This is a catch-all for random and undifferentiated thoughts that didn’t make it into my previous NRAAM reports. I’ll put in a jump, since this is running long…
Archive for the ‘linux’ Category
Random notes toward an after action report: Dallas.
Tuesday, May 8th, 2018Day one notes.
Friday, May 4th, 2018Never do a LINUX distro upgrade while on the road.
The NRA convention is huge: 15 acres. Tulsa is 11, for comparison. We were afraid we wouldn’t be able to see everything: it takes two days to get through Tulsa, and much of that is at a dead run.
But we spent the early part of the morning with Karl of KR Training, who only had a few hours for the show. And we saw quite a bit of it, albeit at a dead run again. But we’ve also got time to go back to the stuff we didn’t get a chance to consider thoughtfully, and we did do slower browsing of a significant part of the show this afternoon. While NRA is bigger than Tulsa, it is also much less densely packed, which makes things easier. We even have time to hit some of the seminars.
Most interesting thing I saw today: My Case Builder. You go on their website. They have a tool that allows you to layout your own custom foam insert. You can use their predefined shapes (about 1200, they claim) or you can use another tool to “trace” an item and input dimensions. Once you’re done, they’ll custom cut a foam insert either for a new case (which you can purchase through them) or an existing case you already have of any brand.
Seen much, much less than I expected: scout rifle scopes. Leopold had none in their display. I did see two Leopold scout scopes, but they had no model markings on them and they were both attached to scout rifles at the Savage and Steyr booths. Vortex had one that looks promising.
Purchased: a spring kit from Apex Tactical for a J-frame. $20 plus whatever it will cost me to have a smith put it in.
Noted: Robert K. Brown was selling autographed copies of his biography, I Am Soldier of Fortune: Dancing with Devils, which I was previously unaware of. May have to go back and pick one up.
Bookmarks.
Saturday, September 17th, 2016Two things I found on the YCombinator Twitter feed that I want to bookmark:
“JavaScript Systems Music”. I’m not really good at music in general, nor am I the audio guy of my group of friends (Hi, Todd!). But I am kind of generally interested in computer audio, and the subtitle of this one sucked me in: “Learning Web Audio by Recreating The Works of Steve Reich and Brian Eno”. Yes, you can do in JavaScript what Steve Reich did with tape loops in 1965.
I like “It’s Gonna Rain”, but, yeah, this.
YComb also linked to an article here, but I actually find the whole site interesting and want to bookmark it: Gary McGath’s “Mad File Format Science”. Or everything you ever wanted to know about file formats, identifying them, and recovering data from them.
As you know, Bob, I’m not a “Star Trek” fan, but I did find this interesting:
The floppies were written on CP/M systems custom built for Roddenberry with special disk drivers.
“DriveSavers took three months to reverse engineer the disk format.”
Anyway, I want to spend more time exploring this site. I’m also tempted to spring for his udemy course: $20, open-source tools, and hey! I can actually make a case that it is job related!
Cahiers du cinéma: September 11, 2016.
Sunday, September 11th, 2016We were watching movies last night, and a question came up. I don’t remember the exact context, but basically: was The Paper Chase actually John Houseman’s first film?
The answer turns out to be: yes, and no, and it’s interesting.
Before The Paper Chase, Houseman is listed as having an uncredited (and I assume small) role in the film adaptation of Seven Days In May.
But before that, in 1938, Houseman was in something called Too Much Johnson. Just the name sparked immense hilarity among our little group (though to be fair, it was also late) but there’s an interesting story here. Too Much Johnson was never shown in public while Houseman was alive…
As most of my readers probably know, long before he was Professor Kingsfield, Houseman had quite a stage career. Among his other credits, he was a leading member of Orson Welles’ Mercury Theatre. Welles had an idea: he wanted the Mercury Theatre to do an adaptation of a 1894 comedy, also called “Too Much Johnson”, by William Gillette. But he also wanted to integrate a silent film into the stage production.
