Archive for the ‘InfoSec’ Category

Chase Bank

Tuesday, May 1st, 2007

Identity theft is a big deal. Doesn’t take a lot to completely take over someone’s identity giving you access to their credit rating which in this world is all you really need to royally screw up someone’s life while enriching yours…if you can sleep at night.

This video shows several Chase Bank branches in New York City and what these guys found in their trash. Does YOUR bank have a shredding policy? Do they follow it?

Vista has improved security!…or something

Thursday, February 1st, 2007

You just gotta love this.  All the ranting and raving about how great Vista is going to be has covered the industry rags for the last year and a half.  I’m sure that great strides have been taken to clean up the mess.  SecurityFocus ran an article earlier this week claiming “Vista raises the bar for flaw finders” touting the new OS.  This quote caught my eye:

“None of the features in Windows Vista, either individually or together, are meant to be bulletproof,” said Stephen Toulouse, senior product manager for Microsoft’s Security Technology Unit. “But the defense-in-depth will significantly raise the security level compared to Windows XP.”

It’s great that they recognize that the bad guys will certainly find holes somewhere.  Time is always on the attackers side.  Defense in Depth is the SOP for all security practices and Vista has gone along way to that end over it’s predecessor. So just when you think the boys and girls in Redmond are on the ball, this breaks on the DailyDave list yesterday from George Ou:

“I recorded a sound file that would engage speech command on Vista, then engaged the start button, and then I asked for the command prompt.  When I played back the sound file with the speakers turned up loud, it actually engaged the speech command system and fired up the start menu.  I had to try a few more times to get the audio recording quality high enough to get the exact commands I wanted but the shocking thing is that it worked!”

So LITERALLY right out of the box Vista is saying, quoting SecurityFocus, “PC, root thyself!”

I love it when a plan comes together.

Sysinternals to be assimilated by Micro$oft

Thursday, July 20th, 2006

UPDATE:  SysInternals file has been restored.

MD5: EACDCB1A798A7DD760E22F9523B1B908
SHA1: 6A910CE3D08C0E81C3FD4C9CB4ADFF57594A6CB2

A dark day to be sure. But you just never know. Mark Russinovich says he will continue his blog which, we hope, will continue to be as independent as it has been in the past.

In the event that M$ decides to charge for their new aquisition…not that they have ever done that before(ahem)…I took the liberty of grabbing all of their tools and dumping them into a single zip file here. These are current as of today and I would be a bit surprised if they are updated again before the completion of the takeover.

Reality III

Tuesday, July 18th, 2006

I’ve written before on what Reality is. Basically, it’s the hard facts that we don’t really want to hear or read or experience. The fact we don’t want to face them doesn’t change the fact that it is reality. The best course of action is to face reality with resolve. It appears that the world at large isn’t willing to face the reality that is “the middle east crisis” or terrorism overall. Sadly, it appears now that the Bush Administration doesn’t want to face it either.

The Guardian of London is reporting that the Bush Administration is giving Israel one more week to destroy Hezbollah before weighing in on the “cease fire” side of the debate. One more week isn’t enough time for Israel to complete this particular task let alone hit at the REAL power behind Hezbollah which is Syria(Iran is pretty much beyond Israel’s reach). “One more week” gives Hezbollah a deadline. “One more week” is setting a date for withdrawal. “One more week” is what the “Cut and Run” crowd in the US Congress has been wanting in Iraq. “One more week” isn’t reality.

Reality is welcoming Israel into the Global War on Terror and reminding her neighbors that if they work with her this will all be over sooner. Israel has shown remarkable restraint over the past decade while Palestinians blowup discos, weddings, markets, buses, and restaurants all over the country. They have offered the Palestinians everything they have asked for in exchange for living peacefully with each other. At every turn they have returned to the slaughtering of Israel’s citizens. Hezbollah is no different. Both of them claim their ultimate goal to be the elimination of the “Zionist State”. The only concession they will take is if the entire country follows the lead of those in the fortress Masada. That is reality. Allow Hezbollah to return to their Masters(Syria and Iran) to regroup and refit and we will walk down this same path sooner rather than later. The objective SHOULD be to encourage Israel to continue on with their operations. Encourage the civilized people of Lebanon and Syria to join in the effort to rid their country of barbarians. Press on to Damascus and get this mess over with.

