Archive for the 'Family' Category

May 04 2015

Dad, I want to learn to hack

Published by under Family,Hacking,Social Networking

My teenagers, like many teenagers, are curious about what their father does for a living.  They’ve been to maker faires, security conferences, unconferences, Defcon, BSides, Hack in the Box, and they’ve really enjoyed them all. They’ve heard me talk about all sorts of current events in the context of computer security.  Quite frankly, I’m a little surprised they still want to hear about security and privacy considering my propensity to monologue (aka rant) about most things security related at the drop of a hat.  But they’re both sponges and given that security has become something that’s in the public awareness, they’re still interested in security, and by extension, hacking.  Or maybe it’s security that’s ‘by extension’, because the idea of breaking into something will always be sexier than the idea of securing it.

This weekend that curiosity hit a critical threshold and the oldest Spawn asked “Dad, how can I learn to hack?” Now, I’ve never been a hacker, just a tinkerer who understands a little about a lot of things, so I did what many good security professionals do when faced with a question:  I went to Twitter.  And I got a lot of good suggestions from folks like Wim Remes (@wimremes),  Improbably Eireann (@blackswanburst), Andreas Lindh (@addelindh), Adrian (@alien8) and Erik Wolfe (@ArchNemeSys), just to name a few.  I also got some cynical feedback from Sid (@trojan7Sec), but that’s fodder for a different blog post.

Before I get to the list of sites sent to me, I have to mention another experiment I’m trying with the Spawn and for my own education.  As my co-worker, Larry Cashdollar (@_larry0), suggested I have a Raspberry Pi 2 with Kali Linux sitting in the living room waiting for the Spawn to get curious enough to start poking around on it.  I taught them how to use Putty to log into it and let them go, but it is a bit intimidating for a first time Linux user and it’s mostly sat there untouched so far.  That being said, the very first thing Spawn0 did was to change the admin password on me and lock me out of the system, until he came into my office giggling like a maniac.  It was a proud Dad moment.

So, without further ado, here’s  a list of the suggestions:

  • Untrusted – This was the first suggestion I received and the one that Spawn0 immediately latched onto.  He completed everything but the last level in one afternoon.  His feedback was that it’s not exactly a ‘hacking’ tutorial, but that it’s interesting and fun none the less.
  • Metasploitable – Another request by Spawn0 was a suggestion for a Linux VM for him to play with and learn on.  Metasploitable is a great tool for exactly that, especially when it’s coupled with the Kali Linux RPi system for testing from.
  • Over The Wire – “learn and practice security concepts in the form of fun-filled games” pretty well sums it up.  I’ve always maintained that security and hacking are more about the thought processes behind decisions than they are about the technology and this helps build the foundations for those thoughts.
  • Hack This Site – This one came in while he was in the depths of Untrusted, so it hasn’t been tested yet.  I played with it when it first came out and I’m interested to see how it’s evolved and how a young adult can learn from the site.
  • – More of a library than a tutorial, there’s still a lot of information to be gained from this site.  I’m not going to encourage the Spawn to become a CISSP, though I may point him in the direction of the CCNA.  Foundational networking is more important than having knowledge that’s a mile wide and an inch deep.
  • Hacking: The Art of Exploitation – Back to my theme of understanding the foundations, this book looks at the underlying ideas of hacking. Originally published in 2003 and updated in 2008, it’s still recommended reading today.  Thanks to my team at Akamai, I brought home a copy of Future Crimes by Marc Goodman from RSA, and both of the Spawn are taking turns reading it.  Might explain the uptick in hacking interest.
  • Mathy Vanhoef – I was pointed to the Memory Hacking blog post, but there’s a lot of crammed into a few posts on this site.  Probably beyond a beginner, and some of it’s beyond my understanding as well.

I don’t necessarily want either of my underlings … I mean children … to follow in my footsteps and become security professionals, but I’m a strong believer in exploring as many different interests as possible.  And anything they learn about hacking, from the underlying philosophies to the technical details, will be helpful in their future.  No matter what they decide to do with their lives, knowing how to program, how to hack and how to things work at the bits and bytes level are going to be important in their futures.  And it gives me an excuse to dust off some of my own skills as well.

More suggestions for sites to add to the list are appreciated.

Edited to add suggestions from Twitter:

  • From @gianluca_string – Exploit Exercises – A host of virtual machines to beat upon and break.  Gianluca Stringhini says he’s using in his hacking class this semester.
  • A glaring oversight when talking about teaching kids to hack was HacKid Conference.  Both of the Spawn consider this to be the best experiences they’ve ever had at a security conference.  Wish I could take them again, but living in the UK makes it unlikely. (hat tip to @beaker and apologies for missing this the first run through)
  • From @EricGershman – PicoCTF – This was a competition targeting middle and high school students from last year, but it’s been continued with access given to teachers for tracking of their students.
[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

2 responses so far

Sep 14 2014

Limiting online time

Published by under Family,General

I limit online time.  Not for me, for my children.  Apparently I’m among a fairly prestigious group of people who do so, since many of the C-level execs in Silicon Valley also limit their children’s time with tech.  Though it looks like many of them are even stricter than I am about how much time the children get to interact with their computers.

We’ve always limited the amount of time our children can spend on the computer.  We found from an early age, they’d spend every waking moment playing games and surfing the internet if they could.  I wonder who they’re using as their role model?  When they got their first computer, one I’d rebuilt from parts of several of my older computers, we allowed them to have it in their room.  We found out quickly that was a mistake, as our youngest had taken to watching videos that contained language we didn’t want him using.  Ever.  Since then the computers have been in the computers have been in a common area where we could look over their shoulders whenever we wanted.

We have hard limits for when they’re allowed on the computer, which are probably not as strict as many of the parents mentioned in the times article.  The children often try to get around these limits by grabbing their iPhones or a tablet, but it’s made clear that these also count as time online and aren’t allowed.  We have hundreds of books, scattered around the house, and reading is always encouraged, no matter the time of day.  Now if we could only teach the youngest how to treat books with proper respect.

One thing we’re looking at changing is their use of social media.  Neither of the children have any social media accounts at all.  It’s not just that we don’t want them to have Facebook or Twitter accounts, it’s also that they’ve heard me talk about social media so much that they have decided on their own that it’s not worth it to have them.  They do have Skype accounts for keeping in touch with their friends back in the States and a few forum accounts, but these aren’t really ‘social media’ as I think of it, though maybe I’m wrong.

This might change in the near future, as our older has started expressing some curiosity towards social media and would like to experiment some.   As long as he understands his parents will be following him and watching who he interacts with, at least at first, I think we can allow him to try it.  I don’t want him to be like the guy who keeps a case of soda in his room because his parents never let him have it as a kid.  Instead we’ll let our children learn in a relatively safe environment, or at least one where we can intervene if we need to.

[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

One response so far

Sep 04 2014

Congratulations, Rich

Published by under Family,General,Humor,Personal

Wow, it’s been seven years since Rich Mogull left Gartner and started Securosis.  I met him shortly before he took the leap, introduced by a mutual friend, Richard Stiennon.  I worked with Rich and a host of others to organize the first Security Bloggers Meetup at RSA, which is still going, and when I heard he was leaving Gartner, I invited him to participate in the Network Security Podcast with me, a partnership that lasted over six years.  He’s  a good person, a good friend, and someone I truly feel lucky to have met in the security community.

It’s interesting to see the progression any security professional makes in their career.  Many of us reach a certain level and seem to be content to rest there, while others never stop, never slow down and are never content with where they are now.  You can guess which of these two I believe Rich to be.  It’s heartening to see friends be successful, since one of the recurring themes in security is how we’re losing the war and burning out.  Seeing someone who’s still excited by their role, if not waking up in the morning, is a wonderful experience to behold.

Where were you seven years ago?  I was the security manager for a small company that had been in start-up mode for 12 years.  Now I’m living near London, working as Akamai’s Security Advocate for Europe and traveling the world over.  If I look at Rich as a benchmark, I feel a little inadequate sometimes.  But if I look at where I started versus where I am now, I’m happy, especially if I think about how much farther I can go.  I’m happy that my friends have been successful beyond my wildest dreams.

Congratulations on seven years of success to Rich Mogull and the rest of the team at Securosis.  You deserve the prosperity you’ve enjoyed over the years and I hope you have many, many more years of the same.  Just one thing:  Keep your pants on.

[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

One response so far

Aug 25 2014

An American in London

Published by under Family,Personal

Almost exactly a year ago my family and I moved from Northern California to 20 miles west of the capital of the United Kingdom, London.  It was the start of an adventure that’s exposed us to a new culture, cut us off from most of our friends and family and made massive changes to how we see the world.  We’ve had to make huge adjustments in our expectations, our lifestyle and how we drive, but my wife and I both think it’s been worth it.  The children seem to disagree, if you believe their loud and frequent complaints.  But these seem to be fewer and fewer as time goes by.

The first few weeks we were living in an apartment a few miles from where we live now.  It was a good landing spot while we waited for our shipment to arrive.  But being a family of four in a two bedroom apartment was its own special level of hell when you’re used to having a little privacy from time to time.    Thankfully our stuff arrived in fairly short order and we got to move into the house we’re living in now.  Everyone has their own space, though my wife spends most of her time in the kitchen or her office, while the kids spend theirs on the computer in the reception room we designated their office and I spend mine in an office that was converted from half the garage.  It’s a good house, about 100 yards from the station, with two trains an hour into London’s Waterloo station.

Learning to drive on the other side of the road wasn’t difficult and we’ve only made the mistake of driving on the right side of the road a few times each, thankfully in parking lots for the most part.  Getting used to roundabouts was more of a learning experience and I know I got honked at more than a few times that first month.  Now I’m fully adjusted and wondering why they’re being used so badly in the US, when they really do contribute to traffic flows when used properly.  The biggest problem I’ve had adjusting has been the bathrooms here, with the light switch on the outside, separate hot and cold water taps and toilets that just don’t seem to work as well as I’d like.  There’s also the shopping, but over the last year we’ve managed to decipher the English equivalent of American products, even if it doesn’t always look or feel exactly like we’re expecting.  There are a few products we still can’t get, like proper stuffing and chocolate chips.  But my occasional business travel to the US makes those limitations livable if we’re frugal in using our resources.

The children are the one’s who’ve had the hardest time adjusting though.  School has been a step back for them, since the UK schools don’t seem to be equipped to deal with exceptional children and this has frustrated them greatly.  They miss their friends, which is sometimes harder because they can get on Skype and talk to them whenever their sleep patterns allow.  What they absolutely hate the most is when the wife and I say, “You’ll look back on this when you’re older and realize what a great opportunity it was.”  Tomorrow’s appreciation is for tomorrow, while today’s whining and complaining is for today.   What they don’t realize is that they’ve seen half a dozen countries in the last year, more than many Americans will ever see in their entire life.  I hope they don’t hate us too much until the light of appreciation dawns upon them.

This is the end of the first year in England, with at least two more to go, barring the unexpected.  We’re settled in as a family, I’m settling in more to the role I’ve chosen at work and at least the wife and I are glad we made the choice to leave the US and immigrate to England, at least temporary.   We spent a week December exploring Munich, my wife spent her 50th birthday visiting museums around Amsterdam and we took a train into London on Saturday to explore Brick Market and Old Spitalfield Market.  These are the kinds of experiences we came to Europe to have.  And this week we have both friends and family visiting from the States.  I hope I survive the experience.

We’ll always be outsiders in England.  But life here almost feels … normal.

