Four nucleotides just aren't enough these days.

DNA, the molecule underlying every form of life on this planet, is in essence a very long chain of sugar and phosphate molecules connected end to end ('long' being a relative term, of course - a molecule 5 centimeters long is gargantuan when you take into account the fact that it's only about 2.4 billionths of a meter in diameter). Each link in the chain is called a nucleotide, and is comprised of one of four possible compounds, adenine, thymine, cytosine, and guanine. Adenine bonds with thymine and cytosine to guanine; each pairing has two possible orientations, for example A-T and T-A. Seems pretty simple at first scratch - you could liken it to a four-bit encoding scheme for information if you wanted to. Yesterday, however, chemical biologist Floyd Romesberg working at the Scripps Research Institute in California announced that he and his team had figured out how to create two new possible nucleotides called dSICS and dMMO2, which means two new base pairs (dSICS-dMMO2 and dMMO2-dSICS) are possible. As if that weren't enough, they didn't have to re-work the replication or transcription mechanisms of DNA to do this because the processes already implemented in the cells of carbon-based life can manipulate them normally (no word yet on how well existing error correction mechanisms would work with the new base pairs, though). The success comes from a decade's worth of work at Scripps Research involving nearly two hundred tweaks of existing nucleotides, most of which weren't compatible with cellular mechanisms.

It should be noted in all fairness that all of this work wasn't done in the context of living cells, but in vitro with enzymes and an environment replicating the nuclei of cells. Actually implementing these new base pairs inside of cells is something that hasn't been done yet, though other recent advances in genetic engineering make such a thing an attractive prospect, to be sure. The upshot of this is that this is a way to add two new values to the character set of DNA, which means that more complex 'concepts' or informational expressions can be encoded in a smaller physical space with a different 'letter'. While we don't have a use for it just yet, this represents an essential step toward manipulating DNA to specific ends in the future.

The Doctor | 31 January 2008, 11:48 hours | default | Two comments

Do engineers make good terrorists?

According to two sociologists at Oxford University, Diego Gambetta and Steffen Hertog, the mindset of a professional terrorist and the mindset of a professional engineer are so similar in makeup that there is a strong correlation between being an engineer and being a member of a terrorist group (paper downloadable from here). Their research states that members of the Islamist movement of Muslim culture show a disproportionately high number of doctors, engineers, and practitioners of other scientific fields. Their paper also makes the claim that engineers in particular tend to gravitate toward violent groups, but it isn't so much being a techie that does it, but having a general makeup of character that fits in well with terrorists. I reference this single quote: "A disproportionate share of engineers seem to have a mindset that makes them open to the quintessential right-wing features of ''monism'' (why argue where there is one best solution) and by ''simplism'' (if only people were rational, remedies would be simple)."

Let's talk about techies for a minute: Technical problems tend to have lots of individual components and some number of connections between them. In a well designed system, each component only does one or two things, but does them very well. In such a system, there is a small number of possible configurations of components and connections that will accomplish the task that the system was designed for; usually only one or two. A good engineer (or programmer, or system architect) will sit down, look at the problem to solve or the task to be carried out, and come up with a single solution that is implemented using those components. Common sense dictates that you cannot simultaneously implement more than one solution to a problem in a system, run them concurrently (let's show some love for redundancy, shall we?), and get anything done. It would be like trying to walk when one of your legs is going forward, one is going backward, and your left hand is holding onto an overhead water pipe - all of the parts have to be working toward the same goal if anything useful is going to happen.

What I'm driving at is this: Just because someone can look at a problem and find a single solution does not mean that they are terrorists, inclined to be terrorists, or even that a techie is inclined to be violent. The article in particular and the study in general seem to lack a basic understanding of the "common sense of engineering" (just as there is a "common sense of IT" ("Is it plugged in? Is it powered on?") and a "common sense of medicine" ("Air goes in and out. Blood goes 'round and 'round. Any deviation in these is a bad thing."), for example), which I think can be neatly summed up by the statement "One solution at a time."

Besides, I have to wonder if Gambetta and Hertog ever thought to ask the question "Do terrorist groups recruit engineers more than people in other professions because their skillsets are practical and relevant to their short term plans?" I also have to call into question their sample set - is it skewed in a particular direction? How was the data gathered?

On top of all of this, would it not make sense to a terrorist organization to recruit very intelligent people on the premise that they are less likely to get caught, and thus not bring the entire organization down? Pluswhich, by recruiting very intelligent people, it would stand to reason that they would thus be able to accomplish more due to the fact that they had neither blown themselves up nor gotten arrested.

All this article really does is make techies seem a bit less trustworthy because of their basic problem solving skills, a worthless and counterproductive act, indeed.

The Doctor | 31 January 2008, 09:52 hours | default | One comment

The Storm Worm turns one year old.

