My Top 5 Security Highlights from This Year

With some big news coming today in the Security world, I thought it may be time to post my top 5 security stories of the year. I numbered them, but they are really in no particular order other then the order I thought of them in.

1. Cold Boot Attack

An amazing piece of hacker-dome coming out of Princeton. Halderman et. al. showed that keying information can easily be identified and extracted from memory to attack encrypted hard drives. Everyone always says, you want to protect your computer, encrypt your disk. That is no longer enough. It should read, if you want to protect your computer, encrypt your hard drive and store your computer in an oven.

2. Kaminsky Attack

One of the biggests and widely publicized attack of the year was also one of the most secret. This attack allowed for an attacker to forge hostname lookups in a matter of seconds rather then days as first thought. When it was announced, the lab basically said it's bad, but we are not going to tell you how bad. Rumors were abound, and everyone and anyone had an opinion. Once the attack details were actually released, it was a horrific as we thought, but thankfully most vulnerable DNS servers have been patched. An amazing thing, really. But, can we ever really trust DNS until DNSEC becomes the standard.

3. OpenSSL Debian Repository

One of the stupid commits of all time, a developer for the OpenSSL library on Debian ran the library through ValGrind. Surprise, there was a memory error: reading uninintialized data. The developer comments out the code and probably thinks, I have saved the day. Oops, that read a realy good thing because it seeds the random number generator. Without it, the only seeding matierial is the process ID, which mean that there was only 2^32 different keys. That is really, really bad because those keys can be enumerated. The worst part was this went undetected for years ... years! Well, at least it fixed now, and it didn't effect me because I am a Fedora user.

4. MD5 Collisions to Create Rougue CAs

Sneaking in just today from CCC, researchers have exploited a collision in the MD5 hash space used by certain CA's to exploit SSL connections in the browser. Just when we though everything was safe, we get this news. Oh boy. It doesn't effect just one CA but many, 5+. This is realy pathetic because MD5 collision weakness has been known for a while, but thse CAs still haven't made the transition. It is shame, and it should be fixed ASAP.

5. Apple Suggests Anti-Virus Software, then says "Just Kidding"

One of Apples big selling point is that Mac is safer then Windows. It is, but not for the reasons that Apple wants you to believe. In fact, at capture the flag competitions year after year, Mac Books tend to be the first hacked, every time. Then why is Apple safer? There are less Mac's then PC's. If you are an attacker do you want to write your virus to atack 10% of the market or 85% of the market (nubers are made up). The truth is, that Macs are more susseptable to attack, but less people attack them. It was then a good idea for Apple to suggest anti-virus software, but it makes them seem hipocritical. So, they renegged. Nice job apple, continue to lie to your customers; it sells product.

Going Home

I am back in Atlanta for the holidays, first time in about 6 months. Now that I am home, I always ask myself what does it mean to be home? What is home? Well, some say home is where the heart is, or wherever you want it to be, or maybe it is wherever you need it to be.

In the Wheel Of Time, Werner Herzog asked the Dalai Lama where the center of the universe is. He responded, right here and pointed straight down. We all are the center of the Universe, our own universe. Home most be our personal center of the universe, and if the center of the universe is here and now, then home must be wherever you are.

I like to think of it differently. When I lived in New York, I always wanted to leave the island. I would go months without leaving Manhattan, and it would make me miserable. Whenever I did leave, I always wanted to go back.

I called New York home when I was away and called Atlanta home when I was there. I think home is the places we leave - never realizing we were home until we move on. One can never physically be home. It is unattainable. It is where I was, but never where I am. For me, I am always leaving and going home.

Bush v. Gore To Make Bush The Next President, Again!

Bush v. Gore, the Supreme Court case that decided the presidency, has begun to be cited in legal briefs, even though the decision clearly implies that it is not a precedent, just a one time only thing.

What's the deal with that? If it's not one time only then ... oh no. That must mean that Bush could be the next president, again. Holy Crap! What will we do?

It's not that bad, really. The New York Times can explain it lot better then me.

Cumputer Robot to Open Doors in the Future!

In the future Computers will be used for a variety of things. Most highly complex beyond our present comprehension. But what to do with all those old computers? Well, they can be reprogram to open all our doors.

Find out the real story of this futuristic device at MAKE Magazine and thedailywtf.com. It's a pretty cool hack.

Pres. Bush Ducks not One, but Two Shoes.

During a new conference with Bush in Iraq, an Iraqi journalist threw first one and then the second shoe at the president. Bush ducked both. Got to give it to him, he moves well for a lame duck. I am not a big fan of the president, but I don't think anyone wants him to be struck by foot ware. Well, maybe some do.

Sliders kicks ass.

Everyone should watch Sliders. It is so awesome.

This from when Rembrant Brown, the "Crying Man," gets sentenced to the gulag in Alaska during an episode of the Peoples Court.In the show he adlibs, "Small claims my ass!" Priceless.

To Catch a Mouse

There's fig newton in the bottom ... come and get it.

John Daly still plays golf?

He sure does. And he plays badly too. After shooting 6 over for the day, Daly smashed a spectators camera against a tree. Nicely done, you goon. It wasn't so long ago that we found Mr. Daly drunk and unconscious outside a Hooters. Another amazing, but unsurprising storey about a Golf career that has hit close to rock bottom.

I actually had the pleasure to see him play in Atlanta at a PGA event, and he is as ugly and mean looking as you think he is. Daly is big and strong, and when he swings a golf club, his whole mass moves with him in this massive explosion of flesh torquing around spine. It is something to behold. I really wish he wasn't such an idiot in the way he lives his life. Too bad. Hopefully we will be hearing less and less of this.