[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

6 responses so far

Aug 03 2014

Last Hacker Standing, Episode IV – The Last Hope

Published by under Family,Hacking,Humor,Podcast

Well, I told you I couldn’t go that long without recording a podcast.  And a couple of weeks ago I got together with my friends Chris John Riley and Dave Lewis and started a new project, Last Hacker Standing.  In the inaugural podcast, we talk news (straight up, with a twist), alongside our wonderful guest Katie Moussouris from Hacker One.  I’m going to try to have fun with this one, not taking it too seriously.  Not that I ever took the Network Security Podcast all that seriously, of course.  Our format is going to be a podcast twice a month, with a guest who will join us to talk about news stories for the first half and talk about themselves for the second half.  We do reserve the right to change this format whenever we please.

Last Hacker Standing, Episode IV – The Last Hope


[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

3 responses so far

Jul 21 2014

Can I use Dropbox?

Published by under Encryption,Family,Privacy,Risk

I know security is coming to the public awareness when I start getting contacted by relatives and friends about the security of products beyond anti-virus.  I think it’s doubly telling when the questions are not about how to secure their home systems but about the security of a product for their business.  Which is exactly what happened this week; I was contacted by a family member who wanted to know if it was safe to use Dropbox for business.  Is it safe, is it secure and will my business files be okay if I use Dropbox to share them between team members?

Let’s be honest that the biggest variable in the ‘is it secure?’ equation is what are you sharing using this type of service.  I’d argue that anything that has the capability of substantially impacting your business on a financial or reputational basis shouldn’t be shared using any third-party service provider (aka The Cloud).  If it’s something that’s valuable enough to your business that you’d be panicking if you left it on a USB memory stick in your local coffee shop, you shouldn’t be sharing it via a cloud provider in the first place. In many cases the security concerns of leaving your data with a service provider are similar to the dropped USB stick, since many of these providers have experienced security breaches at one point or another.

What raised this concern to a level where the general public?  It turns out it was a story in the Guardian about an interview with Edward Snowden where he suggests that Dropbox is insecure and that users should switch to Spideroak instead.  Why?  The basic reason is that Spideroak is a ‘zero-knowledge’ product, where as Dropbox maintains the keys to all the files that users place on it’s systems and could use those keys in order to decrypt any files.  This fundamental difference means that Dropbox could be compelled by law to provide access to an end user’s file, while Spideroak couldn’t because they don’t have that capability.  From Snowden’s perspective, this difference is the single most important feature difference between the two platforms, and who can blame him for suggesting users move.

Snowden has several excellent points in his interview, at least from the viewpoint of a security and privacy expert, but there’s one I don’t think quite holds up.  He states that Condoleezza Rice has been appointed to the board of directors for Dropbox and that she’s a huge enemy of privacy.  This argument seems to be more emotional than factual to me, since I don’t have much historical evidence on which to base Rice’s opinions on privacy.  It feels a little odd for me to be arguing that a Bush era official might not be an enemy of privacy, but I’d rather give her the benefit of the doubt than cast aspersions on Dropbox for using her experience and connections.  Besides, I’m not sure how much influence a single member of the board of directors actually has on the direction of the product and the efficacy of its privacy controls.

On the technical front, I believe Snowden is right to be concerned.  We know as a fact that Dropbox has access to the keys to decrypt user’s files; they use the keys as part of a process that helps reduce the number of identical files stored on their system, a process called deduplication.  The fact that Dropbox has access to these keys means a few things; they also have access to decrypt the data if they’re served with a lawful order, a Dropbox employee could possibly access the key to get to the data and Dropbox could potentially be feeding into PRISM or one of the many other governmental programs that wants to suck up everyone’s data.  It also means that Dropbox could make a mistake to accidentally expose the data to the outside world, which has happened before.  Of course, vulnerabilities and misconfigurations that results in a lapse of security is a risk that you face when using any cloud service and is not unique to Dropbox.