The Washington Post ran an interesting article about the one-year anniversary of the release of the Storm Worm botnet agent about two weeks ago, possibly the most successful and virulent malware agent yet released on the Net. The Storm Worm beastie is unusual in that the botnet is a decentralized collective, i.e, all of the infections don't report into a single C&C channel but instead use a peer-to-peer networking protocol (a variant of the eDonkey protocol, specifically), so it can't be killed by taking down a single server. It is also interesting because updates are periodically released for infective agents in the field, sometimes several times a day, and these binary modules upgrade, replace, or add functionality. While the Storm botnet is a formidable threat to information security it is by no means unstoppable. It's also come out that one Dmitri Alperovitch, Director of Intelligence Analysis and Hosted Security for Secure Computing of San Jose, California is working with federal law enforcement officials on this case. They think that they've figured out who was responsible for the development of the Storm agent, and are at this time trying to figure out how to bring the developers to justice. It isn't looking good (or even likely) because Russian law enforcement refuses to play ball with US law enforcement. There are rumors floating around that the Russian government (which has its share of ex-KGB agents who've come in from the Cold War) is actively protecting organized crime outfits for any number of reasons (chief among them the fact that organized crime is probably propping up a fair whack of the Russian economy, or so the rumors go) among them the crew that developed Storm.

As with most attacks from outside of the country, regrettably, it doesn't look like the long arm of the law will reach far enough to nab the perpetrators.

The Doctor | 30 January 2008, 11:47 hours | default | No comments

Even bigger bada boom!

Remember around this time last year when the US Navy started testing railguns as ship-mounted weapons? BAE Systems has developed an even more powerful magnetic linear accelerator weapon for testing called the 32-MJ LRG (which stands for "32-megajoule Laboratory Rail Gun" - I guess the person in charge of naming experimental weapons was hired by the federal government to name the PATRIOT Act). The experimental weapon is about the size of an airport x-ray machine, and probably masses about as much. It doesn't fire explosive rounds but then again it doesn't have to. If you can throw a projectile at eight times the speed of sound with any accuracy, chances are whatever it hits won't exist for very much longer. Even if you just barely miss the shockwave from the round passing by is probably going to do some major damage on its own.

The Navy says that it won't stop until it can deploy and fire a railgun that requires 6 million amperes of electricty to fire. That's way more power than most generators can crank out today, which is why that beast of a gun is scheduled for development thirteen years from now.

There's another problem that they're hoping will be solved before then, also: Developing materials that won't catastrophically fail the first time the railgun is fired due to the structural stress.

The Doctor | 29 January 2008, 12:09 hours | default | No comments

Bruce Schneier on the false dichotomy between privacy and security.

If I ever get around to having children, I might name my first boy after Bruce Schneier because he's got a lot more on the ball than I ever will. This time around, Schneier has weighed in on the privacy versus security debate in US policy and why it's not really debatable in the manner it's being presented in because personal privacy and national security are not, in fact, opposed to one another. His commentary was provoked by Michael McConnell (Director of National Intelligence) stating in the 21 January 2008 edition of the New Yorker that he wanted to monitor all traffic on the Internet inside the US that they could get their hands on: All e-mails, all web searches, and content from every website that you visit. McConnell also made a very interesting statement: "Privacy and security are a zero-sum game."

In other words, for one player to win, another player must lose.

Schneier cogently makes the point that personal privacy and security are not, in fact, contradictory. To have one, you don't have to give up the other, and he explains the reasons for it better than I can (so I'll direct you to his article and not reprint them here). He also mentions that the government would then be responsible for safeguarding all of the information that they gather on everyone, which as we all know they aren't very good at.

It isn't too hard to find out who our senators and congresscritters are. Track them down and call them, write them, fax them, and e-mail them about this and ask them to stop it. In fact, tell them to stop it - they are supposed to represent the will of the people after all. We don't work for them, they are elected by us to work for us. Either they listen to the will of the people, or the people stop voting for them and back someone else who will. Better yet, threaten to stop sending them campaign contributions - if it's one thing they'll listen to, its a threat to their bankbooks.

The Doctor | 29 January 2008, 11:35 hours | default | No comments

Microsoft admits that Vista is bloatware.

If you've ever installed Microsoft Vista yourself (or looked around in the hard drive of your brand new box), chances are you'd be surprised to find that it's a hog for disk space. An install of Vista can take up anywhere from seven to fifteen (!) gigabytes of disk space, which most people can eat because hard drives these days are typically in the hundreds of gigabytes. Still, that's a hell of a lot of binary; maybe if you've installed a load of applications and patches over a year or so, I can see that, but when you factor in everything that it comes with (bitmap backgrounds, which by definition aren't compressed; loads and loads of eye candy that are more legal than psychedelics; the latest incarnations of Outlook Express, Notepad, and what have you) that's still a lot of cruft. Things that you don't need. The complaints are such that even Microsoft has admitted that it's too big and that they're going to re-tool Windows using a stripped down core OS. A proof of concept Windows core called MinWin recently demonstrated featured a fully operational OS in 25 megabytes of disk space.

25 megabytes. That's comparable to a full install of MS-DOS back in the day (about four 1.44 megabyte floppy disks compressed, if memory serves).

Of course, they have no plans to use MinWin in any of their products; MS reps say that they're going to use it as their basis for future OS design, to which I say that it's about bloody time. Processor cores are becoming insanely powerful and much less expensive (anyone fancy a quad core CPU for $275us?) but you have to ask yourself: Do you want to spend all of those compute cycles rendering your start menu fading in and out, or do you want to spend your compute cycles crunching numbers and getting practical work done? If you're going to drop a couple of hundred dollars on RAM, do you want that memory to be used for storing bitmaps that make up the user interface, or do you want to load bigger spreadsheets and more complex databases to get your work done? What are you willing to trade off?

Or, you could use an application like vLite to go through an install of Vista and uninstall all the stuff that you don't need or want. The thing about bundling applications with operating systems is that you can pull out the stuff you don't need and replace it with other applications that do the same thing, usually in less disk space. Don't like Media Player? Why not install VLC (Video LAN Client) in its place to listen to .mp3's and watch movies? Don't feel like spending $400us on Microsoft Office? Give OpenOffice.org a shot. If Wordpad's formatting glitches get under your skin, why not try the Windows port of Vim or Notepad++?

Just because you buy your OS doesn't mean that you're limited to what a company will sell you. There are thousands and thousands of applications out there that work just as well, and perhaps more efficiently. You can tinker around with your tools to make them faster and more capable to make your work go more smoothly and your day pass more easily. You don't have to sit there and take what they hand you.

Just remember to make backups.

The Doctor | 29 January 2008, 10:26 hours | default | One comment

Cisco ups the ante on data networking once again.

Yesterday Cisco announced its new product, the Nexus 7000 network switch, which will be their highest-end data switch to date. Attempting to push the state of the art in buzzwords (Web 3.0 already?), the Nexus 7k switch is designed to shuffle packets to the tune of... you know, the article isn't really clear. Marketwatch's news article doesn't give the reader any hard values because it's geared more for management types rather than techies in the trenches. Instead, there are passages like "would be able to copy all the searchable data on the Internet in 7.5 seconds" and "download 90,000 Netflix movies in less than 40 seconds", which doesn't really mean anything if you know anything about networking (hint: the bottleneck here is not the switch but the speed and latency of the links running through it). A more useful article at CNN gives hard information about three quarters of the way through the text: The Nexus 7k is supposed to be able to move data at a speed of 15 terabits per second, and uses a new operating system called the Nexus Operating System (NX-OS) rather than Cisco's traditional IOS.

Opening price: $75,000us

Ladies and gentlemen, prepare to spend your paycheques on new certifications.

The Doctor | 29 January 2008, 09:56 hours | default | Two comments

Is No Such Agency now the Network Security Agency?

Earlier this month, George W. Bush authorized a classified government directive that authorizes the National Security Agency to monitor the data networks of other US government agencies as well as monitoring the communications traffic of American citizens and foreign countries. The specifics can't be released due to the security classification but it is known that the US government is very concerned about its information security posture (no jokes, please) and their first remediation step involves understanding what's going on inside their networks. The Office of the Director of National Intelligence is charged with coordinating efforts to track down the sources of infiltration attempts against government systems, DHS is supposed to implement security measures, and the Pentagon itself is in charge of developing strategy. The impetus for this development is said to be a string of attacks against their systems in the past eighteen months, but if you read their yearly unclassified reports the level of attacks really hasn't changed all that much, but they're actually paying closer attention (which they're supposed to) to what's going on. Supposedly cadres of Chinese crackers are behind the intrusion runs they've been spotting; other rumors claim that it's North Korea, Pakistan, or Iraq, but mostly it's China.

The budget for this effort will go through in 2009, and is expected to reach into the billions of US dollars. The effort itself looks, to this account anyway, like a pretty standard security setup: Keep an eye on the infosec community's work, monitor and analyze OSINT, watch the activity on the DMZ and internal networks, record data to analyze later, perform traffic analysis, keep your patches up to date... the difference is the scale, because this is supposed to cover just about every government agency in the country.

The Doctor | 28 January 2008, 14:27 hours | default | No comments

Sacrificing spam when you can't sacrifice spammers.

Due to the fact that Rending the Veil hasn't finished restoring older articles from backup since the last server migration, I'm reposting my last article they published on harvesting the energy spent by spammers in trying to get us to buy their crap.

Spam. Junk e-mail. Things you can't say in mixed company.

No matter what you may call it, we're talking about the same thing: E-mail that you didn't ask for and don't want filling up your inbox, sometimes making it impossible to find real e-mail. It's a nuisance that netizens have been fighting for years. In terms of its capacity to annoy, it's right up there with ingrown hairs in tender places and bassmobiles making things fall off of your altar in the middle of a ritual.

But what if you could turn the steady flow of spam to your own ends? How could you possibly transmute all those exhortations to enhance your genetalia (regardless of your physical sex) into something useful?

First, let's take a look at spam from a metaphysical perspective.