A Big Bad Sucker is Out There

That's right folks, our suspicions have been confirmed. There is a giant killer lurking in the depths of space. A Black Hole. It has been widely theorized that in the center of most galaxies there are black holes. We have seen pictures of huge plumes emerging from either side of distant galaxies, a good indication of black holes. But what about our own galaxy, the Milky Way? By tracking the movement of stars close to the center, scientist saw that they were orbiting around a mass that wasn't emanating light. Whoo. So they continued on. And now, they have confirmed it, there is a killer in the middle of the galaxy waiting to emerge and start to feed again. What would it be like to live during a time when the black hole is feeding. No doubt, the plumes could be seen in the sky. Pretty freaky.

(link)

Bringing a Knife To the Bedroom

Derrick Rose, star rookie of the Chicago Bulls, recently had to go to the emergency room to get 10 stitches on his arm. That is just part of it. According to yahoo sports, the story Rose tells is what gets me.

"It was a silly incident," Rose said. "I was cutting up some food and I laid on a knife getting lazy in bed. I went to go get a bottle of water, came back, forgot the knife was there, then sat down and sliced my arm."

I have to say, that is so ridiculous it might even be true, but I really can't believe it. He has to be coverings something up. Like he was in the club, and he saw someone shoot themselves in the leg, then he went to get a bottle of water and cut himself on a champagne glass. Those are the kind of stories we are used to hearing these days from athletes, but not I was cutting an apple (the food has been reported to be an apple) and rolled over onto a knife. That is just so tame.

Come on Rose give us drama ... or maybe the drama is yet to come.

(link)

Internet Business Model, humor first, get paid second

www.thingsbearslove.com

Make'em laugh then sell them product. Smooth operators.

House and Ethics, a mini review

Interesting and crazy episode of House last night. I think a little, way, way, over the top. But one ethical question came up, almost asked directly in the show. "Is it ethical for doctors in clinical trial to know the patients personally?" The answer nearly quoted out of the show, "It slants the numbers." I have to say I agree. It seems strange for a show that is in the business of portraying doctors to so blatantly say that the way they portray doctors is unethical. It's almost like a "don't do this at home, these are paid professionals" tag line. Watching, I was struck. And then, ... well the soap opera of the show resumed and I was again happy. In total, crazy f*ing episode and wierd ethics. Overall, 2 thumbs up for House and 1 thumb for last nights episode.

No one is immune

Even the NFL is taking a hit in the economy. ESPN is reporting that 150 people from the main office will be laid off. Kind of ironic that the players make ridiculous money, but the front office is hurting. 150 people by lets say 100 thousand a year, we are talking 15 million dollars in saving. That is one season salary for a lot of players, and a joke sallary in baseball. I wonder if NFL HQ asked for help from the owners, i guess not. Now all major sports have had lay offs. No one is immune.

http://sports.espn.go.com/nfl/news/story?id=3757152&campaign=rss&source=ESPNHeadlines

Stupid Governor

Illinois governor Rod R. Blagojevich was caught trying to sell the open senate seat left by obama. You are an Idiot!

http://www.nytimes.com/2008/12/09/us/politics/10Illinois.html?_r=1

The South St. Bridge has Fallen Down

Today was my first time walking the long way to work, over the Walnut St. bridge. The city of Philadelphia finally came to it senses and is tearing down the decrepit South St. Bridge. Something that had to be done. But for me, this means my walk to work has increased almost 2 fold. It is now a 45 minute plus walk from 25 minutes. Doesn't seem I can roll out of bed and be at work at any reasonable time. So kudos to Philly for fixing a huge problem, but for me it is just more time. I kinda want my bridge back.

Burnett to the Braves?

The Internet is abuzz with reports of a 4-year and 5th option at 15 mil/year contact offer to Burnett by the Braves. A formidable offer, one I think is fair especially with the 5th year option. I hope the braves come through on this one instead of circle jerking around like the Peavy debacle. Here's one to Wren, stay in there and make something happen.

The Weather, burrrr, and KickBall Victory

As I type this, the temp is 21 degrees. Seems cold, but you add in the 20 mph winds, and your ass is about to get bitten. I know it is winter, or fall, but this is a little ridiculous. Even still, my comrades and I worked throw the cold yesterday to attain kickball domination.

"On the frozen tundra of Star Garden, one team in red remained to thrust the bitter cold statue of victory over their head. The ball-shevicks, and Willy Nelson, felt the joy of being champions. Finally! "

And congrats to everyone, we played great. Defence wins championships, and giving up just 1, that's right 1, run in 2 games is definitely the contributing factor. See you all at the formal to really hoist our trophy high.

adam

Start it off, python 3.0

This is a test of the talking to the internet system. Do not be alarmed. You shouldn't even care. What I says echos off the vastness of the bored.

In this extravaganza, "sports, computers, and the deadly 3," I your lonely narrator will present to you the things that I fancy most. I will likely thow a little college football on friday, a little coding on tuesday, and a talk about some crazy avant-garde french film from some unknown, but brinilliant, director on thursday. Monday, Wednseday, Friday, and Sunday I rest because I am lazy.

To start off, I will quickly shout towards python 3.0, with more to come later. I downloaded and installed the update last week and spent about 3 minutes just checking to see if the print function really did change, it did. Shucks. Well I am going to hold on to the 2.5 branch for awhile longer. They keep saying that you should start porting, well I don't want to spend time porting instead of coding. So there, I said it. It's frustrating the whole 3.0 thing. I liked my print function without parenthesis. I guess I'm oldfashion like that.

till next time,

adam