It’s going to happen. It HAS to happen if we are serious about this War on Terror.

Olmert Gets It

Monday, July 17th, 2006

2 hours ago PM Olmert said the following:

“Citizens of Israel, there are moments in the life of a nation, when it is compelled to look directly into the face of reality and say: no more,” he said.

“And I say to everyone: no more. Israel will not be held hostage – not by terror gangs or by a terrorist authority or by any sovereign state,”

“There is nothing we want more than peace on all of our borders,” Olmert told the Knesset. But he said, “Israel will not agree to live with rockets fired on its citizens, he added. “Only a nation that can protect its freedom deserves it,” he stated.

Amen Mr. Olmert. Amen. God Speed in your efforts and God Bless the IDF!

Doesn’t sound like a man who is going to cave to the “balanced response” crowd does it? Over at HotAir a commenter, Creed, offered up this phrase from Menachem Begin from the last Lebanon adventure in 1982:

The hour of decision has arrived. You know what I have done, and what all of us have done. To prevent war and bereavement. But our fate is that in the Land of Israel there is no escape from fighting in the spirit of self-sacrifice. Believe me, the alternative to fighting is Treblinka, and we have resolved that there would be no Treblinkas. This is the moment in which courageous choice has to be made. The criminal terrorists and the world must know that the Jewish people have a right to self-defense, just like any other people.

Begin Got It. Olmert Gets It. It’s not common for a Non-Kentuckian to get the Half Horse-Half Gator award but Mr. Olmert, This one’s for you.

Kentucky State Government blocks access to some blogs

Thursday, June 22nd, 2006

Notably, who has been very critical of the Fletcher Administration because of the Merit System scandal. I haven’t been exactly friendly to this administration either because of the same scandal and my blog is no long accessible within the state’s network.

The geeks tell people they blocked blogs and newsgroups based on a list provided by the company who made their content management/monitoring system. If that’s the case then they need to dump that product because the BIG political blogs out there are not blocked. Sites like Instapundit, Daily Kos, and Andrew Sullivan were accessible as of yesterday while Michelle Malkin,, and lil ole me are blocked. How exactly I ended up in the same block rule as Michelle I’ll never know…I’ll just enjoy the company for a while.

If you can read this then you can head over to BGR for all their details. They are filing FOIA requests for the discussion that led to this implementation of “the list”. As friendly as Fletcher has become with email, I’m all but certain we will see this reveal one of two things:

1) Fletcher either ordering, or ignoring the spectre of, censorship of certain sites based on political content. If this is the case he has to go. Before, I wanted him to resign because of the indictment. It was the right thing to do. Now, if this proves to be a censorship thing, he has to be thrown from office. His behavior is unbecoming a Kentucky Governor or even a Kentuckian.

2) Total and complete incompetence in the implementation of a policy designed to limit the availability of “time sinks” to employees. Networks are not democratic things and they cannot be run by committee. Policies are necessary dictating what users can and cannot do. If this proves the case then someone else has to go…we’ll find out who in due time.

Jesse MacBeth…what a piece of work is…well…

Tuesday, May 23rd, 2006

With a surname like MacBeth I just couldn’t help myself.

… have we eaten on the insane root That takes the reason prisoner?
Macbeth, 1. 3

Yep…he certainly has.

What bloody man is that?
Macbeth, 1. 2

Why that would be some useless piece of trash after the milblogs have gotten done with him, that’s the (rhetorically) bloody man!

Stands not within the prospect of belief.
Macbeth, 1. 3

It certainly doesn’t. Maybe that’s why IVAW has dropped him like a hot rock.

False face must hide what the false heart doth know.
Macbeth, 1. 7

Well, he tried to hide it but fortunately the Milblogs were here and, well…

The attempt and not the deed
Confounds us.
Macbeth, 2. 2

That it did.

The devil damn thee black, thou cream-faced loon!
Where gott’st thou that goose look?
Macbeth, 5. 3

Amen to that!

VA Infosec nightmare

Tuesday, May 23rd, 2006

Security Focus reports in part:

“The U.S. government warned on Monday that a database containing sensitive information about veterans and their families had been stolen, after an employee violated policy and brought the data home.”

Several things jump out at me about this.

First, and most obvious, the fact that 26.5 million identities are now exposed, mine included.

Second, the only reason VA knew this data was exposed was after the “analyst” reported the burglary to VA. I can’t imagine his horror after realizing what had happened. I’m hoping he also kicked himself for bring it home in the first place. Here’s hoping he at least had it encrypted some how but I’m not holding my breath.

Third, in their statement, the VA says this “analyst” didn’t have authority to take this home. The VA must be the most trusting Federal Agency in government. Makes you wonder what their internal security looks like. Hey VA! Ever heard of VPN? If you are going to let these people tinker with this information then at least force them to do so over an encrypted channel and leave the data where it lives.

This kind of thing makes me want to get even more draconian with my users.

CyberJihad target!

Monday, May 1st, 2006

There’s a difference between a victim and a target. Targets are the recipient of some kind of an attack. Victims are typically taken out of action by said attack. Aaron was a target but definately not a victim.
Ya just gotta go read this guy. Last week almost 100 blogs were taken off the air while Hosting Matters masterfully fended off a DDOS attack against Aaron’s site. Naturally I had to go see what all the fuss was about…I’m glad I did. The guy gets it.

May Day “Boycott”

Sunday, April 30th, 2006

Tomorrow will be a media frenzy as the criminals attempt to “shutdown” several US cities. Yeah, they are criminals. They violated US laws to enter our country. Over a year ago I wrote this. The same still holds true except now the criminals are doing us the favor of gathering together for us. Should make it simple enough right?

Why doesn’t someone with some authority in these matters, as I surely do not, why don’t they setup an ICE booth right smack dab in the middle of these “parade” routes with the same paperwork these people SHOULD HAVE completed at a LEGAL port of entry. Right there in the middle of the “parade” route we offer them the ability to get legal.

At the end of the “parade route” we have crates full of zip ties and several of the HUGE army tents of old. If they didn’t queue up at the table in the middle of the route then surely they have no intention of becoming legal immigrants. Arrest them, cuff them, and toss them into the new tent city to await immediate deportation. If anyone resists this arrest, then we consider them invaders. Any physical assault on the ICE agents will be regarded as an act of war and we just shoot the bastards on site. Harsh? Absolutely! Almost as harsh as a 12 million man invasion of a soveriegn country don’t you think?

Okay fine, we don’t shoot them but we certainly don’t concern ourselves with that whole “civil rights” crap being rammed down our throats either. Because I demand that our laws are followed does NOT make me a racist, Conrad. The thought that these people can flagrantly celebrate their illegal actions frustrates me to no end. Who has the authority to arrest these criminals? If no one, then we are all in a world of hurt.

Here’s a thought, if these “demonstrations” occur in your city, call the police on them. They have violated the law right? As a LEGAL citizen of the USA, it’s my civic duty to place that call isn’t it?

What a world we live in where criminals can hold demonstrations in the streets of our largest cities and the FRIGGIN POLICE ARE EXPECTED TO PROTECT THEM!

Microsoft wants to think for you…again.

Wednesday, February 8th, 2006

Well well well, M$ has come out with a subscription based program that will roll all of your security related applications(firewall, AV, and Spyware) into one handy package. They call it OneCare. You can read all about it here, start at the bottom and read up.

They seem to be implying that this won’t interfere with the other security related apps you are running and will be the onestop shop for all things malware. Right. Holes have already been found and probably addressed…the program is still in Beta until July. These problems, however, show at best, a stunning ignorance of the threats out there and at worst a sloppy implementation.

Problem 1: Anything utilizing JVM gets a free pass through the firewall.

Problem 2: Any signed application gets a free pass through the firewall.

“Oh but signed applications are safe aren’t they?” Uh…no. Many bits of Malware are signed today to keep windows from alerting on them. It’s become standard practice and most everyone in the security world knows it…except the folks at Microsoft apparently. Oh, wait, I mentioned “security world” and “Microsoft” in the same sentence…silly me.

M$ wants $49.95/yr for the use of this “service”.

