Category Archives: Security

Honey, please light the Ethanol

< Smart FireA design group has come up with the perfect solution for those people who want the appearance of a fire, while reducing the risk of poisonous fumes and the mess of combustion. It is called “EcoSmart Fire” to emphasize how smart it is to have an Ethanol flame burning in your house.

My first questions were, of course, what is the actual heat output of this thing and whether it is practical to assume a ready supply of denatured ethanol. Unfortunately this is probably the wrong approach to this new technology — finding a way to enhance the ambiance of a space already running on central heat seems to be the main point, with only a very basic level of practicality, safety, and sustainability in mind.

Nonetheless, I found that the FAQ says the flame can “produce 14Mj/h equivalent to 13000BTU”. Not bad for a small room. Come to think of it the average PC power-supply generates about 1500BTU to 2500BTU but even if you ran five or so PCs to keep you warm you would still be on the grid and you couldn’t “safely” burn stuff. On the other hand, if you live in more than a 500 sq/ft bungalow you might need to invest in a lot of small fires, which just begs the question of whether you can run these fires from a centralized control system to manage output, burn-rate, etc. or if you are just supposed to setup a fire on its own in each room, as the Victorians did.

The marketing blurbs claim this really uses a renewable energy as the source of fuel, but burning wood is like burning ethanol in that regard, eh?

In fact I read that Alaska’s Senate passed a law recently (bill 337) to promote creating ethanol by processing waste wood with fish parts. So the comparison must be intended for petroleum or natural gas based fireplaces, not wood fires. Is that a big market?

Come to think of it I’m wondering why someone hasn’t yet figured out a way for restaurants to recycle their own cooking oil into beautiful and firery displays of ambiance. And if ethanol is actually available, then just mix it with the waste oil from food preparation and you end up with a convenient fuel for running your fireplaces as well as your vehicle…biodiesel.

America and the Con

While I was reading about the history of the Hart-Rudman national security commission (sometimes also known as Hart-Gingrich or the Hart-Rudman-Gingrich), I ran into an interesting Weekly Standard article (Issue 35, May 29, 2000) by Tom Donnelley. Donnelly was deputy executive director of the Project for the New American Century at the time. This is the same organization that has tried to make a case for the President’s search for WMD in Iraq as late as April 2005, so bear with me. (Note: for a more realistic conservative’s view of the WMD debate, check out the book “State of War: The Secret History of the CIA and the Bush Administration”)

Donnelly called his article in 2000 “Newt Gingrich’s Last Boondoggle” and he gave a fascinating look at the beliefs of the group that ultimately pressured the President into invading Iraq. Note that this article was published before Bush took the reigns of the country by an order of a conservative federal Supreme Court, so the reasoning expressed in the article illustrates why/how Bush could have began his term buoyed by the lofty dream of absolute US hegemony.

For example, Donnelly very harshly criticizes Hart and Rudman for arguing “that American strategy must ‘compose a balance’ between the goals of freedom and stability.” Donnelly suggests that trying to strike such a balance in the world would be meaningless as the concepts of right and wrong can be easily judged by America and the resulting policy would be one of struggle against evil, not some kind of compromise:

But in a world where so many nations remain ruled by dictators, liberty and stability are often at odds. How, for example, is the United States to “compose a balance”? between liberty and stability in China? If stability reigns, so will the Chinese Communists. If America works to advance freedom in China, there will almost certainly be turmoil.

Make no mistake about it. That is a policy of destabilization meant to allow control of a country’s future by whomever is strong and big enough to fill the vacuum. It is the same means-justify-the-end argument used throughout the Cold War, coupled with the idea that it is far better to err on the side of right-wing economics than go for something undefined in the middle that might be susceptible to the left. Donnelley was arguing that the Cold War did not really end; it just changed a little and there was an adversary with a different flag. Thus his reasoning was probably that the US would be foolish to miss their opportunity to take a seat at the head of the table and assert themselves again as a moral authority through some kind of deontological ethics. He then indicates that no compromise or collaboration with other countries is necessary when you have the kind of superiority demonstrated by the success in cold war conflicts:

The report disavows the habits of leadership, power, and principle that unexpectedly won the Cold War. Alas for Hart and Rudman, these strategic habits may be hard to break—and since they made America into history’s “sole superpower,”? some will wonder why they need breaking.”

It is almost as though if you have been right once, you will be right again no matter what the situation. However, while the US might have “won” a superpower conflict when the primary adversary stood down, that does not translate directly into unquestionable control of the remaining geopolitical affairs. This is the crux of the mistake made by think-tanks like Project for the New American Century. The situation was not like one of the Rocky movies where a heroic fighter beats the odds is left standing in a ring over the dispirited opposition. Quite the contrary, while one particular risk became lessened other high-risk security issues became more critical; threats and vulnerabilities changed so the overall risk equation shifted but still needed to be heeded. Even Tom Clancy’s writing was tapping into this philosophy by the late 1990s (Rainbow Six, Rogue Spear), which reflected that the military establishment itself could see engagements ahead would require a more indigenous, sophisticated and delicately balanced response than that of giant missle defense systems and Big Red One rolling over and occupying vast expanses of foreign territory. Goodbye John Wayne, hello Mr. Bond (or Alpha team), you might say.

The risk algorithms of national security and international relations were clearly evolving in a way that many, including Hart-Rudman, could see. So, by the summer of 2001, intelligence and anti-terrorism experts were literally yelling into the ears of the Bush Administration that Hart-Rudman’s recommendation of “a finer calculus of benefits and burdens” really would be necessary. Richard Clarke’s “roll back” presentation suggested a strategy for the US to strike right at the heart of al Qaeda training camps and put the terrorist group on warning in February 2001. Yet the Bush Administration walked away from the table announcing they were going to handle things the old-fashioned way, on their own timeline and without interference.

It really boiled down to the desire for a new policy founded on a concept of shared balance and co-existence versus the old policy of total elimination. Nuance versus hubris. Many suggest that the elimination policy group was bolstered by the events during the Reagan administration that led to the unexpected change in the policy of the USSR. But this “proof” of the policy had more to do with timing and admission of failure rather than the success of any direct assault or overwhelmingly powerful US strategy. Some could say that the US outspent the Soviets, but even that was hard to prove. It was like the countries were drag-racing and the US won because the other car ran out of gas or had a mechanical failure, but the Reagan administration walked away believing they were the better driver. Thus an elimination policy group formed and believed that unilateral leadership based on superior moral ground (like Kant’s categorical imperative) had won a war during their watch. Moreover, they believed that this success needed to be further capitalized upon or lost forever. Some were so caught up in this dream-like state that they were offended by any suggestion of uncertainty about the state of US supremecy. Lynne Cheney, wife of Dick Cheney, found the reality of geopolitical issues so threatening that she simply resigned from the commission in protest:

Cheney was unhappy with the suggestion that American power was bound to decline: “Emerging powers will increasingly constrain U.S. options regionally and limit its strategic influence. As a result, we will remain limited in our ability to impose our will. . . .”?

The irony is almost too thick to avoid. The ex-Regan administration member Cheney resigned because she could not deal with reality. The only alternative, impose her view on those who recognized the new security risks ahead, must have been unsuccessful and so she quit the team. It is only logical that she and her husband from that point onward were planning to deep-six the recommendations of the final report and knew what to do when it was handed to the Bush Administration in 2001. Incidentally, during the 9/11 events she was reported to have turned down the offical debreifing from the anti-terror task force so she could hear the reports from CNN.

At the end of the day it was an uncompromisingly myopic stance of the Bush Administration coupled with the inability to process information about the real and present dangers to the country that arguably precipitated the ease with which al Qaeda staged their attack on 9/11 — Osama’s minions did not fit the image of what the Bush Administration, and the Cheney couple in particular, were willing or able to accept as a credible threat. They therefore not only fumbled the job of understanding risk, but they ignored and actively distanced themselves from the voices that tried to raise alarm before disaster struck. Like a heavy-weight fighter brushing off idea that bar-room punches of a welter-weight were of any concern, the Bush Administration didn’t understand that the inauspicious new adversaries not only had motive, but the means to do serious and lasting damage.

In conclusion, and unfortunately for the US, a series of ill-conceived security decisions by the Bush Administration were made based on a tired and romantic view of a world that probably never really existed. Six years later the world is left to hope that the Bush Administration has started to realize, as Gorbachev once did, that the value concept of a giant conventional superpower could be long past its shelf date. The idea of imposing unilateral will by generating endless turmoil abroad today does in fact exhaust a powerful nation, even America, and can actually end up eroding the base of power and undermining relationships. It was easy to see how this policy would lead to a quagmire of undesireable and taxing battles on multiple fronts where success would come only by lowering expectations. Do the American leaders today have the strength to admit the mistake and swallow their pride? Unlikley. And so the real danger now is that leaders, facing the exhaustion of their nation, may forgoe the high road of true democracy by becoming accountable and instead choose the path of desperation — quick fixes intended to create the illusion of success at any cost, without regard for the true damage they may cause to their country and its freedoms.

WordPress 2.0

Well, the WP upgrade went sort of smoothly. Let me know if you see any issues. The documentation was a bit sketchy since it says “make sure you do not delete a specific wp-” file right before it says run the command “rm wp-*”. I backed up the file in question first, obviously, and so far things seem to be working ok. The management of the site is significantly enhanced with lots of WYSIWYG and pretty colors, which doesn’t really do much for me. My purpose was actually just to keep up with some of the bigger bug-fixes, and I guess I just have to take some of the inlcuded zip and zoom with a grain of salt…

Diesel converts to water

You know the whole water into wine thing? Well, I hate to bring it up but what else comes to mind when the Army announces that their diesel-powered Humvees are going to be outfitted with technology that can return water from diesel exhaust? Just filter the exhaust through some “proprietary carbon filters” and put the results into a handy container in the Humvee and add a spigot. Pretty darn amazing idea, if you ask me, and apparently just one of the innovative things that happens when the chips are down in a desert and water is considered a truly precious commodity, yet diesel fuel is all around. Or as someone in logistics might put it “if you carry fuel, you already have your water”. Well, unless you run out of “proprietary” filters. But I digress…

once you taste the water, you realize the potential.

Great marketing slogan, because before I tasted the water I just thought it would be a convenient place to dump toxic waste from warships and munitions. To be frank, the risk equation being used here to justify the research is simple. The more complicated the supply logistics the more vulnerable the soldiers, so the brass are looking for ways to shore-up a water supply chain. Cleaning domestic superfund base sites? Civilians are vulnerable mostly, so no pressing need for the military to invest in new technology there…remember, the groundwork for the Internet was started by a project funded by the US military to help maintain the command structure during war.

Now, let’s say the situation with risk is different — contaminated water is all around, AND diesel refineries are nowhere to be found. Enter engines designed for bio-fuels? Hmm, maybe the next war, although the use of bio-diesel is known to lower the risk of damage from IEDs since it is less combustible. It also might make the water taste more like yesterday’s freedom fries.

In the meantime fuels like bio-diesel remain non-combat experiments and the ability to recycle the exhaust sounds like a cool use (pun intended) of energy tech that I hope makes it to the civilian world soon.

Muscle IDs

Anyone who’s fired a pistol knows that they get a “muscle memory” from the grip. Well, the latest biometrics are being considered for pistols in order to authorize the person who grabs the grip, based on their muscles. Grab a hold of one and fire a few rounds and it should be able to distinguish you from anyone else.

Makes a lot of sense, and it could perhaps be useful in other high-risk pursuits where you need to get a grip on things (to protect assets, reduce vulnerabilities, or mitigate threats…or a combination of the three). The only down-side, of course, is that if you become tied to the device meant to be disabled without you…well, you are actually now part of the device and the risk that goes with it. So if you are the only person who can fire the pistol, then you may be actually forced to use it in a way that you wouldn’t if it could be used without you. The risk matrix changes. It never goes away. Anyway, an interesting update to the possibilities out there for authorization controls.

FindU CallSign Database

This is rather impressive. If you want to see the APRS info for your area, check out the query site. Very handy for Business Continuity portals…on the same note, I just added a weather plugin to the right. The best use might be if it can detect the weather of the person (IP) visiting, but for now it gives you a window into one of the environments I live in. If I’m feeling ambitious I might also add in a few surveillance images.

Site Maintenance

Well, I recently posted some security fixes to the photo log (plog) portion of the site and now WordPress has announced their 2.0 release is official, which means I’ll be doing some fiddling over the next few hours to test and perhaps migrate the site. I’m excited about all the new features, but what really caught my eye was the little slogan at the bottom of the WordPress site:

Code is Poetry

Excellent! Although if it were up to me I would suggest they change this to “Secure Code is Poetry”, since a lot of code is just plain crap, and crap really isn’t poetry at all. I mean you have to draw the line somewhere, right?

Buyers beware

This is becoming all too common on the Internet: you have something stolen so you go online to see if you can get a good deal and suddenly realize the seller is the same person who stole the thing from you in the first place.

Today’s news is interesting because the man looking to replace his camera thought it odd that the seller was in the same town. This highlights the rather old adage “innocent until proven guilty” with the emphasis on the fact that the dumber the crook, the less likely they will be able to duck and cover once confronted with some basic facts.

In the retail industry eBay is sometimes the first place you look when things go missing. It almost lets the criminals implicate themselves for you, rather than requiring any kind of messy investigation. In fact, you might say that people can be awfully careful, if not downright sneaky, about theft just about up to the point where they post their warez online. And suddenly they’re in a whole new world with little idea of how to keep up the ruse. I almost felt sorry for one guy who went to jail. He was virtually invisible in the real world but lit up like a christmas tree online and probably never realized the connection.

Windows Metafile Header filters

Paul Laudanski posted some sample rules on Bugtraq that will help Sunbelt Kerio and Snort filter for windows metafile headers:

alert ip any any -> any any (msg: “COMPANY-LOCAL WMF Exploit”; content:”01
00 09 00 00 03 52 1f 00 00 06 00 3d 00 00 00″; content:”00 26 06 0f 00 08
00 ff ff ff ff 01 00 00 00 03 00 00 00 00 00″; reference:
url,www.frsirt.com/exploits/20051228.ie_xp_pfv_metafile.pm.php;
sid:2005122802; classtype:attempted-user; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:”BLEEDING-EDGE EXPLOIT
WMF Escape Record Exploit”; flow:established,from_server; content:”01 00
09 00 00 03″; depth:500; content:”00 00″; distance:10; within:12;
content:”26 06 09 00″; within:5000; classtype:attempted-user;
reference:url,www.frsirt.com/english/advisories/2005/3086; sid:2002733;
rev:1;)

Nice work, especially now that “73 variants of malicious WMF files” are reported to be circulating.

Edited to add: Bleeding Snort actually says “Signatures have been submitted by Matt Lange, Frank Knobbe, and others for the new WMF bug”, so kudos should go their direction. Thanks guys! The actual sigs are being maintained here. Here’s the latest snapshot (Revision: 1.5, Fri Dec 30 14:40:46 2005 EST (7 hours, 27 minutes ago) by fknobbe:

#by mmlange
alert tcp any any -> $HOME_NET any (msg:”BLEEDING-EDGE CURRENT WMF Exploit”; flow:established; content:”|01 00 09 00 00 03 52 1f 00 00 06 00 3d 00 00 00|”; content:”|00 26 06 0f 00 08 00 ff ff ff ff 01 00 00 00 03 00 00 00 00 00|”; reference: url,www.frsirt.com/exploits/20051228.ie_xp_pfv_metafile.pm.php; classtype:attempted-user; sid:2002734; rev:1;)

# By Frank Knobbe, 2005-12-28. Additional work with Blake Harstein and Brandon Franklin.
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:”EXPLOIT WMF Escape Record Exploit”; flow:established,from_server; content:”|00 09 00 00 03|”; depth:800; content:”|00 00|”; distance:10; within:12; pcre:”/\x26[\x00-\xff]\x09\x00/”; classtype:attempted-user; reference:url,www.frsirt.com/english/advisories/2005/3086; sid:2002733; rev:3;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:”EXPLOIT WMF Escape Record Exploit – Web Only”; flow:established,from_server; content:”HTTP”; depth:4; nocase; content:”|00 09 00 00 03|”; within:500; content:”|00 00|”; distance:10; within:12; pcre:”/\x26[\x00-\xff]\x09\x00/”; classtype:attempted-user; reference:url,www.frsirt.com/english/advisories/2005/3086; sid:2002741; rev:2;)

Microsoft gives green light on WMF to One Care

Well, after almost two days of the exploit Microsoft has come forward with Advisory 912840 that suggests several
things:

  1. This is more than just a hole in fully patched XP and 2003 (9x and 2K have been added to the list). Not much of a surprise there.
  2. The scope of the infection/attack is still vague, so there is no public advice yet on how to consistently close the hole. That’s something of a surprise, especially since Microsoft has announced that if you are part of their “One Care” program you are protected.
  3. Note: the One Care reference is wmf1228. Yet another vulnerability database…wonder what happens if you get two distinct WMF exploits on Dec 28th? Do they go to wmf1228a and wmf1228b? And next year when another WMF explot is launched on the same day? Do they switch to wmf061228a? Seems like someone isn’t thinking too carefully about even the simple things, but I digress…

  4. Microsoft really really wants you to contact the authorities, whether it be the FBI, Internet Fraud Complaint Center, or your local alternative.

So, I’m not sure I’m reading this announcement properly, but it raises an interesting question: Should a company be liable for damages from a defect if they have a fix but are not distributing it to anyone outside a subscription/maintenance program? Aside from all the details about fees and testing, etc. I am getting more and more curious why information about the patch (other than “if you use One Care and your light is green, then you are safe”) is not being released more quickly, since it obviously can’t be a good thing for Microsoft to delay and risk damage to all the non-One Care customers.

Edited to add: Some have suggested to me that the One Care fix is actually nothing more than an automated version of the suggestion on the Microsoft Alert:

Microsoft has tested the following workaround. While this workaround will not correct the underlying vulnerability, it will help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

Un-register the Windows Picture and Fax Viewer (Shimgvw.dll) on Windows XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows Server 2003 Service Pack 1

Note The following steps require Administrative privileges.

To un-register Shimgvw.dll, follow these steps:

  1. Click Start, click Run, type “regsvr32 -u %windir%\system32\shimgvw.dll” (without the quotation marks), and then click OK.
  2. A dialog box appears to confirm that the un-registration process has succeeded. Click OK to close the dialog box.

Impact of Workaround: The Windows Picture and Fax Viewer will no longer be started when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer.

Also, f-secure has said that they think this step is actually a really good idea, and that “leaving image editors out completely for the rest of the year might be a good idea.” I’ll defer to their expertise (and inside scoop) on the malware, but sometimes it is hard to tell whether they are serious or just have a really dry sense of humor.