I’ve never seen how Dropbox handles and secures the keys that are used to encrypt data and they haven’t done a lot to publicize their processes.  It could be that there are considerable safeguards in place to protect the keys from internal employees and federal agencies.  I simply don’t know.  But they do have the keys.  Spideroak doesn’t, so they don’t have access to the data end users are storing on their systems, it’s that simple.  The keys which unlock the data are stored with the user, not the company, so neither employees nor governmental organizations can access the data through Spideroak. Which is Snowden’s whole point, that we should be exploring service providers who couldn’t share our data if they wanted.  From an end-user perspective, a zero-knowledge is vastly preferable, at least if privacy is one of your primary concerns.

But is privacy a primary concern for a business?  I’d say no, at least in 90% of the businesses I’ve dealt with.  It’s an afterthought in some cases and in many cases it’s not even thought of until there’s been a breach of that privacy.  What’s important to most businesses is functionality and just getting their job done.  If that’s the case, it’s likely that Dropbox is good enough for them.  Most businesses have bigger concerns when dealing with the government than whether their files can be read or not: taxes, regulations, taxes, oversight, taxes, audits, taxes… the list goes on.  They’re probably going to be more concerned with the question of if a hacker or rival business can get to their data than if the government can.  To which the answer is probably not.

I personally use Dropbox all the time.  But I’m using it to sync pictures between my phone and my computer, to share podcast files with co-conspirators (also known as ‘co-hosts’) and to make it so I have access to non-sensitive documents where ever I am.  If it’s sensitive, I don’t place it in Dropbox, it’s that simple.  Businesses need to be making the same risk evaluation about what they put in Dropbox or any other cloud provider: if having the file exposed would have a significant impact to your business, it probably doesn’t belong in the cloud encrypted with someone else’s keys.

If it absolutely, positively has to be shared with someone elsewhere, there’s always the option of encrypting the file yourself before putting it on Dropbox.  While the tools still need to be made simpler and easier, it is possible to use tools like TrueCrypt (or it’s successor) to encrypt sensitive files separate from Dropbox’s encryption.  Would you still be as worried about a lost USB key if the data on it had been encrypted?


[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

One response so far

Oct 17 2013

What’s a micromort?

Published by under Family,Humor,Risk

One of the cool things we’ve found on TV since moving to the UK is QI XL.  It’s a BBC show hosted by Stephen Fry where they take a rather comedic romp through a bunch of facts that may or may not have anything to do with one another.  Last night’s show was about Killers and a term that was completely new to me came up, a unit of measure called the ‘micromort’.  It’s basically a measurement equal to a one in a million chance of dying because of a specific event.  Really, it’s a scientifically valid measurement of risk.  And yes, our family has a strange idea of ‘cool’.

Why is the micromort important and relative to security?  Because humans, and security professionals are included in that category, have a horrible sense of the the risks involved in any action.  For example, you are 11 times more likely to die from a 1 mile bike ride, .22 micromorts, than you are from a shark attack, .02 micromorts.  Yet the same people who fear sharks greatly but are willing to go on a bike ride on a daily basis.  And many of those people smoke, which is a single micromort for each 1.4 cigarettes smoked.  People suck at risk analysis.

So could we come up with a similar unit of measurement for the risk in a million of a single action leading to a breach?  Someone needs to find a better name for it, but for the sake of argument, let’s call it a microbreach.  Every day you go without patching a system inside your perimeter is worth a microbreach.  Deploying a SQL server directly into the DMZ is 1000 microbreaches.  And deploying any Windows system directly onto the Internet is 10 million microbreaches, because you know that it’ll be scanned and found by randomly scanning botnets within minutes, if not seconds.

The problem is that the actuarial tables that the micromort measurements are drawn from millions of daily events.  People die every day, it’s an inevitability and we have a very black and white way of measuring when a person is dead.  We can’t even really agree on what constitutes a breach in security at this point in time, we don’t have millions of events to draw our data from (I hope) and even if we do, we’re not reporting them in a way that could be used to create statistical data about the cause of these events.