There’s some very funny stuff about Welles editing the film, in his hotel suite, while up to his knees (according to Houseman) in nitrate film. Another of Welles collaborators recalls the film catching fire in the projector, Welles being so absorbed in the editing he didn’t even notice…
Anyway, they put the film together and went to stage “Too Much Johnson” at a place called the Stony Creek Theatre in Connecticut before they took it to Broadway. But there was a problem: the ceiling in the Stony Creek Theatre was “too low” for film projection. So the Mercury Theatre staged “Too Much Johnson” without the movie part. Depending on who you believe, the audience reaction was poor. In any case, Welles shelved the “Too Much Johnson” project before he finished editing it: in later years, he claimed that he’d looked at the stored footage, and it still looked pristine. But that footage was destroyed in a 1970 fire at Welles home, and the movie was presumed lost…
…until 2008, when a copy was discovered in Spain. The film was restored and shown for the first time in late 2013. In 2015, the combined film/stage production was staged for the first time. And now you can watch the 66 minute work print and reconstructed 34 minute edit of “Too Much Johnson” at the National Film Preservation Foundation website.
This is probably too much “Too Much Johnson” for most of you, but I make no apologies for my interest in Welles and his work, and I think this is a great story even without Welles and Houseman.
After the jump, topic changes…
DEFCON 24 updates: August 8, 2016.
Monday, August 8th, 2016- Slides from the Jay Beale and Larry Pesce talk “Phishing without Failure and Frustration” are up here at the InGuardians website.
- At the same site, a talk Jay Beale gave in the Packet Capture Village, “Adding Ramparts to Your Bastille: An Introduction to SELinux Hardening”.
- Slides for Max Bazaliy‘s “A Journey Through Exploit Mitigation Techniques in iOS” are here.
- Haven’t found slides yet, but the tools from Salvador Mendoza’s “Samsung Pay: Tokenized Numbers, Flaws and Issues” are here.
- Patrick Wardle‘s “I’ve got 99 Problems, but Little Snitch ain’t one” slides are here.
More on Blue Hydra.
Sunday, August 7th, 2016Earlier, I wrote “It runs! It works! Mostly. Kind of.”
I’ve been banging on Blue Hydra in my spare time since Thursday, and I stand by that statement. Here’s what I’ve run into so far.
The README is pretty clear, and I didn’t have any problems installing the required packages. (I don’t have an Ubertooth, so I skipped that one. We’ll come back to the Ubertooth later.)
First problem, which was actually very tiny: I know next to nothing about Ruby, other than that cartoon foxes are somehow involved, so the phrase “With ruby installed add the bundler gem” was more like “I don’t speak your crazy moon language”. Google cleared that up pretty quickly: the magic words are gem install bundler.
Next problem: running bundle install resulted in an error stating that it couldn’t find the Ruby header files. It turns out that, while my Ubuntu installation had Ruby 2.1 installed, it didn’t have the ruby-dev package installed. sudo apt-get install ruby-dev fixed that issue.
Next problem: the SQLIte Ruby gem failed to install when I ran bundle install. It turns out that I also needed the sqlite3-dev package as well. And with that installed, the bundle built, and I could do ./bin/blue_hydra.
Which gave an error stating that it didn’t have permissions to open a handle for write. Okay, let’s try sudo ./bin/blue_hydra (because I always run code from strangers as root on my machine; everyone knows strangers have the best candy). And that actually worked: Blue Hydra launched and ran just fine. In fairness, this may be a configuration issue on my machine, and not an issue with the software itself.
In playing with it, I’ve found that it does what it claims to do. Sort of. It’s been able to detect devices in my small lab environment with Bluetooth discovery turned off, which is impressive. I also like the fact that it stores data into an SQLite database; other Bluetooth scanning tools I’ve played with didn’t do that.
However, it seems to take a while to detect my iPhone; in some instances, it doesn’t detect it at all until I go into Settings->Bluetooth. Once I’m in the Bluetooth settings, even if I don’t make a change, Blue Hydra seems to pick up the iPhone. Blue Hydra also has totally failed to detect another smart phone in my small lab environment (and I have verified that Bluetooth was both on and set to discoverable.)