As I said on their blog, why would I move away from Zonealarm(free), AVG(free), and Spybot(free)? Why do I need OneCare to tell me about threats when I already have SANS Internet Storm Center? Why would I encourage my not-so-tech-savvy family and friends to participate in this post-modern version of the Bait and Switch? They’re going to call me anyway…

Ed “The Legend” Skoudis, SANS instructor and Malware expert, welcomes M$’s foray into the security world:

I agree with Ed in that it’s all about trade offs…I’m just not sure the trade offs made by M$ are worth the gamble. My recent rant has been “Don’t Think For Me!” and it holds true here. Let ME decide what my trade offs are. I really believe that in todays network world users have to be educated. The days of dropping $2500 on a machine and jumping on the “super info-highway data freeway thingamajig” with your killer 300bps acoustic coupler are over. Today’s world simply requires users to know and understand alittle about how their machines operate on the network. They don’t need an indepth knowledge of TCP/IP. They don’t need to be CCNE’s. They **DO** need to understand that programs will try and reach them across the internet and not all of those programs are nice. They **DO** need to understand that not ALL of the programs on their machine need to have access to the Internet. If folks can’t grasp those two ideas then perhaps they need to reconsider getting online.

Joel Stein…Blue Pill Person

Wednesday, January 25th, 2006

Joel Stein’s editorial in the LA Times was something I tried to read but the ignorance and self righteous drivel smelled to bad. I got the point quickly. He’s another one of those folks who doesn’t even consider the US Military useful. He would probably be in favor of severe cuts in DoD funding like a certain Georgia peanut farmer. I pretty much ignored the drivel as just that drivel.

Today, while scanning Memeorandum, I saw the maelstrom that was created by his bit of “writing” and checked out some links. For starters, he was interviewed by Hugh Hewitt and Radioblogger has an MP3 as well as the transcript. Just reading the transcript isn’t good enough…you REALLY need to hear the interview to get a handle on the job Hewitt did on this guy. Mr. Stein, here’s your lunch, hat, and ass back.

And then, as if Hewitt didn’t disassemble Mr. Stein already, The American Thinker has a letter from LTC Steve Russell, Commander Task Force 1/22nd Infantry (the folks that dragged Hussein from his hole). Normally I would just leave the link and be done with it but the good Colonel’s letter is SO dead on I’m going to post the whole thing.

Mr. Stein’s commentary on soldier support is remarkable because it reflects more than just his opinion. It may even express a viewpoint.

While most of Mr. Stein’s commentary is indicative of a man who has enjoyed our freedoms with none of the responsibility (by his own admission), he has at least one point of merit. He does not conceal his true conviction. When one considers those that say they support the troops but not the war, it is hard to distinguish which is more harmful to the soldier.

Mr. Stein alludes to this as trying to have it both ways and implies this is a moral cop out. He may be right. It can also be viewed as similar to telling the trash man, “Thanks.” It is seldom sincere. It is just so the trash will keep being taken away by someone willing to do it so one does not have to get his hands dirty.

Mr. Stein’s tragedy is not his clear conviction but rather that he steals freedom from his sacrificing countrymen. He sees no moral dilemma with that—which is indicative of an attitude prevalent among some self-proclaimed, high-browed, educated types that believe there is somehow a moral superiority in non-involvement. To defend his position, Mr. Stein is critical of what he calls ‘American imperialism.’ To borrow what he surely intended as a denigrating analogy, we can indeed see parallels in attitude if not government and conquest.

Rome had its internal critics. So did Greece. But when the vast majority of Romans began to view the finer points of life as morally superior to the lower points of necessity, Roman youth lost their appreciation for what held Rome together in the first place. Soon, hired or conquered levies replaced Romans in the ranks. Why should Romans fight wars that they could not see any reason for fighting? After all, what impact did they have in Rome?

Eventually, the theory of a moral superiority in non-involvement met the cold steel of non-theoretically superior sword thrusts from Vandals and Huns that replaced Romans in the Roman empire.

I take exception to Mr. Stein’s comment about soldiers ignoring their morality. And as a soldier that has served in Kosovo, Afghanistan and Iraq, none of those experiences ever made me feel ‘lucky.’ The noble ‘wars’ and ‘fights’ are seldom noble for the soldier. They involve pain and human suffering on a grand scale. Mr. Stein I am quite certain has never killed a man and is proud of that. I have had to kill several men in desperate, close combat while I watched my opponents facial expressions change as life ebbed out of them. I am quite certain that I am not proud of that.

