Archive for the ‘Geek’ Category

Urgent security news!

Friday, December 22nd, 2017

The iPhone X’s FaceID can be bypassed using “specially prepared printouts of photographs”! Gott in Himmel! Doesn’t this make the feature useless?

Oh, wait. Did I say “iPhone X FaceID”? I’m sorry. I meant “Windows Hello facial recognition”. My bad.

Obit watch: September 18, 2017.

Monday, September 18th, 2017

I don’t know exactly why this surprises me, but for the historical record: NYT obit for Jerry Pournelle.

The obit is actually pretty respectful (if a week late) and covers his work as a computer columnist almost as much as it does his SF writing.

Obit watch: September 9, 2017.

Saturday, September 9th, 2017

Dr. Jerry Pournelle, noted SF writer and longtime computer columnist for Byte magazine back in the day.

Official website. Lawrence. Borepatch.

I don’t have a lot to add here. I never met Dr. Pournelle, and I don’t think I’ve read any of his solo SF. I’m spotty on his collaborations with Larry Niven, though the ones I have read I think are better than Niven’s solo work.

I enjoyed his Byte column, though at the time some of his recurring tropes did kind of grate on my nerves. (See also: Gregg Easterbroook.)

(For the younger set, and/or those who may not know: the Internet Archive has a large digital collection of Byte.)

I’m very fond of Oath of Fealty. And I believe Lucifer’s Hammer has been a huge influence on a lot of people (including me, somewhat),

The only other thing I have to say is: I’m ordering a copy of The Survival of Freedom, as my personal tribute to the good doctor.

Also among the dead: Don Williams, noted country musician.

Troy Gentry, also a country musician with Montgomery Gentry, was killed in a helicopter crash yesterday.

And finally, Rick Stevens, not a country musician, but a funk-soul one. He sang with the group Tower of Power, and did the lead vocal on “You’re Still a Young Man” from the 1972 album “Bump City”.

Then he got into heroin and other drugs. Over about a two-day period in 1976, he killed three men. He was convicted of murder and sentenced to death, but California declared the death penalty unconstitutional and he was resentenced to life. He was paroled in 2012 and started working again.

In January 2013 his old band brought him onstage at the Oakland club Yoshi’s to sing his signature song.
“When he got back onstage with Tower of Power for the first time in 40 years,” Mr. Maloney said, “he felt like he was levitating. That’s what he told me.”

While he was in prison, he became a Christian. He also did counseling and mentoring for other inmates, and formed prison bands.

He remained remorseful for the deadly events of 1976, which he said occurred during a time in his life when he was going from one drug high to another and not thinking clearly — “a jackass in a jumpsuit,” he would describe himself years later. When he began performing again after his release from prison he was realistic about his past.
“I know a lot of people won’t forget,” he said in a 2013 interview. “I won’t forget.”

Not exactly an obit, but:

Leslie Van Houten, who was convicted along with other members of Charles Manson’s cult in the 1969 killings of Leno and Rosemary LaBianca, was granted parole Wednesday by a panel of state commissioners in Chino.

Her parole still has to be approved by the governor. Jerry Brown rejected her bid for parole last year.

Quote of the day.

Wednesday, August 30th, 2017

We have sort of a trifecta today, because we can’t choose. All three by way of the Hacker News Twitter, the first two from the same source:

“Blindly trusting authority to make our ethical decisions for us is the best way to separate ourselves from the Nazis!”

The IRB listened patiently to all this, then said that it had to be in pen. You know who else had people sign consent forms in pencil…?

The third one really isn’t a quote of the day. You should just read the whole thing: “Laser Products I Hate”. Including why you shouldn’t give money to Kickstarter for that Cubiio piece of crap.

Drainage!

Tuesday, August 29th, 2017

By way of Patrick Non-White: a series of tweets from Matt Corbett‏ about how flood planning and storm runoff works in Houston.

If you click on that first one, you should be able to follow the rest of the (long) thread from there, though you might have to skip over some stuff about cheerleading.

I’m also not an expert, and haven’t lived in Houston for (mumble mumble) years now, but this fits in with what I do know. I especially appreciate his discussion of the evacuate/don’t evacuate decision: it was more than just partisan politics, it also involved differing sets of priorities.

Now I’m only falling apart…

Monday, August 21st, 2017

Late night thoughts.

Wednesday, August 16th, 2017

I was talking with a friend a couple of weeks ago, and she said something that triggered a mental connection. And then some other stuff happened that triggered some more connections. This is another one of these posts where I was thinking out loud when I wrote this, please forgive me if it goes astray.

I didn’t live back in the old days – 30s – 60s – but my impression (based on what I’ve read) is that, as a child, you were valued somewhat based on physical skills. That is, you were expected to be able to run, hit, and catch reasonably well. (Ruark talks about this a little in The Old Man and the Boy.) If you couldn’t, you were looked down upon by your peers. If you were actually physically incapable (lost a leg or an arm) you may have been looked upon with some pity rather than condescension, but there was still a feeling that the non-physically skilled were somehow inferior. It seems like that lasted well into the 1970s and possibly even into the late 80s.

(Question: what were the expectations for girls? I don’t have a good answer, not ever having been a girl.)

At some point, this changed. Physical skill, while still valued, began to be supplanted by other skills, specifically video games. If you couldn’t run, hit, or field well, being good at rescuing the princess from another castle or whatever the frack Sonic did could still gain you some level of respect. I don’t know exactly when this change started: I feel like it was after I went off to college, but before things changed again.

I still see parents getting their kids into sports, but soccer seems to be the thing now. And that seems to me to be less about the sport – there’s not that much talent required, just run and kick ball – and more about tiring the little s–ts out for a while so Mommy and Daddy can get stuff done. (There are other exceptions, such as Little League and youth football, but I have the impression that those sports are driven by parental nostalgia. “I loved Little League when I was a kid! Surely my kid will love it, too!”)

The third change was the growth of the Internet. Once that became commonplace and everywhere, it didn’t matter if you could run, hit, field, or what you were good at. If you had some kind of specific area of interest – something you were good at, something you were obsessed with – the Internet enabled you to find people just like you. Nobody knew you were a dog, or an awkward teenage boy. We accept you, one of us, one of us.

I used to think that was a good thing. I still do: I think it’s great that those awkward teenagers can find people who are just like them. I think the Internet has done a wonderful job helping people who are shut-in or disabled or just socially awkward interact with others. I think it’s incredibly empowering, and a good antidote to bullying and ostracism.

But recent events have me wondering: have we also built a bunch of individual echo chambers? Now that everyone can find people just like them, have we devalued social interaction and the ability to get along with other, different people? Are we raising generations of otaku?

I don’t want to seem like a cranky old man longing for a return to the good old days. There were bullies and thugs and cheaters and generally not nice people back then, there are now, and there always will be. “There were no formerly heroic times, and there was no formerly pure generation.”

But could this be part of the reason why we have LARP Nazis?

Obit watch: August 14, 2017.

Monday, August 14th, 2017

Dr. Cathleen Morawetz passed away a week ago Tuesday. She wasn’t someone I had ever met or heard of before the Times published her obit, but she sounds like an incredibly neat person that I wish I had known.

Much of Dr. Morawetz’s research centered on equations that describe the motion of fluids and waves — in water, sound, light and vibrating solids. One of her first notable papers helped explain the flow of air around airplanes flying close to the speed of sound.

Wings can be designed so that transonic airflow remains smooth at certain speeds without generating shock waves. But Dr. Morawetz’s work demonstrated that such shock-free wings do not work in the real world. The slightest perturbation — an imperfection in the shape, a tilt in the angle of the wing, a gust of wind — disrupts the smooth flow.

I wonder if there’s a relationship between this and chaos theory, but this is way outside anything I’ve ever studied.

In later work Dr. Morawetz studied the scattering of waves off objects. She invented a method to prove what is known as the Morawetz inequality, which describes the maximum amount of wave energy near an object at a given time. It proves that wave energy scatters rather than lingering near the object indefinitely.

She was 94.

In addition to her husband, Dr. Morawetz is survived by three daughters, Pegeen Rubinstein, Lida Jeck and Nancy Morawetz; a son, John; a sister, Isabel Seddon; six grandchildren; three great-grandchildren; and four step-grandchildren.

Obit watch: August 8, 2017.

Tuesday, August 8th, 2017

For the historical record: NYT obit for Mark White.

Ernst Zündel, scummy Nazi Holocaust denier and the center of two criminal trials in Canada.

Richard Dudman passed away at the age of 99, surprisingly. I say “surprisingly” because, as a journalist for the St. Louis Post-Dispatch he led an interesting and dangerous life:

Mr. Dudman’s career in journalism lasted more than three quarters of a century. He was in Dallas when President John F. Kennedy was assassinated and, after oversleeping and missing a flight back to Washington, dropped by the police station where Lee Harvey Oswald was being held and watched as he was gunned down by Jack Ruby.

He covered other wars all over the world, including Vietman. He was responsible for the P-D publishing part of the Pentagon Papers. In 1970, he and two other journalists were taken hostage by the Vietcong and spent 40 days as prisoners before being released.

In 1978, he and two other journalists got an “interview” with Pol Pot (though the “interview” was more like Pol Pot haranguing them through translators for several hours). Then someone tried to kill the three journalists.

He had a motto: “Reporter who sits on hot story gets ass burned.”

David E. H. Jones passed away a few weeks ago. That name may ring a small bell for some of you: he was a chemist and professor, as well as a professional writer.

Dr. Jones, who died at 79 on July 19 in Newcastle upon Tyne in northeastern England, wrote hundreds of irreverent columns about Daedalus for two sacrosanct journals: New Scientist, in a column named for Ariadne, the mistress of the labyrinth, and Nature, in a column called Daedalus.

Back in the old days, I used to spend time in the university library reading New Scientist, and Dr. Jones’s column was always the first thing I flipped to.

DEFCON 25/Black Hat updates: July 28, 2017.

Friday, July 28th, 2017

Round 2:

  • The white paper for “Free-Fall: Hacking Tesla from Wireless to CAN Bus” (Ling Liu, Sen Nie, Yuefeng Du) is here. Slides here.
  • Slides for “Exploiting Network Printers” (Jens Müller, Vladislav Mladenov, Juraj Somorovsky, Jörg Schwenk) are here.
  • Found slides for “Breaking Electronic Door Locks Like You’re on CSI: Cyber” here. (I called this one wrong: no Bluetooth. Not a complaint, just an observation.)
  • This is one that I saw, overlooked, and now am intrigued by: “All Your SMS & Contacts Belong to ADUPS & Others“. “Our research has identified several models of Android mobile devices that contained firmware that collected sensitive personal data about their users and transmitted this sensitive data to third-party servers in China – without disclosure or the users’ consent.” Slides. White paper.
  • Slides for Vlad Gostomelsky’s “Hunting GPS Jammers”. I think this is one that really needs video, too.
  • “Intercepting iCloud Keychain” (Alex Radocea) slides.
  • And “The Future of ApplePwn – How to Save Your Money” (Timur Yunusov) slides.
  • And (hattip to Mr. Yunusov) “Jailbreaking Apple Watch” (Max Bazaliy). I haven’t compared these slides to the onea on the presentations server, just FYI.

Okay, lunch time is almost over, and I feel like I’ve done enough damage to the security community today. I’ll try to have more updates later today or tonight.

DEFCON 25/Black Hat updates: July 27, 2017.

Thursday, July 27th, 2017

Round 1:

Edited to add more:

  • Karla Burnett’s “Ichthyology: Phishing as a Science” is actually relevant to my professional life. White paper.
  • Slides and the white paper for “Hacking Hardware with a $10 SD Card Reader” (Amir Etemadieh, CJ Heres, and Khoa Hoang) are here.

DEFCON 25: 0 day notes.

Tuesday, July 25th, 2017

I’m not going again this year. Maybe next year, if things hold together. But if I were going, what on the schedule excites me? What would I go to if I were there?

Thursday: neither of the 10:00 panels really grab me. At 11:00, maybe “From Box to Backdoor: Using Old School Tools and Techniques to Discover Backdoors in Modern Devices” but I’m at best 50/50 on that. At 12:00, I feel like I have to hit the “Jailbreaking Apple Watch” talk. “Amateur Digital Archeology” at 13:00 sounds mildly interesting.

Not really exited by anything at 14:00. At 15:00, I suspect I would end up at “Real-time RFID Cloning in the Field” and “Exploiting 0ld Mag-stripe information with New technology“. And 16:00 is probably when I’d check out the dealer’s room again, or start getting ready for an earlyish dinner.

Friday: 10:00 is sort of a toss-up. THE Garry Kasparov is giving a talk on
The Brain’s Last Stand” and as you know, Bob, chess is one of my interests. On the other hand, there’s also two Mac specific talks, and Kasparov’s talk is probably going to be packed: I suspect I’d hit “macOS/iOS Kernel Debugging and Heap Feng Shui” followed by “Hacking travel routers like it’s 1999” (because I’m all about router hacking, babe). Nothing grabs me at 11:00, but I do want to see “Open Source Safe Cracking Robots – Combinations Under 1 Hour!” at 12:00:

By using a motor with a high count encoder we can take measurements of the internal bits of a combination safe while it remains closed. These measurements expose one of the digits of the combination needed to open a standard fire safe. Additionally, ‘set testing’ is a new method we created to decrease the time between combination attempts. With some 3D printing, Arduino, and some strong magnets we can crack almost any fire safe.

13:00: “Controlling IoT devices with crafted radio signals“, and “Using GPS Spoofing to control time” at 14:00. (I do want to give a shout-out to the Elie Bursztein talk, “How we created the first SHA-1 collision and what it means for hash security“, though.)

Do I want to go to “Phone system testing and other fun tricks” at 15:00? Or do I want to take a break before “Radio Exploitation 101: Characterizing, Contextualizing, and Applying Wireless Attack Methods“:

As we introduce each new attack, we will draw parallels to similar wired network exploits, and highlight attack primitives that are unique to RF. To illustrate these concepts, we will show each attack in practice with a series of live demos built on software-defined and hardware radios.

And then at 17:00, “Cisco Catalyst Exploitation” is relevant to my interests. However, I don’t want to dismiss “The Internet Already Knows I’m Pregnant“:

…EFF and Journalist Kashmir Hill have taken a look at some of the privacy and security properties of over a dozen different fertility and pregnancy tracking apps. Through our research we have uncovered several privacy issues in many of the applications as well as some notable security flaws as well as a couple of interesting security features.

Saturday: Nothing at 10:00. At 10:30, maybe “Breaking Wind: Adventures in Hacking Wind Farm Control Networks” because why not?

I have to give another shout-out to “If You Give a Mouse a Microchip… It will execute a payload and cheat at your high-stakes video game tournament” but I’m personally more interested in “Secure Tokin’ and Doobiekeys: How to Roll Your Own Counterfeit Hardware Security Devices” at 11:00. (“All Your Things Are Belong To Us” sounds pretty cool, too, but I’d probably wait for the notes/repos/etc. to be released rather than attending in person.)

Oddly, there’s really nothing that grabs me between 12:00 and 15:00. At 15:00, “Tracking Spies in the Skies” mildly intrigues me (mostly for the ADS-B aspect), while at 16:00 I’m really excited by “CableTap: Wirelessly Tapping Your Home Network” (more home router hacking! Hurrah!)

At 17:00:

In this talk, we explore the security of one of the only smart guns available for sale in the world. Three vulnerabilities will be demonstrated. First, we will show how to make the weapon fire even when separated from its owner by a considerable distance. Second, we will show how to prevent the weapon from firing even when authorized by its owner. Third, we will show how to fire the weapon even when not authorized by its owner, with no prior contact with the specific weapon, and with no modifications to the weapon.

You have my attention.

(Related article from Wired. Presenter’s Twitter feed.)

Sunday: “I Know What You Are by the Smell of Your Wifi“, followed a little later by “Backdooring the Lottery and Other Security Tales in Gaming over the Past 25 Years“.

Weirdly, after that, there’s nothing that interests me until the closing ceremonies at 16:00. (Though I might go to “Man in the NFC” if I was there.)

This seems like a very low-key year, and I’m not sure why. I don’t see any Bluetooth related stuff, and very little lock related. Perhaps I should be glad I’m skipping this year.

Anyway, you guys know the drill: if you see a talk you’re interested in, leave a comment and I’ll try to run it down. If you’re a presenter who wants to promote your talk, leave a comment and I’ll try to give you some love.