Now, to be fair, there may be some other things going on:
- I’ve also observed previously that Bluetooth under Ubuntu 15.10 didn’t work very well. At all. So at one point on Saturday, just for giggles, I upgraded Project e to Ubuntu 16.01.1 LTS. And shockingly (at least for me) Bluetooth works much much better. As in, I can actually pair my phone with Ubuntu and do other Bluetooth related stuff that didn’t work with 15.10. That seems to have mitigated the discovery issues I was seeing with Blue Hydra a little, but not as much as I would have liked. (Edited to add 8/8: Forgot to mention: after I upgraded, I did have to rerun
bundle installto get Blue Hydra working again. But the second time, it ran without incident or error, and Blue Hydra worked immediately aftewards (though it still required root).) - I was using the Asus built-in Bluetooth adapter in my testing. Also just for giggles, I switched Blue Hydra to use an external USB adapter as well. That didn’t seem to make a difference.
- In fairness, Blue Hydra may be designed to work best with an Ubertooth One. The temptation is great to pick one of those up. It is also tempting to pick up a BCM20702A0 based external adapter (like this one) partly to see if that works better, partly because I don’t have a Bluetooth LE compatible adapter (and this one is cheap) and partly because the Bluetooth lock stuff is based on that adapter. (Edited to add 8/8: I’m also tempted by this Sena UD100 adapter. It is a little more expensive, but also high power and has a SMA antenna connector. That could be useful.)
- It may also be that I have an unreasonable expectation. Project e is seven years old at this point, and, while it still runs Ubuntu reasonably well, I do feel some slowness. Also, I think the battery life is slipping, and I’m not sure if replacements are available. I’ve been thinking off and on about replacing it with something gently used from Discount Electronics: something like a Core i5 or Core i7 machine with USB3 and a GPU that will work with hashcat. Maybe. We’ll see. Point is, some of my issues may just be “limits of old hardware” rather than bugs.
- And who knows? There may very well be some bugs that get fixed after DEFCON.
tl, dr: Blue Hydra is nice, but I’m not yet convinced it is the second coming of Christ that I’ve been waiting for.
DEFCON 24 notes: Hail Hydra!
Thursday, August 4th, 2016GitHub repository for Blue Hydra.
I’m jumping the gun a little, as the presentation is still a few hours away, but I wanted to bookmark this for personal reference as well as the enjoyment and edification of my readers.
Edited to add: quick update. Holy jumping mother o’ God in a side-car with chocolate jimmies and a lobster bib! It runs! It works! Mostly. Kind of.
If I get a chance, I’ll try to write up the steps I had to follow tomorrow. Yes, this blog is my personal Wiki: also, while the instructions in the README are actually pretty good, I ran into a few dependency issues that were not mentioned, but are documented on Stack Overflow.
New toy! New project!
Saturday, April 9th, 2016I was out and about earlier today with my mom and my nephew: we stopped by Hobby Lobby because I was looking for something. I’ll be posting about that something later on, but while we were there, I found one of these and ended up getting a screaming deal on it with the 40% off coupon.
Which is great, but that looks like a manual control box, right? How do you control it with a PC? Lots of soldering and a custom circuit board?
Ah. Nope. They have a USB device interface for the OWI-535. Isn’t that nifty?
But wait! The included software only runs on a PC! How do you control it with a Mac, or a LINUX system?
Surprise! People have reverse-engineered the control protocol! For example, this guy! (I love that blog title, by the way.) It looks like most of the other control examples I’ve found all loop back to Vadim Zaliva’s work documenting the protocol for the OWI-535. (He’s also documented the control protocol for the OWI-007 here.)
And look! Here’s control code in Python. running on a Raspberry Pi! Isn’t that a clever cleaver!
We’ll see if I can get the arm together and working without breaking it. Bad news: I don’t have that much mechanical aptitude. Good news: they claim all you need is needle-nosed pliers, diagonal cutters, and a Phillips screwdriver. No soldering required, which is good. I could probably solder my way out of a paper bag if someone held a gun to my head, but I’ve never been what you could call “good”, or even “competent” at it…
(As a side note, I’ve been trying to get back to “Talkin’ GPS Blues“. Unfortunately, I also decided to upgrade Project e to Ubuntu 15.10…and Bluetooth apparently doesn’t work well on 15.10, at least as of when I completed the upgrade. So once I get Bluetooth working again, and have some more time, I intend to revisit GPS, this time with some skanky Perl, Python, and possibly even Java code. We’ll see.)
DEFCON 23 notes: August 7, 2015.
Friday, August 7th, 2015I kind of skipped over yesterday, because Thursday is traditionally slow. And it is a little early for stuff to be up today, plus many of the good presentations are scheduled for tomorrow.