But what separates him from me is certainly not education. Nor is it conviction of purpose. It is indeed morality. But of a nobler kind. No greater love has a man, than he lay down his life for his friends—even when they act and write unfriendly.

As an American, I no longer draw a distinction of who qualifies to be one or is best suited to appreciate democracy. After serving nine years overseas and on multiple continents, I do not see white or black or Hispanic or Indian or oriental or educated or simple-minded Americans. I only see Americans. Even the unfriendly kind. And when I am old, I will be able to look in the mirror and know that I acted on my convictions to preserve what others will not. Cannot. Do not. And what I will see is a man with a clear conscience and a moral sense of purpose.

I am thankful I do not have to look into Mr. Stein’s mirror.

LTC Steve Russell

And, on Hewitt’s blog he posts a note from a member of our military.

Hugh, Only one word can describe how I feel after reading the editorial by Mr. Stein – sadness. Sadness that such ingorance is still so prevalent in such an educated (at least I want to believe we are educated) society. I am on my 3rd year of active duty deployment since 11 Sep 01. I served 9 years in the Navy during the Cold War, both in Desert Shield and Desert Storm. My son Adam, who graduated high school in 2004, is currently stationed near An Najaf, and, by the way, reenlisted for 5 years while in country. He had other alternatives and opportunities and I even tried to steer him in a different direction. Yet, he joined and serves willingly, as do I. By the way, Hugh, lest folks like Mr. Stein think we soldiers are an ignorant lot, I happen to have a bachelors degree in computer science from the esteemed Chapman University of Orange California. I worked 10 years as a software engineer for various companies such as Rockwell, The Soma Group, DCA Services Inc., COM2001, etc. I am working on my masters in homeland security/information security. One of the sergeants in the battalion I previously served with had his doctorate in education. Most soldiers are working on higher education even as they serve in the combat zone. Some of the brightest, best thinkers I have met have been in the military. Ignorant? Stupid? Duped? Foolish? Hardly. I can tell you this, Hugh, we serve because we understand the world around us, we understand reality, and we understand that the best defense is a darn good offense. Hugh, thanks for the interview with Mr. Stein – you certainly laid bare his depth of knowledge and understanding of not only the military, but the realities of the world in general. And should he care to experience some military training first hand, he can contact me at the below numbers or this email. We have a lot of infantry field training coming up this year and we can certainly find a place for him for a couple of days, and I will personally serve as his escort if he agrees. Consider it an open invitation. Best Regards, SSG A. B.

Hewitt says that if Mr. Stein is interested, he will facilitate the meeting. You might want to drop Mr. Stein a note, care of the LA Times, and encourage him to participate.

NYTimes earning plunge? SHOCKED!

Tuesday, January 24th, 2006

Fancy that, the NYCrimes earnings have plummeted. I bet they are scratching their little empty heads about that one. “Gee, we attacked the troops at every turn!” they whine. “We even distort their final letters home when they are killed by the ‘dissidents’ in Iraq!” they cry. “We have made every effort to undermine the country!” they stammer. “Why oh WHY are we slowly going under?”. **sigh** Perhaps this is why.

But, what can you expect from this treasonous fishwrap. If their readership continues to drop along with their profits they will begin paying US advertising dollars to line our bird cages with their despicable rag.

Tracphones? I’ll have 60 please

Friday, January 13th, 2006

Well well well Mr. Risen, sure this has nothing to do with your book…er…SCOOP huh? Tracphones are wonderful for parents who want to have contact with their kids without the fear of their kids running up huge cell bills. They are also great for blowing up subway trains and other things.

Mr. Risen, you broke the story of the NSA program where our government was monitoring telephone calls from and to suspected barbarians. Cell and land line phones are easy to sniff…except for these tracphones. I just wonder what these particular barbarians were going to do with 150 tracphones. It would be all but impossible to track them. Say each barbarian has four or five phones and the rotate them every five days. Impossible to find let alone monitor.

This particular bunch of barbarians were captured by sharp eyed and quick witted Walmart and Target employees. What about the others who are doing the same thing, possibly right there in Gotham, and are NOT getting caught? What about those who are getting them online?

Mr. Risen, you do realize of course that your actions may well have contributed to this, right? Your blue pill mentality has put us all at risk just so you could sell a few pathetic books. Thanks Mr. Risen, the blood is on your hands.