Some day we might be able to define a microbreach and the cost of any action in scientific terms.  There are small sections of the security community that argue endlessly about the term ‘risk’ and I have to believe they’re inching slowly towards a more accurate way to measure said risks.  I don’t expect those arguments to be settled any time soon, and perhaps not even in my lifetime.  So instead I’ll leave you with an entertaining video on the micromort to watch.  Thanks to David Szpunar (@dszp on twitter) for pointing me to it.

[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

Dec 18 2011

Open tabs 12/18/11

Published by under Family,Government,Hacking,Malware

Long night last night.  We went to something called a pirate gift party; sort of like a white elephant gift (cheap, person A can take a gift from the table or steal from person B) except most of the gifts were wrapped in tinfoil cleverly disguised to hide their true nature.  Two minor variations from a normal white elephant gift is that there is no limit to the number of times gifts can be stolen per turn and no one gets to open the gifts until the last gift is chosen from the table.  This led to an interesting ‘defense’ strategy; since there was a gift that was wrapped to look like Thor’s Hammer that my Spawn wanted, they worked together to make sure they kept it at all cost.  Basically, when person A stole the hammer from whoever was holding it, that Spawn would steal his brother’s gift, and that Spawn would steal the hammer back.  This was a pretty good strategy, until Spawn1 lost concentration at one point and went after a different shiny object.  It all ended up good in the end, though another pair challenged the Spawn to a game of endurance to see who wanted the hammer the most.  It ended up being a 15 minute round robin of gifts being stolen and restolen that left everyone laughing.  Oh, and “Thor’s Hammer” ended up being a cleverly disguised box with chocolate and money in it, with a broom handle that was acting as the handle.

Oh, and very importantly, It’s that time of the year! Security Bloggers Meetup invites have gone out.

Open Tabs 12/18/11:

[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

Nov 22 2011

Open tabs 11/22/11

Published by under Family,Hacking,PCI,Risk

I got home Sunday from 3 days in Las Vegas, two of which were spent at the first ever Minecon.  For those of you who aren’t the parents of Minecraft addicts or addicts yourselves, it’s a game where you create a whole world then mine it for resources and build just about anything you can imagine.  It’s multiplayer, sometimes massively so, and it’s very easy to set up your own server and be hosting it for the world in a matter of hours.  Unluckily, it may be too easy; people who can barely figure out what their IP address is are setting up servers on their desktops then sharing their systems with friends via Hamachi or simply opening their home network to the world. It’s enough to give a security professional an aneurism!  I wrote up my own experience in creating a cloud server for Minecraft in April, but that server never caught on with the kids.  So now I’m trying a different solution, MineOS Crux, a custom build distribution of Ubuntu specifically created for people who want a secure, lightweight Minecraft installation.  I’m running it as a VM on my Mac Mini server and exposing it to the world on a non-standard port, plus I locked down the distro a little more than the standard build.  I’m still more than a little paranoid about it, so if the kids aren’t using it, it’ll go away.

Oh, and the kids got me to start playing Minecraft as well.  Good thing there are a lot of long holiday weekends coming up.

Open Tabs 11/22/11:

[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

Nov 11 2011

Open Tabs 11/11/11

Whether you call it Veteran’s Day, Pocky Day,Binary Day or something else, it’s Friday, I don’t know about you, but I’m looking forward to this weekend and spending some time with friends.  Being a parent, I don’t get out for adult time as much as I once did, which makes the rare occassions all that much more special.

If you know a veteran, today would be a good day to tell them thanks.  I ‘repaired’ radios long ago and far away on a little artillery base in Germany.  I put repair in quotes because our job was to say “Yep, it’s broken”, replace the radio and send the broken one off for repair by someone who actually did electronics troubleshooting.  I was lucky and my enlistment was during a relatively peaceful time, but we have hundreds of thousands vets out there who saw events and actions most of us can’t even imagine.  Please respect them for their sacrifices.

I haven’t done this in a few days, so there’s a lot of built up articles.

Open Tabs 11/11/11:

[Slashdot] [Digg] [Reddit] [] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

Next »