Welcome to my digital home! There are lots of articles you might find helpful buried in this site on topics such as modifying an Alfa Romeo 159, rebuilding a Lotus 7 (Robin Hood 2B), not to mention a ton of stuff on technology in general. It’s all here somewhere, so use the search function or navigate using the menu structure. if you want to talk, reach out via the contact function, I usually do answer!
Random Post Selection
InfoSecSunday Times – 17th January 2010 – Dark Pools / HackingRelated Images: [...]
GeneralI have been working with a large retailer of late who is a heavy user of Sun & Solaris. As you can imagine, this is perfectly normal, and in fact, considered best practice for what they are doing. That said though, in an area such as retail, with low margins and profits based on sheer quantity, surely a leap of faith into the “dark side” or as we prefer to call it, Linux, would be a better option?
Once upon a time the argument was simple, RISC architecture was simply ahead of the game, by a long way, but guess what, x86 grew up, caught up, and overtook. These days, the performance you get out of multi-core x86 is significantly more than it’s RISC based equivalent. I realise that point could be considered contentious by the purists out there, but for mainstream computing in a world that is ever more cost concious, I struggle see how any argument for RISC can win over x86.
Once you have your x86 base, you can go with an x86 version of Solaris (not that you would) or thanks to Sun not playing silly games, you can actually use something useful, such as Redhat, Suse, Ubuntu or if you so desire, Novell.This additional flexibility is core to getting the base of your platform right. Large scale architectures need solid foundations to remain stable, perform and scale as desired.
Lets consider it for a moment. Sparc vs x86 & Solaris vs Linux, well to be honest, there is barley anything in the comparison except cost. Sun make x86 hardware based on multi-core AMD processors which are blisteringly fast and being manufactured by Sun, they are rock solid.
Now. If I were that retailer, I know where I would be looking to spend my money, but thats not what I am there to talk to them about, so I’ll keep it for my blog and not overstep my scope.
Related Images: [...]
Alfa 159I already had the amplifier and sub from a prior install, and in that install I had discovered a problem with the pairing. The sub is an Infinity Kapa perfect 12 VQ rated at 400w RMS and the amplifier is an Alpine MRV-420 rated at 350W RMS. Driving the sub at high voltage, with line levels in excess of 4v and the gains maxed out means that the amp is producing closer to 450W RMS and the sub, which is well regarded as being able to handle much higher loads than 400W RMS, just laps it up, but had one small issue that needed sorting. It would overheat during extended sessions of Drum and Bass at full power! To sort this issue, I stripped the amp back to bare metal, rebuilt it using high grade CPU heat sink paste and added a temperature controlled cooling system utilising 6 x 40mm fans in a push/pull config. Needless to say, it can run at full power and then some, all day long now !
These images are of the strip & rebuild:
” order_by=”sortorder” order_direction=”ASC” returns=”included” maximum_entity_count=”500″]
Related Images: [...]
InfoSecSo here we are again, a few months on, and just when so many were licking their wounds after the last infection, along comes another. Guess what, if you had your eyes shut my sympathy is not going to be that forthcoming!
Malware has come along way since its anarchistic pre-pubescent beginnings, and is now a fully fledged teenager, displaying all the fire, passion and unpredictability you would expect from one. Once upon a time, you could be sure your malware was simple in its intention, written by an unorganised person or persons, with the typical agenda of notoriety or malicious damage. Although bad, quite easy to deal with.
Modern malware however is a whole new ball game. Written to order, with a menu of “features” available from stealing data to placing a sleeper inside the system, all with standard issue mass infection mechanisms anti malware detection programming, the latest in self defence techniques and with the underlying drive of a typically well organised or at least very motivated source.
Yet despite this significant step change in what we are seeing as the attack, as a world of experts I am still not seeing a change in the controls, strategies or defence tactics of many organisations. This I find astounding. How anyone who is considered a responsible person in an organisation can sleep at night thinking that a firewall and a few layers of Anti-Virus is going to cut it as the total form of protection is seriously miss-informed. Equally, those companies out there pedalling the silver bullets of the security world ” ultimate anti-malware solution (TM)” are doing nothing but compound a problem that will continue to evolve and get more sophisticated.
