Category Archives: Security

Energy, Security

Audi and VW report surge in diesel sales

Leave a comment

The Autoblog Green reports more great news for American car buyers: Audi diesel sales soar in November; TDI model accounts for 69% of A3 sales

Though Audi’s sales numbers certainly have improved over last year, it’s the automaker’s TDI-equipped clean diesel vehicles that have gained the most ground. The TDI engine accounted for 69 percent of all Audi A3 models sold in the U.S. in November. Additionally, the diesel-burning version of the Audi Q7 represented 45 percent of the SUV’s total sales volume. Both Audi and partner Volkswagen have witnessed a trend of growing interest in their clean diesel models and hope to continue to ride the surge with more TDI model launches scheduled for the U.S. in the coming years.

More TDI models? Excellent! Dear Audi, please include an all-wheel-drive option on the TDI passenger cars. I have been trying to find a way to import the amazing Audi Allroad TDI since 2004. The VW is nice, but variable height suspension and quattro are safety enhancements very useful in these big Sierra snow storms. I do not need the bling and mass of a Q-series, just the efficiency and functionality of the Allroad. At this point, however, I (and about ten others I know) would be thrilled to take delivery of an A3 quattro TDI.

Speaking of bling, the new V6 Le Mans diesel engine option would also be much appreciated as an option, even without anything like the stunning looks of the car:

The future of clean and smart engine design: Diesel by Audi.

Come on Honda and Subaru! Get in on the action. I have seen similar stories about your diesel models in Europe:

The company’s first horizontally-opposed boxer diesels have rolled out in Europe, and Subaru’s executive vice president Tom Doll said the diesel engine is a hot seller over there, so much so that Subaru total sales are increasing.

Autoblog Green says the car companies are now waiting on the government to mandate higher miles per gallon before they will believe American consumers are willing to buy better technology.

Our chance of getting this powerplant seems slim but new CAFE regulations requiring upwards of 35 miles per gallon by 2016 could convince Subaru that the time to offer Americans a diesel is now.

Toyota took a chance with the Prius and look what happened? The VW and A3 TDI sales are surging. Don’t wait for regulation; ship a limited run to the US and watch the data. Demand is here. Look at comments on the Autoblog Green for example:

I drive 25K miles per year in my 2000 Outback, need to burn 925 gallons of gas per year @ 27 miles per gal costing $2497 @ $2.70 per gal. If I used a diesel engine I would burn 500 gal @ 50 miles per gal costing $1500 @ $3.00 per gal. Save $997 per year or $29 per week. Additionally if diesel spikes up I have the option of making my own diesel out of various materials such as vegetable oil or algae. I really want that option in my next car.

That’s from an American with a low mileage estimate. I could not have said it better myself. Save money, clean the air, and shift America to alternative fuel sources through diesel engine sales, without sacrificing any performance or comfort.

Security

Microsoft Stops Office License Test

Leave a comment

The Microsoft support site says you might get an error message when you try to validate Office by using Office Genuine Advantage: “Why didn’t my computer complete validation” or “Error code: 0x8018111”. They give the following explanation:

The Office Genuine Advantage (“OGA”) program has been retired

This is awesome news for anyone who has been trying to run Office on dynamic hosts in virtual environments. Every time I started Office (basically every time I started a virtual machine) it would throw up a message with something like “Hardware change detected; you need to validate your copy of office using genuine advantage”.

It was particularly annoying at conferences where I could start my presentation only after I clicked “Ignore” on the license prompt.

I complained many times directly to Microsoft so perhaps it is this kind of issue that killed OGA.

Security

SSLstrip counter-measures

3 Comments

SSLstrip is a very easy tool to use that sits in between a victim and a legitimate website and switches their traffic from HTTPS to HTTP. If they continue to use the website in HTTP, the tool steals their passwords.

The author presented an example data set in 2009 that showed in 24 hours he was able to find a little over 100 passwords by setting up an attack in front of a single TOR router. He further boasted that not a single user stopped using the websites when his tool switched them to a non-SSL page.

The tool has to be on a network such as an open wireless to gather victim traffic. Many have also speculated about compromise of a host internal to an organization. Once a host inside a company has been compromised, then the tool can be installed to redirect local traffic by spoofing ARP tables. The stolen passwords, or other sensitive information, then can be sent back outside the organization.

A paper from George Mason University called “Prototype System to Protect against SSL-Stripping Attacks” suggests SSLstrip attacks can be defeated by forcing secure HTTP traffic using a special proxy. It sits in-between users and a web-site to prevent network traffic from redirection and interception by a rogue proxy like SSLstrip.

The client-side tool needs to be installed on all hosts to be secured on the a business’ or organization’s LAN, and the client’s browser will be configured to route all HTTP traffic through our system. As mentioned above, the routing of HTTPS traffic is not modified. Whenever the client host starts up, the client and server use public key encryption to establish a shared secret key.

When the user makes an HTTP request, the client tool generates a random number to prevent replay attacks, encrypts it along with the HTTP request using the shared secret key, and forwards them to the proxy server

(1). The proxy server stores the random number and forwards the HTTP request to appropriate web server
(2). When a response is received
(3), the proxy server computes a Hash-based Message Authentication Code (HMAC) of the response, using the HMAC-MD5 algorithm
(4). The server then appends the HMAC and the original random number to the HTTP response, encrypts it all
and sends it back to the client
(5). The client verifies both the HMAC and the random number
(6). If both match, the message was not modified in transit. If they do not match, the tool alerts the user to possible tampering.

Energy, Security

UK snowfall uncovers marijuana growers

Leave a comment

The heat generated by growing plants indoors, combined with poor insulation, led police to a “cannabis factory” in northern England

Members of the community reported suspicions about what was happening at a rented house in Montrose Road, Leicester.

When officers began checking out the information, they noticed the house was one of the few in the area without snow on the roof. Cannabis factories tend to be very warm due to the high number of industrial-strength lights used to encourage plant growth.

Officers obtained a search warrant, and yesterday (Thursday December 16) they raided the house. They discovered around 300 plants worth tens of thousands of pounds, and a sophisticated growing system.

[…]

“By closing this drugs factory we have disrupted a significant criminal enterprise, and stopped a large amount of drugs from reaching the streets of Leicester.”

Marijuana raids always mention a number of plants and 300 seems to be fairly common, as reported in California, Connecticut, Kansas, Florida, Idaho, Pennsylvania….

At first I was curious how 300 compares with other amounts reported for “significant” indoor finds so I searched by incrementing 100s (400, 500, etc.); I gave up when I reached 6400 (more than a ton, estimated at $9 million). That could melt a lot of snow.

The Leicestershire Constabulatory concluded their report with this quick guide to “cannabis factory” spotting:

* Windows obscured at all times
* Heavy condensation on windows
* The distinctive smell of cannabis
* Lights being used at odd times
* Deliveries of large items late at night