There are a few ways by which spam is transmitted. One of the oldest is software that, when given a canned message and a list of addresses to target, sends hundreds of thousands of messages, one to every e-mail address in the list. This is probably the slowest method of spamming because it's limited by the speed of the spammer's connection to the Internet. More often than not when the complaints start flooding the spammer's ISP, their accounts are summarily terminated, assuming that the entire netblock doesn't get dropped into RBLs (realtime blacklists) across the Net first. There are only so many ISPs in a given area, so it's too easy for a spammer to exhaust all of their possibilities in a short period of time. This method is all but obsolete, not only because connectivity is at a premium but because spam filtering technologies can easily pick up and drop spam that doesn't change its content very much.


More under the cut...

The Doctor | 28 January 2008, 01:34 hours | technomagick | Three comments

It seems that I'll be in town for a while, so I'll actually be able to post.

This is week four of my "three weeks out, one week in" work cycle, so I'll have much more constant net.access for at least a couple of days. I may as well take the time to write a couple of updates. My off-the-road workload has been sizable lately, enough so that even working from home means a day of solid work, with little to no socially acceptable goofing off at work stuff going on, such as reading Slashdot or checking one's e-mail. Work aside, I haven't been doing much of anything at all. Yesterday morning, Lyssa and I drove to Maryland to run a few errands before meeting up with the Mad Scientist Coffee Klatsch that afternoon. There is a music store in Takoma Park called the House of Musical Traditions that has Irish whistles, an instrument which Lyssa's been keen on picking up again, and I must say that they have quite a selection of them.

I didn't know that, like other instruments, Irish whistles could be made in different musical keys, or that Guiness (yes, the beer) sold a branded Irish whistle.

While I was there, I did a little nosing around but didn't find anything that I was looking for. They didn't have much in the way of wind instruments (and those they did I don't have much facility with), but lots of guitars and books on songwriting. I might have to go back there some day and take another look at what they have.

The afternoon was spent at Hasufin's place hanging out with the Mad Scientist Coffee Klatsch, our bi-weekly salon-cum-Hellfire Club in which we hang out drinking coffee, nibbling, and talking about whatever happens to come to mind. "Whatever comes to mind" can be anything from comparative religion to high-voltage electronics, politics to Chinese mythology, practical modern necromancy to utterly horrible puns, and whatever else might appear. It was one of those afternoons which means eating horribly and laughing lots, which is sometimes exactly what you need in your life.

Mika got for me a couple of pounds of vacuum packed coffee beans to make a batch of my special coffee; I'll have to make a trip to Smile Herbs after I get my next paycheque.

As for last night, I sat around the apartment relaxing, watching Cartoon Network, and not doing much of anything for a change, something that I greatly looked forward to for a couple of weeks.

Enough about my life for the past couple of days, how about some news from the infosec front, which is ostensibly one of my interests: Phishing's been a problem for years, but it seems that the phishermen are being scammed themselves. In the same tradition as the Virus Construction Kit, a group called Mr-Brain based out of Morocco has released a simple and easy to use toolkit for people to set up phishing websites and generating fake e-mails to direct unsuspecting users to them. What most wannabe-phishers don't realize is that the Mr-Brain kit is booby trapped - it does what you'd expect of a kit that sets up a faked bank website, but the code generated secretly e-mails all of the information collected to Mr-Brain for their own use.

It just goes to show that you should review your code, doubly so if you're up to no good.


More under the cut...

The Doctor | 27 January 2008, 19:47 hours | default | No comments

More biotech: Cloning from cell samples?

Cellular biologists working for the company Stemagan, based out of San Diego, California, have claimed something amazing: That they've managed to produce human embryos using skin cells from men instead of gametes (NY Times link - use Bugmenot if you need access). The embryos thus produced didn't develop very far, only to the blastocyst stage, but that in itself is a breakthrough. It wasn't necessary to force the division of the third stage for example (which is thought to have happened by accident under laboratory conditions at least once in medical history), for example. However, because embryonic stem cells weren't part of the experiment, not many people sat up and took notice (I guess stem cells are more hot in the research arena than cloning entire people). They've published a paper through the journal Stem Cells (subscription only, starting at $205us) - if anyone has a copy, I'd love to take a look at it.

Experimental results showed that of 29 trials using donated eggs, five of them developed into blastocysts. One was shown to be a genetic clone, while another two produced strong evidence that they were genetic clones.

The Doctor | 21 January 2008, 23:38 hours | default | No comments

Explosive post queue flush in three.. two.. one....