The simple fact is that ANY malware solution on the planet today from any vendor works on the same detection methods. They look for something they have seen before or something that looks like something they have seen before and block it, It’s that simple. And for that reason alone, you cannot rely on that control alone as the only form of defence. Equally, the firewall and all that other perimeter based paraphernalia you invested in, don’t get me wrong, all well and good, but its not going to stop this stuff. Why? Web 2.0, Social Networking, Unified Communications, Chat, Mail, you name it. Any medium of communication that can facilitate the transfer of a file, and that includes just good old browsing of the web, will bring malware to your door, invited in so to speak, through all that perimeter protection, and straight to the desktop.
The truth is, the only way to protect yourself against this stuff is to stop thinking it’s “the good old days” and get with the times. The only way you’re going to stand a chance of surviving one of these incidents is by thinking about the entire control landscape and how they interact with each other. A good model for this is Defence in Depth as that provides a very good method of visualising the controls at each layer of your environment and allows you to map attacks through the controls to see if they would be successful or not.
This simple visualisation strategy can bring value beyond your wildest dreams, giving you the opportunity to stop, think and adjust what you’re doing, justify investment, demonstrate control and rationalise spend. All very important concepts for the times. There is a world of products, vendors control choices and equipment with pretty flashing LED’s on it. The only way to figure out which ones will help you is to understand what you have, what you need and why.
Related Images: [...]
InfoSecI work in a world of standards, opinions, controls and countermeasures, all encompassed in a foreign language of “InfoSec” and “ItSec”. This of course, while entertaining, is of little use to the world. I would like to propose a simple concept, probably high level, and I am sure my peers would argue is “inadequate”, that said however, hear me out:
Ok, so the basic concept is simple, setup three primary work streams or “functions”, 1 is a Risk Asssesment and Classifcation Function, 2 is a People / Process/ Awareness, and 3 is Controls, both protective and detective as needed.
The idea is that the risk assessment process runs in a cycle with inputs and outputs at the core of the system which serves as the engine for security. Its easier to explain in a diagram, take a look:
Genious or Madness, its your decision, I like it because its simple and can be applied to any situation. Of course I agree with arguments such as “where is the governance?”, “what about strategy” etc, but quite simply, thats not what this is. This is a simple security process that allows you to feed information in and get solutions out.
Related Images: [...]
InfoSecI recently was asked by Bloomberg to comment on the raft of Android malware recently discovered. During that interview I mentioned some concepts around the open vs closed models and wanted to expand on this thinking a little further.
As you may know the Google Android platform has been open source since 2008, and as such has a healthy following of developers and an open list of problems that anyone can view and contribute fixes for. Contrary to this, Apple IOS has, and most likely always will be closed and the intellectual property of Apple, and therefore is managed by an army of developers working directly for Apple. Other than these two business models being the polar opposites of each other, the devices themselves do share some common ground, an example of which is they are both based on a *nix base and both allow anyone to develop an application for their platform.
So which is better, open or closed? Both have equal merits and demerits, but for me the key one we need to consider is the security of the applications. Given a smartphone platform is ultimately a portable computer in your hand that you can transition a significant amount of daily communications to, in any corporate environment you need to be thinking about how you maintain the security of that device. For the purposes of this article I am going to discount all the other major security problems with both platforms and specifically look at the apps. To this end I want to create the abstraction between the platforms and the application environments as people seem to confuse these two and blur the lines, and forget that we aren’t talking “open-source” as both platforms are in fact “open-shop”.
If your app store is 100% open, as we have seen with Android, anyone can release any app into it without any form of quality control or security audit. This, as we saw, resulted in a number of applications having more functions that the user subscribed to, and left the devices open to abuse from those individuals that would make money from negative actions. In a corporate environment this means that you have got to control what apps get put on the phone, and create a whitelist and policy enforcement system, which as we all know, we cause the end user to get upset as their freedom of choice is restricted. For the general consumer this means that they, at some stage, will likely end up getting literally robbed blind by their smartphone, because, in an open model, there is no one controlling what gets onto their device for them.
The other end of the spectrum is of course where we are with Apple. Onerous quality assurance, technical and security checks and numerous caveats to adhere to, before your app even gets into the store. But this conversely reduces the risk to business and the consumer equally. In this model, Apple takes control and responsibility for securing the applications on their platform, and minimising the risk to the user. I of course, still would recommend in any corporate environment the use of policy enforcement and approved applications, but you’re at least starting for a better place, and don’t need to do a full source code review of every app your planning to use just to make sure it’s not a Trojan of some kind!
So which model is right?
