An Information Security Place

Steven J. Vaughan-Nichols is a fellow blogger at Computerworld, and typically drives me a little nuts with his "Microsoft-is-evil" / "Linux is God’s OS" posts (it drives me a little crazy when people take such a one-sided rabid stand on the OS issue – I am all for ideals, but Steven just goes too far sometimes).  However, his latest post is funny as all get out.  He posts a fake news release that is making some announcements of goings-on in the technology world where Linux doesn’t exist.  It is pure genius, and I busted a gut reading it.

So Steven, though I grind my teeth sometimes when I read your stuff, and even though I was actually drinking coke when I was reading this, you have earned a highly coveted OJ Award from An Information Security Place.  Congrats!

Vet

This post has no technical value.  Just experimenting with how much traffic I can get by putting the term “clickjacking” in a post.

But seriously, if you want to know anything about it, go listen to Martin’s podcast interview with Jeremiah and Rsnake.  You can also go over to Computerworld and take a look at the Q&A.

So…

clickjacking…

clickjacking…

clickjacking…

Rsnake

Robert Hansen

Jeremiah Grossman

Whitehat Security

SecTheory LLC

OWASP

Vet

OK, I haven’t given out an OJ award in a while, but The Hoff deserves this far and away.  He wrote a poem about the DNS flaw debacle and the debate that has ensued about disclosure, and it is the most awesome display of security poetry to date in my not-so-humble opinion.

So Chris, here ya’ go man.  Enjoy!

Vet

Diebold Accidentally Leaks Results Of 2008 Election Early

This post at Darknet.org.uk was devastatingly hilarious.  Just the title alone made me crack up: Im In Your Leenucks Box Changing Your Password.

It is all about a professor teaching a technical class.  He has some young punk who thinks he is the man when it comes to hacking.  The prof teaches the punk a lesson in a hilarious manner. 

Go read.  You will not regret it.  This one is definitely worth an OJ award!

Vet

We had a sales person ask for a recommendation on personal password management.  Of course everyone recommended Password Safe.  But then the fun began:

#1

Pen and paper?

#2

And tape it to the bottom of your laptop.

#3

I just use “password” for all mine.  Keeps it real easy

#4 – This one is mine:

I developed my own block cipher and use it to encrypt all my passwords. 

Well, I say “developed”.  To be fair, it is really just a derivative work.  I basically improved on the AES standard by making it a 1024 bit key size and a 256 bit block size.

Of course, with the quantum computer I just developed, it won’t take much to crack that algorithm.  Oh well, back to the drawing board.

#5

I started to do that too but it was too easy.

#6 – the last one

Don’t beat yourself up!  Try something a little more challenging.  I use the complex XOR operation with the following key.  Works every time!

x=a e=s n=p j=w q=r p=o f=d

That was fun.

Vet

OK, I know I said I was going to bed, but then I saw this post at mcwresearch.com.  Michael, you have earned your first OJ award.  Congrats!

Vet

Why do Alan and Mitchell call the Still Secure, After All These Years blog and podcast “SSATY” instead of “SSAATY”? 

Is there a conspiracy against the letter “A”? 

Do they not like the letter “A”?  I would think not since it starts Alan’s first name and also starts Mitchell’s last name. 

Does it help Alan cut costs to leave out the extra “A”?  Maybe so since he has recently announced a very successful quarter at his blog.

Did the blatant pursuit of fame and fortune drive the “A” away?

Did the “A” drive away in a cab after Alan pelted it with racist comments?

I should probably just ask Alan and Mitchell, but that would be too easy.

Vet

[Updated post - I added quite a bit]

I am about to leave the RSA conference. I am a little disappointed that I was not here all week. The last two years I arrived Monday and left Friday and got to go to all the sessions I could make it to. But that was when I was an Information Security Manager for a non-profit psychiatric clinic. They were used to sending doctors and their execs to conferences, so it wasn’t a foreign concept to them. Now that I am a presales SE for a security consulting firm, I have to make sure I am available for meetings and such as much as possible.

I really am grateful that I am here at all this year. I really came in just for the security blogger gathering, and I wouldn’t be here at all if it wasn’t for that. Of course, I did meet with a potential client while I was here, so I feel much more justified.

Speaking of the blogger gathering, I have to agree with Martin that it was a great event. I loved meeting everyone that I have been IM’ing and emailing and podcasting with for a year now (BTW, my blog is almost 1 year old – Feb 24, 2006 was my first post). My favorite part had to be the big bear hugs I got from Alan Shimel and Mitchell Ashley at StillSecure (the most exciting event of the evening was the cab ride from the Thai restaurant to my hotel, but I will give Alan a chance to blog about that first). Those two guys crack me up, and they are really cool guys.

I also finally got to meet the great Mike Rothman. I like that guy a lot.

I also got a thrill when I met people that said they read my blogs. I agree with Alan when he comments on how flattering it is to have someone say they read and actually value what I write.

I also enjoyed meeting Cutaway from Security Ripcord. That guy is as down-to-earth as you get. Just a good guy who doesn’t put on any airs. He’s a Marine (some would say former Marine, but once a Marine always a Marine). I was in the Army, so we inevitably end up talking military stuff. If you add Martin to the mix (ex-Army), it really gets deep.

One other person I really enjoyed meeting was Washintonpost.com’s own Brian Krebs, who writes the Security Fix blog. Brian is a celebrity in the security world because he writes for such a distinguished publication. But he is also respected by security professionals because he writes some good stuff and knows what he is talking about. And he was a nice guy, and he was also humble. I had to thank him personally for the great job he did of exposing the scandal with the Connecticut substitute teacher that was convicted for exposing her students to pornography (here and here).

Some other big names that were there:

Bruce Schneier - It was pretty cool to actually get to introduce myself to him. I’ve met him, but only quickly at shows and at a book signing. This was more personal.

Richard Stiennon - VERY nice guy. And all we bloggers thank him and Fortinet for sponsoring the event (we thank Microsoft as well).

Rich Mogull - Gartner man himself. Another down-to-earth and very likeable guy. And he is a second dan is taekwondo.

Ron Gula – It was a pleasure to meet Ron as well. Another good guy who could easily be arrogant but was not.

There are others, and I don’t mean to leave anyone out. I just can’t remember everyone. Suffice it to say that this was a group of people who were just excited to meet a bunch of peers and talk about security (though I don’t think we talked about security as much as we just BS’ed and had a good time networking).

Vet

[ev type="youtube" data="0OTgb3KO7QM"][/ev]

Since I am resolved not to get on this dang computer this holiday weekend, I leave you with this Eddie Murphy clip from Trading Places:

[ev type="youtube" data="vs08a4D0lgg"][/ev]

I have been blog-tagged by Ian Lamont, the Online Projects Editor over at Computerworld. I have mixed feelings about this stuff, especially since this is an information security blog and I am supposed to be guarding information. But it seems harmless enough. So, in the holiday spirit, I guess I will play along.

I am supposed to reveal 5 things about myself that few people know:

1. I drove a M1A1 Abrams tank with the 1st Infantry Division in Desert Storm

2. I was awarded the Army Commendation Medal (ARCOM) for assisting in capturing of a POW during the clearing of an enemy bunker complex don’t ask me why they had tankers doing this instead of infantrymen). He was hiding to avoid capture and came out with his gun drawn when we got close to his hiding spot. He decided against trying to shoot and run when he saw 5 American soldiers pointing M16’s and 9mm Berettas at various points on his anatomy.

3. I graduated seventh in my high school…out of 86 people.

4. I worked in a head shop in Manhattan, Kansas (in Aggieville, home of Kansas State University) when I was in the Army stationed at Fort Riley, Kansas. I was the only person who didn’t have long hair. No, I did not smoke weed or do any other drugs while I was in the Army. The people who owned the shop were just real cool.

5. I read novels voraciously, but I have to force myself to read nonfiction (except for engaging biographies and military / war stories).

So, now that I have told my deepest, darkest secrets, I am supposed to blog tag 5 other people. Not sure how some of the people I know will react to being blog tagged, but oh well.

Martin McKeay, Alan Shimel, Mitchell Ashley, Mike Rothman, and Michael at mcwresearch.com (not sure if he wants his last name posted).

Vet

Alan and Mitchell at the StillSecure After All These Years podcast interviewed me last week for their podcast. It is up here at Alan’s site and here at Mitchell’s site.  I gave an update on my move to the channel, about honesty in selling security, the converging of the security professional and the general IT professional article I wrote at CW, and some other stuff.  It was fun.
Thanks to Alan and Mitchell for having me on again. I really enjoy talking about myself, as anyone can plainly see, and Alan and Mitchell actually seem to genuinely be interested in the people they interview. They are two great guys that I hope to meet soon at the RSA Conference security blogger gathering (not sure if Mitchell is going to be there, but I know Alan is going to show).

Thanks for the kind words, guys. You are two class acts.

And Alan, notice that I did not alter the picture in any way!  Or did I?
Vet

My wife and sister-in-law managed to convince my father-in-law to dig through the storage closet and pull out their old Classic Nintendo Entertainment System (NES).  They have a bunch of games like the original Mario Brothers, Duck Hunt, Dr. Mario, etc.  I am posting this at almost midnight Central time, and they are still playing.  I am trying to decide whether to go back or go to bed.

Anyway, this thing brings back all kinds of memories of my childhood.  I remember putting my original NES on layaway when I was in high school.  I think it was just over $100 back then, and I only earned about $200 / month, so it was quite the financial decision.  Waiting for a month to get that thing just about killed me!

When I did get it, I did nothing but play.  I was a Zelda master and a Mike Tyson ass-whipper back then.  I would stay up all night with a friend competing to see who could beat different games the fastest.  We would start right after dinner (around 7pm) and would not stop until the sun came up the next morning.  Remember those days?

Good times, good times…

Vet

I might adopt this as my theme song. Do I have to pay royalties?

[ev type="google" data="1384277706451157121"][/ev]

Thanks to Pito at salas.com for the link to this site.  Very sweet looking speed test site.  And you can choose speed test servers all over the world.  Of course, they could be downloading malware on your PC, but hey, it is still cool!

Vet

I started doing some research, and I found this picture.  Now I am not making any political statement here, so don’t flame me.  I didn’t see this during the Bush – Gore campaign battle, and I have to say that this kinda freaked me out for a second.  Then I started laughing.

Vet

[gv data="6A0rwG39Jzk"][/gv]