As one might expect, it's been a busy couple of days (a week, really), which has kept me from being able to post anything. I got back from Philly around 1700 EST5EDT last Friday, and I've been offline pretty much the entire weekend because I've been too tired to do much of anything. After I got back, Lyssa made a wonderful hot dinner (all the more special because temperatures in the tri-state area have been averaging in the mid-twenties Fahrenheit), and then we decided to get together with some friendly faces to hang out for the evening. To that end, we rang up J- and headed to Tyson's Corner mall to wander around a bit and take in a movie, namely, I Am Legend. I have to admit, I'm very impressed with the movie: The soundtrack is minimal to nonexistent, the CG effects are excellent, and the sets are nothing short of amazing. The depiction of New York City after the entire population of the country (and possibly the world) has gone the way of Windows v3.1 is a testament to both movie engineering and digital graphics. I liked some of the more subtle references in the movie, from the fact that gasoline was well over $6us per gallon during the period of time depicted to the fact that the movie takes place in 2012 (thanks, Terrence).

If you've a yen for some post-apocalyptic media these days, give I Am Legend a watch. On the big screen, if you can.

In other news, I've been averaging about twelve hours of sleep every night since I got back to DC whether I wanted it or not. Once my head hits the pillow, that's all she wrote. That's not to say that I'm actually sleeping all the way through - I keep waking up every two hours or so for various and sundry reasons, but I still manage to get some REM sleep.

And now, the news that I've been meaning to post about for a while but have been either too busy (or too busy fighting with the hotel's network) to get around to.


More under the cut...

The Doctor | 21 January 2008, 22:24 hours | default | No comments

Helllllooooooooo.... Philadelphia!

Well, I'm the field again, back in Philadelphia, Pennsylvania to fight the good fight.

Or get myself so worked up that I'll blow through an incarnation, I'm not sure which. It's too early to tell.

My cow-orkers picked me up around 1000 EST5EDT on Monday morning (so written because it'll be well after midnight when I get around to posting this) - apparently my vehicle is distinctive enough that they found my apartment building without too much trouble. Apparently they like the magnets on my car, something that I find endlessly amusing because so few people mention them. After a quick stop off at the bank to take care of business we hit the Beltway headed northward once again, and after three hours or so found ourselves in Pennsylvania during January once again. The trip was unexpectedly rapid - I got a considerable amount of reading done on the way up and didn't even realize that we were within spitting distance until we got lost somewhere between Philly and the Delaware border. Thankfully, we just had to turn around and keep going an extra few miles until we found the right exit.

I see that Pennsylvania misses me. That means rain, cold, and wind, and not necessarily in that order.

The hotel's wireless network is flaky as all get out - no one on my team can access their e-mail from behind the wireless routers they have in place, nor can they hit any SSL-protected websites. I did some poking around this afternoon with TCPdump and its sister application SSLdump, and discovered that the wireless access points are attempting to proxy SSL connection attempts, and then immediately dropping the ball. Cipher strengths are renegotiated with smaller and smaller key sizes until the router gives up and the application in question takes ten minutes to figure out that it's not getting anywhere. I don't know who set these things up but they really didn't know what they were doing, and consequently they're screwing everyone staying at the hotel. The only reason that I can check my e-mail (or even post this) is because I've set up a bunch of SSH tunnels to smuggle traffic back to the Network by way of the OpenSSH protocol, which the local proxy servers don't know how to handle and thus let pass through freely.

I don't know what tomorrow has in store for me, but I get the feeling that it's going to make me cringe. I really should get to bed to rest up for whatever lies in store for I and my team.

The Doctor | 15 January 2008, 01:09 hours | default | Two comments

An open question for my readers.

While going through my server logs tonight I keep seeing logfile entries like this:

a.b.c.d - - [13/Jan/2008:22:59:49 -0500] "GET /pivot/archive/2007/11/16/serious_vulnerability_found_in HTTP/1.0" 404 321 "http://drwho.virtadpt.net/archive/2007/11/16/serious_vulnerability_found_in" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; Win64; AMD64)"

Someone's going to articles on my website that exist, but then they're clicking a link someplace in the article that's sending them to the same URL prepended with the string /pivot, and I can't figure out where or why they're causing this 404.

If anyone reading this has done this accidentally, could you please comment and describe what you were doing so I can fix it?

Thank you.

The Doctor | 13 January 2008, 23:06 hours | default | Three comments

FBI forgets to pay its phone bill; wiretap goes silent.

It has recently made it into the press that the FBI has been conducting wired surveillance of an international nature - the specifics of the operation aren't known, which is what one would expect of an ongoing investigation. However, due to an ongoing problem with controlling funds allocated to fieldwork, they forgot to pay the telco bill for the wiretap and the telco summarily shut the line off. The FBI's been fighting problems with mismanagement of money and embezzlement for years now, and while the measures they've put in place are helping to some extent they sometimes cause problems. This is apparently happening often enough to be causing real problems with investigations - even FISA orders are slamming to a halt because bills are going unpaid.

The Doctor | 11 January 2008, 13:03 hours | default | Three comments

US Judicial system debates the legality of searching laptops at the border for no discernable reason.

For a while now I've been hearing about (and thus keeping an eye on) stories from people whosee laptops are being confiscated at the border and examined, as sort of a gill net for anything shady (or that they don't understand). Usually you hear about it in the context of people getting busted for carrying child pornography but more often than not it's Joe or Jane User. The US government says that going through someone's data without a warrant is no different from going through someone's suitcase without a warrant; Idisagree, for reasons better elucidated by Judge Dean Pregerson of the US District Court of LA than I: "Computer hard drives.. can include diaries, letters, medical information, financial records, trade secrets, attorney-client materials and information about reporters' "confidential sources and story leads." (quoted from the article, which quoted Judge Pregerson - click link for context).

Imagine it: Everything on your laptop can be copied and examined after the fact - your e-mails, your web browser's history, pictures of your kids, the book you're working on, notes from your last field assignment (I really doubt that the people who are going through all of this data while you're standing in line waiting would understand what a penetration test is, or the fact that they are often legally done)... they could potentially misrepresent anything on there in such a way that they could hassle you, bring you up on charges, or potentially whisk you away with a black sack over your head. The people in the field doing this aren't infosec professionals or lawyers, they are people trained to be paranoid, and to keep an eye open for anything that could potentially be illegal or dangerous (which usually amounts to things that they don't understand).

I don't know about you, but it worries the hell out of me.

EDIT: The following links will be of interest to people following this matter:

The Storm Worm botnet learns some new tricks - like phishing.

Scarcely one year after the initial appearance of the Storm Worm and its resulting botnet, some heretofore untapped functionality's been pushed out in one update or another in just the past couple of days: Not only is the botnet sending out phishing-related spam but the phishing sites are hosted on the infected machines themselves. The information security community is speculating that it may now be possible for the controller of the botnet to partition it and assign different tasks to different segments of the infected net.population. As if that weren't problem enough, the domains that the phishing sites use update their DNS records every couple of seconds (a method called fast-flux DNS addressing), so every time you go to that domain, you're actually contacting a different IP address. That way, it isn't possible to block a small number of IP addresses at the local level.

As they say, 'interesting times'.

The Doctor | 10 January 2008, 14:23 hours | default | No comments

My media - let me show you it!

I've put a few more photo albums online from last year and this year:

The wedding of Alexius and Marlise Pendragon - 15 December 2007 (slightly out of order due to the file naming conventions of the two cameras used).

The Dresden Dolls - 27 December 2007, Washington, DC

In case you missed them because they were buried at the end of a very long concert report, Information Society in concert - 5 January 2008, Philadelphia, PA

Oh, and some long overdue updates to my .plan file (obDisclaimer: Possibly not safe for work.).

I also finally debugged Pivot's URL rewriting scheme so that the links to every post are a) more search engine-friendly, and b) more reader-friendly. If they broke anything, please let me know in the comments.

The Doctor | 09 January 2008, 15:19 hours | images | No comments

Czech crackers facing trial for faked nuclear detonation.

Last June, a group of crackers and art hackers in what used to be Czechoslovakia hacked a webcam feed to make it look like someone had detonated a nuclear device by scaling the tower that the webcam was mounted on and patching into the network link directly, which let them inject their altered images. Coincidentally at the same moment that the webcam feed was shown by the local news. They're facing a court trial and up to three years in jail for their prank, which scared not a few people silly. They say that they did it to call into question the validity of the news media - in a world in which readily affordable computer technology can spoof one of the most famous films in history on a shoestring budget, you really have to wonder about the footage on the evening news...

The Doctor | 08 January 2008, 15:27 hours | default | No comments

Приветствия, камрад! Полностью ваш icecap прина&#10

Just a couple of days after the New Year started, researchers from the United States and Norway set out across Antarctica to move the South Pole - literally, because the red-and-white barber pole that marks the geographic southern pole of the planet had shifted because the ice sheet it's planted in constantly drifts toward the ocean. To their surprise and amazement, the team was greeted by something entirely unexpected: A large bust of Lenin left by Soviet researchers in 1958. Way back when, they built a small research station there and when they decamped the Russian scientists left the statue of Lenin's head and upper body behind, facing toward Moscow. While the cabin itself is buried beneath snow and ice, the cabin's chimney now protrudes through the show. Lenin's bust is fastened to the top of the chimney, which is why it is now exposed.

In case anyone's curious, the ICBM co-ordinates of the old Soviet research station are thus: 82 degrees, 6 minutes south; 54 degrees, 58 minutes east; 3718 meters above sea level (roughly).

The Doctor | 08 January 2008, 15:09 hours | default | No comments

Two heads-up posts from the infosec world that could hit close to home.

First off, someone's created a trojan horse program that affects unlocked Apple iPhones. By definition, you can't install anything on an iPhone unless you crack it, so the impact of this is potentially smaller than it could be. At any rate, it pretends to be a patch for v1.1.3 of the iPhone firmware. It doesn't do anything until you try to uninstall it (because it doesn't look like it does anything), at which time it will take any copies of OpenSSH and Erica's Utilities with it when it goes. While the original website that offered this utility is now gone, you just know that a couple of someones out there got hold of copies and are hard at work making it do different (and probably nastier) things.

