disclosure; I’ve even covered it here, but a significant portion of the industry supports staying silent on vulnerabilities while working with the vendor to get a patch. The goal is to best protect users. Some vendors abuse this (to control image), as do some researchers (to gain attention), but Maynor and Ellch staying silent is very reasonable to many security experts. Remember- the demonstration was only a small part of their overall presentation and probably wouldn’t have ga ered nearly as much attention if it weren’t for Brian Krebs’ sensationalist headline. That article quickly spun events out of control and is at the root of most of the current coverage and criticism. Just confirming an exploit could hurt Maynor and Ellch: Two words: Mike Lynn. This is between Maynor, Ellch, SecureWorks, and any vendors (including Apple) they may or may not be working with. I like Daring Fireball, but SecureWorks has a history of responsible disclosure and working with affected vendors, and I see no reason for them to change that policy to satisfy the curiosity of bloggers, reporters, or any other outsider. John’s stakes are too low. He’s asking Maynor and Ellch to bet their careers against MacBooks? If John puts Daring Fireball up as his ante the bet might be fair. Besides, Maynor already has a MacBook. This challenge doesn’t help anyone. At all. Is my MacBook Pro vulnerable? I don’t know, but even if it is there’s not a damn thing I can do about it until Apple issues a patch. It’s not like I’m turning off my wireless until I hear there’s some

There are very few genuine, passionate people in this world. Today, with the death of Steve Irwin, there is one less. http://www.cnn.com/2006/SHOWBIZ/TV/09/04/australia.irwin/index.html http://animal.discovery.com/fansites/crochunter/steve/statement.html?clik=www_wh_2 Steve was a personal hero of mine. Not because of any crazy stunts, but because of his integrity, honesty, and utter dedication to his family and what he believed in. This is just a terrible loss and the only ones that matter now are his family. Although I never met Steve I was fortunate enough to visit Australia Zoo twice over the past few years. There’s not a damn thing worth saying I can say on this so I’m just posting some pictures from our last trip to Australia Zoo after the jump. When a memorial fund is established we’ll post the information here. Note: Steve wasn’t there when we’ve visited, that’s his staff in the photos: Share: