Category Archives: Security

Locally Decode Windows Administrator Password for AWS Instance

If you’ve run into that awkward moment in AWS when they ask you to submit your key into some suspicious-looking web interface in order to receive the password for your newly created instance, this quick command is for you.

After an instance is created and running, right-click on the instance and select “Instance Settings” then “Get System Log”:

As you just booted your instance for the first time, the administrator password will be printed to the log:

Copy the text between the password markup to your buffer and then paste it into this command along with the local directory of your pemfile:

echo "copied-password" | base64 -d | openssl rsautl -decrypt -inkey "directory/pemfilename" -out administrator.password

Then open the administrator.password file and you’ll see the password for your administrator account

Did a Spitfire Really Tip the Wing of V1?

Facebook has built a reputation for being notoriously insecure, taking payments from attackers with little to no concern for the safety of its users; but a pattern of neglect for information security is not exactly the issue when a finance guy in Sydney, Australia gives a shout-out to a Facebook user for what he calls an “amazing shot” in history:

As anyone hopefully can see, this is a fake image. Here are some immediate clues:

  1. Clarity. What photographic device in this timeframe would have such an aperture let alone resolution?
  2. Realism. The rocket exhaust, markings, ground detail…all too “clean” to be real. That exhaust in particular is an eyesore
  3. Positioning. Spitfire velocity and turbulence relative to V1 is questionable, so such a deep wing-over-wing overlap in steady formation is very unlikely
  4. Vantage point. Given positioning issue, photographer close position aft of Spitfire even less likely

That’s only a quick list to make a solid point this is a fabrication anyone should be able to discount at first glance. In short, when I see someone say they found an amazing story or image on Facebook there’s a very high chance it’s toxic content meant to deceive and harm, much in the same way tabloid stands in grocery stores used to operate. Entertainment and attacks should be treated as such, not as realism or useful reporting.

Now let’s dig a little deeper.

In 2013 an “IAF Veteran” posted a shot of a Spitfire tipping a V1.

This passes many of the obvious tests above. He also inserts concern about dangers of firing bullets and reliably blowing up a V1 in air, far away from civilians, versus sending it unpredictably to ground. Ignore that misleading analysis (shooting always remained the default) and revel instead in authentic combat photo quality of that time.

After this 2013 tweet several years then pass by, and nobody talks about V1 tipping, until only a few weeks ago a “Military aviation art” account posts a computer rendered image with a brief comment:

Part of a new work depicting the first tipping of a V-1 flying bomb with a wing tip. Who achieved this?

It is a shame this artist’s tweet wasn’t given proper and full credit by the Sydney finance guy, as it would have made far more sense to have a link to the artist talking about their “new work” or even to their art gallery and exact release dates:

Who achieved this? Who indeed? The artist actually answered their own question in their very next tweet, where they wrote…

On the bright side the artist answers their own question with some real history and a real photo, worth researching further. On the dark side the artist’s answer also sadly omits any link to original source or reference material, let alone the (attempted) realism found above in that “IAF veteran” tweet with an actual photograph.

The artist simply says it is based on a real event, and leaves out the actual photograph (perhaps to avoid acknowledging the blurry inspiration to their art) while including a high-resolution portrait photo of the pilot who achieved it.

Kind of misleading to have that high-resolution photograph of Ken Collier sitting on the ground, instead of one like the IAF Veteran tweeted… an actual photograph of a V1 being intercepted (e.g. Imperial War Museum CH16281).

The more complete details of this story not only are worth telling, they put the artist’s high-resolution fantasy reconstruction (of the original grainy blotchy image) into proper context.

Uncropped original has a border caption that clearly states it’s art, not a photo

Fortunately “V1 Flying Bomb Aces by Andrew Thomas” is also online and tells us through first-person accounts of a squadron diary what really happened (notice both original photographs are put together in this book, the plane and the pilot).

And for another example, here’s what a Vickers staged publicity photo of a Spitfire looked like from that period.

A Spitfire delivers beer to thirsty Allied troops

It shows the “Mod XXX Depth Charge” configuration (two 18 gallon barrels of bitter “beer bombs” to deliver into Normandy) and you can be sure an advertising/propaganda agency would have used the clearest resolution possible — the British don’t mess around with their beer technology.

Again notice the difference between air and ground photos, even when both are carefully planned and staged for maximum clarity.

Strong’s Brewery Barrels Locked and Loaded.

Back to the point here, V1 would be shot down in normal operations not “tipped”, as described below in a Popular Mechanics article about hundreds in 1944 being destroyed by the Tempest’s 22mm cannon configuration.

Popular Mechanics Feb 1945

Just to make it absolutely clear — Popular Mechanics’ details about cannons unfortunately doesn’t explain shooting versus tipping — here’s a log from Ace pilots who downed V1.

Excerpted from “V1 Flying Bomb Aces” by Andrew Thomas

So you can see how debris after explosions was a known risk to be avoided, even leading to gun modifications to hit with longer-ranges. It also characterizes tipping as so unusual and low frequency it would come mainly at an end of a run (e.g. with gun jammed).

Just for a quick aside for what followed soon after WWII ended, as I wrote on this blog last year, things inverted — shooting drones down in the 1950s was far more dangerous than tipping them because of increased firepower used (missiles).

Compared to shooting cannons at the V1, shooting missiles at drones was more like launching a bunch of V1s to hit a bigger V1, which ended as badly as it sounds (lots of collateral ground damage).

Again, the book “V1 Flying Bomb Aces” confirms specific ranges in the 1940s were used for shooting bombs so they exploded in air without causing harm, preferred against tipping.

Osprey Pub., Sep 17 2013.
ISBN 9781780962924

…the proper range to engage the V1 with guns was 200-250 yards.

Further out and the attacker would only damage the control surfaces, causing the V1 to crash and possibly cause civilian casualties upon impact.

Any closer and the explosion from hitting the V1’s warhead could damage or destroy the attacking aircraft.

Apparently the reason tipping worked at all was the poorly engineered Nazi technology had a gyro stabilizer for two dimensions only — flight control lacked roll movement.

V1 Flying Bomb Gyro. Source: MechTraveller

Tipping technically and scientifically really was a dangerous option, because physics would send the bomb out of control to explode on something unpredictable.

Back to the curious case of the artist rendering that started this blog post, it was a Spitfire pilot who found himself firing until out of ammo. He became frustrated without ammo so in a moment of urgency decided to tip a wing of the V1.

Only because he ran out of bullets, in a rare moment, did he decide to tip… of course later there would be others who used the desperate move, but the total number of V1 tipped this way reached barely the dozens, versus the thousands destroyed by gunfire.

Shooting the V1 always was preferred, as it would explode in air and kill far fewer than being tipped to explode on ground as also documented in detail by Meteor pilots, hoping to match the low-altitude high-speed of a V1.

Compared with the high performance piston-engined fighters then in service with the RAF (the Tempest V and Spitfire XIV), the Meteor offered little in the way of superior performance. Where it excelled, however, was at low level – exactly where the V1 operated. The Meteor I was faster than any of its contemporaries at such altitudes. This was just as well, for the V1 boasted an average speed of roughly 400mph between 1,000ft and 3,000ft. At those heights the Tempest V and Spitfire XIV could make 405mph and 396mph, respectively, using 150-octane fuel. The Meteor, on the other hand, had a top speed of 410mph at sea level. […] While the first V1 to be brought down by a Meteor was not shot down by cannon fire, the remaining 11 credited to No. 616 Sqn were, using the Meteor I’s quartet of nose-mounted 20mm cannons.

Note the book’s illustration of a V1 being shot at from above and behind. Osprey Publishing, Oct 23 2012. ISBN 9781849087063

Does a finance guy in Sydney feel accountable for claiming a real event instead of admitting to an artist’s fantasy image?

Of course not, because he has been responding to people that he thinks it still is a fine representation of a likely event (it isn’t) and he doesn’t measure any harm from confusion caused; he believes harm he has done still doesn’t justify him making a correction.

Was he wrong to misrepresent and should he delete his “amazing shot” tweet and replace with one that says amazing artwork or new rendering? Yes, it would be the sensible thing if he cares about history and accuracy, but the real question is centered around the economics of why he won’t change.

Despite being repeatedly made aware that he has become a source of misinformation, the cost of losing “likes” probably weighs heavier on him than the cost of having a low integrity profile. And as I said at the start of this post (and have warned since at least 2009 when I deleted my profile), the real lesson here is that Facebook loves low-integrity people.

Facebook to Replace Churches… With Surveillance

In January of 2017 Facebook announced a “pledge” to visit 50 states of America in person “to learn how people live“.

It sounds like an unintentional self-own — a thorough condemnation of Facebook — by saying software doesn’t work at all and physical contact is the best way to learn.

In other words a social behavior platform is so utterly disconnected from reality of how people live its CEO has to announce a better way is to visit people in order to learn from them?

It doesn’t make sense at all because… it’s a lie.

Facebook’s CEO wasn’t really taking a step outside his high-security anti-social guarded compound to visit actual people to understand real social behavior.

Nope.

He was clumsily hinting at a plan to conquer and displace leadership in a new target/expansion area: Replace Church (e.g. use centralized tactics to draw people away from their local faith and community and towards worship/like of Facebook-controlled groups instead).

A local community-based faith in God is seen as competition by the CEO of Facebook, who since his Harvard student days has openly sought ways to manipulate the public into giving him control over their “likes”.

There was foreshadowing, to be fair, from the sort of enlightened place you may expect.

Howard University pulled the alarm way back in 2011, when Ronald Hopson (associate professor of psychology and divinity) signaled “Facebook Can’t Replace Church”.

As long as we are sentient beings, we will require direct contact as a principal mode of interaction. […] Electronic bits may prove inadequate to convey the same rich experience of encounter. Ultimately, virtual gatherings will not be enough.

Ok now fast-forward from that early 2017 “pledge” and notice headlines from local religious leaders reflecting on the awkward in-person visit from Facebook’s leader.

Zuckerberg himself started admitting Churches were foremost on his chopping-block, using extremely ignorant and tone-deaf logic to boot.

“A church doesn’t just come together by itself,” Zuckerberg said. “It has a pastor who looks out for the well-being of the congregation. And if someone hits hard times, they’re in charge of making sure that people have the food and shelter they need. A Little League team has a coach who motivates the kids and helps teach them how to hit better. Leaders set the culture, they inspire us, they motivate us, they give us a safety net and they take care of us.” Zuckerberg said Facebook’s artificial intelligence algorithm can power the website to more effectively organize online communities…

I could probably write a whole book about why the Facebook CEO is so egregiously wrong (and technically I am), but let me just point out some high-level failures that make him sound so evil:

  1. A church absolutely can form BY ITSELF and not owe itself to one individual. I can’t believe I have to say this. The definition of church is literally a gathering of people who share faith, almost like an instinct to get together for safety. So right off the bat the Facebook argument is a bunch of self-serving disinformation.
  2. The etymology of “pastor” (considered a leader in some Protestant Churches, not to be confused with Al Pastor) is someone who cares for a flock of sheep. Do sheep flock if they don’t have a pastor? Duh. Of course they do. “Sheep have a strong flocking instinct. They feel safer when gathered together.”
  3. More importantly, if a flock has a leader what would disrupt this status? I mean can a pastor be “unholy” for example? NO, by definition a pastor must be selfless and devoted to service a greater good. (e.g. Facebook could NEVER take the role of a pastor because by definition they are entirely selfish). The true pastor keeps patience while blameless (remains holy), whereas Facebook tells everyone to “fail faster” and act irresponsibly (sins excessively) — two literal opposite ends in morality.
  4. From there you hopefully can see the giant misstep in Zuckerberg saying “they’re in charge of making sure that people have the food and shelter they need” as if a pastor is supposed to control “needs” from his bank account with special contractors on speed-dial to build compounds… as if some kind of Koresh cult.
  5. Indeed, notice how the list of “leader” qualities has things like “set the culture” and “take care of us”. Instead of the normal “teach a man to fish” line that most real leaders would recognize, this is like reading evil leadership tips like “if you give a man a fish you can inspire and motivate him to do what you want”.

This is on top of the fact that Zuckerberg equates a decline in Church membership to a lack of “sense of purpose and community”.

That’s just wrong. So wrong.

Consider for example that his own point — people leaving Church find a new sense of purpose and community elsewhere — completely contradicts himself.

If people leaving Church are the same thing as people having no sense of purpose and community, then Facebook can’t be the answer!

So I really don’t see all that much difference between Zuckerberg’s claim that he has a limited understanding how people really live, and his desire to be their “leader” by telling them how to live by falsely claiming to have a safety net in mind (while in fact trying to become a monopoly, like a cult they can’t escape from).

Zuckerberg has built little more than a big greed machine ignorant of history. Dostoyevsky wrote about this over 100 years ago in Brothers Karamazov, as Tweeted recently by Tom Simonite:

Some claim that the world is gradually becoming united, that it will grow into a brotherly community as distances shrink and ideas are transmitted through the air. Alas, you must not believe that men can be united in this way. To consider freedom as directly dependent on the number of man’s requirements and the extent of their immediate satisfaction shows a twisted understanding of human nature, for such an interpretation only breeds in men a multitude of senseless, stupid desires and habits and endless preposterous inventions. People are more and more moved by envy now, by the desire to satisfy their material greed and by vanity.

Oh, and in terms of leaders “taking care” of their flock when big data is involved?

Federal Bureau of Investigation files show that just over a year after L. Ron Hubbard created the the Hubbard Dianetic Research Foundation, a precursor to the Church of Scientology, he offered to become an informant for the Bureau, and provide the FBI with a list of its members and copies of their fingerprints.

Think in terms of Zuckerberg rushing in to attract people leaving Churches in the same way as Hubbard built his empire of weird cult behavior; create slavish fealty for profit while selling-out adherents on a constant surveillance platform.

The “learn how people live” operation from Facebook seems based on far more sinister intent than people realize. It will be unfortunate for anyone who really allows this CEO into their lives.

2017 BSidesLV: Hidden Hot Battle Lessons of Cold War

My presentation on machine learning security opened the Ground Truth track at the 2017 BSidesLV conference:

When: Tuesday, July 25, 11:00 – 11:30
Where: Tuscany, Las Vegas
Cost: Free (as always!)
Event Link: Hidden Hot Battle Lessons of Cold War: All Learning Models Have Flaws, Some Have Casualties

In a pursuit of realistic expectations for learning models can we better prepare for adversarial environments by examining failures in the field?

All models have flaws, given any usual menu of problems with learning; it is the rapidly increasing risk of a catastrophic-level failure that is making data /robustness/ a far more immediate concern.

This talk pulls forward surprising and obscured learning errors during the Cold War to give context to modern machine learning successes and how things quickly may fall apart in evolving domains with cyber conflict.

Copy of Presentation Slides: 2017BSidesLV.daviottenheimer.pdf (4 MB)

Full Presentation Video:

Prior BSides Presentations