On the other end of the spectrum, researchers from eEye Security have developed a new rootkit for machines running Windows. Rather than hiding and injecting new drivers or replacing binaries with modified versions, their rootkit works by replacing the master boot record of the OS disk so that the rootkit's code runs even before the Windows kernel starts up, sliding beneath the OS like a bedsheet underneath a brick. So far as the kernel is concerned everything's hunky-dory, but it's been compromised in ways that are undetectable from inside the Windows environment itself. The rootkit's binaries can be hidden in sectors of the disk outside of the file system that aren't in use (no file system uses all available blocks of a partition - there are always some left empty) and nothing inside of the Windows install itself is changed, so standard disk watchers like Tripwire won't pick up on them.

Rootkits, if you're not conversant in matters malware-related, are pieces of software that subvert certain functions of the operating system they're installed into. Someone that has acquired compromised a machine and broken administrative access can keep it for longer periods of time because basic functions of the OS cannot detect their modifications - files hidden in certain places or have certain names don't show up in directory listings. Software written to search disks for unauthorized files can't find them, either, because they all rely upon those hooked functions in the OS. Network connections from certain addresses or to certain ports are also cloaked because the OS routines that could display them are wrapped or replaced with code that specifically ignores them. The closest metaphor I have for a rootkit is blinding a security camera by taping a picture of the room it's watching over the lens to hide the people walking around inside of it.

Technical discussion after the cut.


More under the cut...

The Doctor | 08 January 2008, 14:23 hours | default | No comments

EDITED: Concert report: Cesium-137, ThouShaltNot, and Information Society at the Trocadero in Philadelphia.

(obligatory disclaimer: Many links reference my Amazon Associates account.)

On Friday evening, our good friend Derek Pegritz drove down from Pennsylvania to visit Lyssa and I and stay with us for the weekend because we had another wacky and amazing adventure all lined up: A trip to Philadelphia, Pennsylvania to see a concert at the Trocadero Center thrown by Dancing Ferret Productions. A veritable trifecta of awesome music would be played at this venerable Philly venue, Cesium-137, ThouShaltNot, and Information Society. This was to be a most unusual show in that it would be recorded for a future DVD release by Dancing Ferret Disks, and also in that this is the first time that the original members of InSoc would be playing together since 1993 or 1997 (I'm not sure which - well over fifteen years at any rate). Around 1400 EST5EDT yesterday afternoon, the three of us loaded up the TARDIS, connected our new navigation system (a Tomtom One GPS unit), and set course for Philly.

Without stopping off anywhere, the TomTom got us there in a little over three hours' time without getting us lost, something that has never, to my memory, happened before. Once we hit the highway, it was smooth sailing, and we arrived at the Trocadero ninety minutes ahead of schedule. After finding a parking garage within easy walking distance, we walked around the distract for a while and eventually settled on a Thai restaurant called the Siam Cuisine Thai Restaurant (925 Arch Street; Philadelphia, PA, 19107; 215-922-7135). The three of us stopped outside of their window to look over the menu, but were beckoned inside by one of the waitresses, who was enthusiastic about our wanting to check them out, and promised us a wonderful Thai dinner if we came in to warm up.

What a dinner it was: I had pineapple fried rice with chicken for dinner while Lyssa and Pegritz had a yellow curry and tofu dish that were, in all, excellent. The fried rice wasn't oily or over spiced, yet left a pleasant afterburn with each bite. The yellow curry wasn't overly hot and had a nice sweet note on top of it all. They even served a decent coffee (Lavazza, one of my favourites) that was spiced with cardamom, cinnamon, and ginger. All of us were very pleased with our meals, which were decently priced for the Philly area (averaging $11.50us per dish). I give them one and one-half flareguns: If you're in the Philadelphia area and like Thai food, stop in here. Tell 'em the time travelers sent you.


More under the cut...

The Doctor | 07 January 2008, 00:07 hours | images, restaurants, default | Ten comments

"Oh my God, he changed the words!"

Hi, Kurt.

We're back from the InSoc show safe and sound, and getting ready to pass out.

I can die now.

More on this after I regain consciousness.

The Doctor | 06 January 2008, 04:03 hours | default | No comments

Another milestone moment in my life.

Lyssa, Pegritz, and I are off to see Information Society in Philly. I've packed my CD of Hack in the hope that I'll be able to get it autographed, there's some cash in my pocket for swag, and I've even put my contact lenses in so I can wear mirrorshades to this show.

Old school all the way, baby.

The Doctor | 05 January 2008, 14:31 hours | default | No comments

DRM: When you absolutely, positively need to get screwed because your home media system is too good.

DRM: Digital Rights Management. A technology which uses strong crypto to control whether or not a particular computer is permitted to decrypt and play back a particular media file. The idea is that unless a given box has been outfitted with a particular certificate, it doesn't matter if the files are shared or not, only the system for which the certificates were issued could play them back, assuming that the company that provided the certificates didn't decide to revoke them or something.