But! BlackHat 2015! Not everything from BlackHat gets duplicated at DEFCON, and vice versa, but there’s always some overlap. Some things that are already up:
- “When IoT Attacks: Hacking a Linux-Powered Rifle”, the Runa Sandvik and Michael Auger talk about the TrackingPoint rifles. Slides here.
- Colby Moore’s “Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service”, one of the talks I was interested in. Slides. Summary.
- “Switches Get Stitches”, by Cassidy, Leverett, and Lee, about vulnerabilities in industrial Ethernet switches. This was one of my backup talks, in case the primary was full. Slides.
- I mentioned Sean Metcalf’s “Red vs. Blue: Modern Active Directory Attacks & Defense” in passing. Slides. White paper.
- Not one I think I mentioned, but Marina Krotofil’s “Rocking the Pocket Book: Hacking Chemical Plant for Competition and Extortion” might be of interest to some of you. Slides. White paper.
There are a couple of other overlaps I’ve found (specifically the Josh Drake presentation on Stagefright and the Valasek/Miller car exploit) but those don’t have any slides or other material attached yet.
More links and stuff as and when I find it and am able to post.
Edited to add: Just noticed this on the DEFCON 23 site. Download the conference CD optical disc here. Woo hoo woo hoo hoo. (The .rar file is 419 MB. Good thing I work for a networking company.)
On the road again…
Monday, June 2nd, 2014Heading home. Travel day. In the meantime:
1. Go read this post by Tam. There are echos in it of something some less smart person wrote a couple of years ago.
2. I didn’t realize until the middle of last week that this year is the 50th anniversary of the .41 Magnum. (Ask me about my Model 57.)
3. I took a fair number of photos yesterday while running around with my aunt and uncle (who graciously drove the two hours each way from Cleveland to spend part of the day with me; thanks again, guys!). I’m waiting until I get back to do the post-processing and uploading, but I thought I’d throw one up here that I played with last night.
I took this with the D40X and the 18-55 kit zoom. It was cropped and the exposure adjusted slightly using Shotwell on Project e. I’m actually pretty happy with the end product, though I may make a second pass over it once I’m in front of iPhoto.
Ubuntu blues.
Saturday, August 17th, 2013Documenting this here for the record.
I think I have finally resolved the “the system is running in low graphics mode” error I’ve been getting on Project e (which, I will remind you, is an Asus 1005HA with an integrated Intel 950 graphics adapter) since upgrading to Ubuntu 13.04.
This particular document is comprehensive and ultimately useless. I tried every suggestion in it, with no success at all.
What finally seems to have resolved the problem was a suggestion in this thread. Specifically, brucey99’s suggestion to edit /etc/init/lightdm.conf and add
sleep 10
above
exec lightdm
seems to have done the trick. (I used “sleep 20” instead of “sleep 10”. What’s the harm, 10 seconds more boot time? I can always change it later.)
It also seems like the
sudo service lightdm restart
command from a terminal window works to get things back to normal if the machine does start in low graphics mode.
And I’m not sure it made any difference, but just to document: I also created a xorg.conf file (from xorg.conf.failsafe) and edited the “Device” section:
Section "Device"
Identifier "Intel Graphics"
Driver "intel"
Option "AccelMethod" "UXA"
EndSection
After restarting about a half-dozen times, it hasn’t come up in low graphics mode yet. I’ll see how it goes.
As David Brin once said, “Let the next guy know what killed you.” And thanks, brucey99.
Bookity bookity bookity.
Tuesday, August 6th, 2013Two more things that I wanted to bookmark:
Peteris Krumins’ “A Unix Utility You Should Know About: Netcat“. Actually, I want to bookmark his entire site, as there’s a lot of good stuff there, including “Low Level Bit Hacks You Absolutely Must Know“.
Also: Michael Ossmann’s HackRF Kickstarter, which is fully funded and has 29 days to go. This is a project I’m really excited about and will probably end up backing. Short version: HackRF is a project to build a software defined radio that is about the size of a USB hard drive, runs off of USB bus power…and if you back the project (and if it ships, this being Kickstarter and all), the cost is around $300, which puts it into “Shut up and take my money” territory.