The 'or something' is the operative part of what screwed one Davis Freeberg not too long ago: An afficionado of HD (High Definition) media, he bought a brand-new Samsung SyncMasterTM 226BW HD display for his computer, the better to watch movies bought, paid for, and downloaded from Amazon and Netflix. As it turned out, the combination of an HD monitor and graphics card in his computer was a little too high-def for comfort and the DRM management software in his computer provided by Netflix refused to let him watch anything unless it erased all of the licenses already stored, forever preventing him from watching anything that he'd already downloaded. This is possibly due to paranoia on the part of Hollywood - I guess if your display is too good, someone could point a video camera at the screen, make a recording, and then distribute that. One would suppose that the quality would be marginally better than what you'd buy at a bootleg movie sale in downtown New York City.

Whether or not those deleted files could be recovered and put back is something that I don't know. Freeberg mentions that there is a way to back up the DRM certificates and restore them, but it's a long and tricky process.

Netflix's recommendation? Downgrade to VGA.

My recommendation? Don't patronize any companies that force you to take a hot DRM enema just to watch a movie. Take your time and money somewhere else.

The Doctor | 03 January 2008, 10:32 hours | default | One comment

Ransomware: Pay us $35us or be forever locked out of your box!

Ransomware, malware that forces the user of an infected machine to pay a sum of money to Someone Out There in exchange for regaining access to their data isn't exactly the most common thing going around but it seems to be catching on, and I can't think of a reason why it would slow down. Earlier strains found in the wild did things like finding and encrypting all Excel spreadsheets on a machine and demanding that the user wire money someplace in exchange for the utility that would decrypt them, but now the stakes are a bit higher on both sides of the fence: A new malware agent locks users completely out of their machines until $35us is paid, either by dialing a premium-rate phone number (most of the cost of which goes to the bad guys) or going to a web site that processes payments for porn sites. The beastie manifests as a full-screen error message that pretends to be a nag screen for an anti-malware application that has expired.

From what I've been able to tell, no one's written a universal unlocker yet for this little nasty, unlike some of the other extortionware agents in the wild. I wouldn't mind getting hold of a sample of it to start taking apart, so if anyone out there does manage to capture a sample please let me know. Specifically, I'm interested in the mechanism by which user access is locked out, though the PIN generation method used by the beastie is also of interest to me (writing a keygen to banish a malware infestation, as it were).

The Doctor | 03 January 2008, 08:40 hours | default | No comments

Let's try this again from the top.

Second try: I tried to post from Laurelinde's place but her wireless access point bounced me halfway through the process, so it never made it through.

Happy New Year and welcome to the year 2008 of the common era!

Laurelinde and Lyssa, both off yesterday, spent much of the day getting ready for the shindig at Laurelinde's place last night while I was at work. Unfortunately, I didn't get back to the apartment until nearly 1900 EST5EDT due to a last minute project that I had to see through to the end. I actually left the office around 1800 EST5EDT but had to stop off at Whole Paycheque to pick up a couple of bottles of raspberry lambic and then go back to the apartment to pick up a couple of things, like the Aerobed so that Lyssa and I could crash over there in relative comfort, the contents of the gift basket from my boss, and a couple of DVDs that we wound up not watching. After making sure everything was taken care of, I set out across the Beltway for Maryland.

Strangely enough, I made it in about a half hour's time, not because I was travelling at speed but because the Beltway was curiously empty of travellers. Maybe everyone left for their respective parties early, or maybe I hit one of those strange moments in Time in which everything moves together with the precision of a Swiss clockwork. Maybe I was just one of the schmucks of the very last group of people to leave work yesterday, I don't know. What I do know is that I made it without little trouble. Lyssa and Laurelinde were hard at work in the kitchen on Alton Brown's city ham recipe, and everyone else was lounging around the house chatting.

Dinner, namely the aforementioned ham and a number of boxes of Mrs. T's Pierogies (which, I maintain, can't hold a candle to homemade pierogi) was ready around 2100 EST5EDT or therabouts. Everything had gone off without a hitch, and everyone was pleased with how dinner turned out. It was around this time that N- and I cracked open our libations of choice (the ladies had been too kind to me and bought a flask of Goldschlager for me, which was shared along with the bottle of Captain Morgan's Private Stock, a gift earlier in the day from a friend at work).

The New Year was rung in on the porch of the house with N- firing the cork from a bottle of bubbly in the general direction of out and away from everyone, followed by a couple of people retiring for the evening. N- and I stayed up until 0300 or so this morning talking about life in general and history, but eventually I stumbled upstairs to crash for the night. Once again I slept until noon or therabouts (have to watch that, what with work and all) and was greeted by the midday sun, a pot of coffee, leftover pierogi from last night, and (scrambled) eggs Benedict, courtesy of Laurelinde. Lyssa and I eventually headed out around 1500 EST5EDT today - she's asleep in the other room right now while I tidy up a bit around the apartment and re-write this entry (more coherently than last time, I hasten to add).

The Doctor | 01 January 2008, 18:43 hours | default | One comment
"We, the extraordinary, were conspiring to make the world better."