To be honest, both have their merits and both have their flaws, but I still, personally, favour Apples approach, to err on the side of caution and ensure that the apps they release are 100% up to the task. Let’s face it, developers are known for cutting corners where they can to save a few lines of code, so someone cracking the whip on quality and security can’t be all bad now, can it.
Related Images: [...]
GeneralWell, after the change of room size the RP6G2’s lack of low frequencies eventually pushed me to go the extra mile and get the KRK10s. Initial feedback on it? Its got so much bass! I know that’s the whole point of it, but wow, I like bass and even I struggle with this sometimes. So much so that I actually bought the Boss FS-5L latched foot switch so that I could bypass the sub from time to time and allow the full range of frequencies back to the RP6G2’s!!!!
So….. what does all this mean?
Well, first off the KRK10s is one hell of a good sub, well built, sounds great and can really pump out some power, so much so, it rattles all of the radiators in every room of the house when its wound up! that said, it more than matches the RP6G2’s and compliments them well. The unit itself acts as the hub of your system, so you route your main outs to the unit from your source, then plug each of the other 2 speakers into the sub. My preference for this was to use TRS Balanced Jacks from my mixer to the Sub, then XLRs from the Sub to each speaker. A good, cheap cable provider I use regularly is: Vision Sounds on eBay, they are quick to process, cheap to buy and decent quality, so that works for me!
The KRK10s comes with a built in Crossover, with a knob on the back to set the Crossover frequency. I have played with this for a while now, and for me, I find that the best option is to keep some of the bass going to the RP6G2’s and let the sub handle the low stuff. To that end, I tend to have my crossover point at around 50Hz, which lets the RP6G2’s handle the punch in a beat while the KRK10’s handles the roll. I find this approach keeps the imaging better in my opinion.
The built in amp comes with the same +-6db of gain through a control knob on the rear. Mine is set to -4db and that still, on some tracks and sources, overpowers the RP6G2’s at 0db gain! For this reason, I find that it is very useful to have an EQ of sorts in the mix so you can compensate for different sources. I make use of an Alesis MultiMix8:Firewire to bring each of my audio sources together, which gives me a low/med/high EQ on each channel (except the Firewire output, but that’ a whole different article!).
The final, but very useful feature that comes with this unit is a bypass ability. You can plug in any latch-able foot pedal, but the Rokit site recommends the Boss FS-5L. I have the FS-5L and agree with them, its well built, but not so hard a switch that you can’t use it by hand if you want it on your desk. The reason for the bypass is actually quite a good one. Sometimes, you need to remove the bass effect of the sub and revert back to just the bass of the RP6G2’s. To do this without a bypass and making use of an EQ, you would taint the bass feed to the RP6G2’s and actually not give an accurate image, however, the bypass, when engaged, simply kills the Sub, bypasses the EQ and outputs a full range signal to the RP6G2’s leaving you with a nifty way of getting an accurate frequency reproduction for those absolute moments of audio clarity!
If your seriously thinking of adding a KRK10s to your setup, here are some tit bits of advice for you:
Buy the Boss FS-5L Latched Foot switch at the same time to give you the ability to bypass the sub easily when needed
If possible put at least a basic 3 band EQ between your source and the entire setup, as the ability to gently retard the bass is very handy
Make sure you have no neighbours attached, above, below or to the side of you, or you will quickly make some new enemies!
All in all, I am genuinely blown away with my overall investment into the Rokit camp, and will happily pick up an ERGO when funds can justify the £500 price-tag!
KRK10s Specs:
225 Watt (peak) Powered Sub woofer for Studio Use
SPL: 110dB Music and 113dB Peak
10” High-Excursion Glass Aramid Composite Woofer
Frequency Response: 34Hz – 50Hz to 130Hz Variable (+/- 1.5 db)
Variable and Sweepable Low Pass Filter
80Hz High Pass Filter
Radically Curved Front Baffle Design for Amazing Performance
Front-firing port provides low frequency extension without boundary coupling
Bypass Control using Standard Foot switch
Related Images: [...]
General…what is it about working from home that makes life so much easier? I treasure my days in the “home office” as they give me opportunity to catch up on all that has evaded me for so long! I find at least 1 day a week keeps me ahead of the game and on top of the workload.
Related Images: [...]
InfoSecThe concept is simple, the more obstacles in the way the better. Let me abstract the concept for you…..
…..you put your file in a safe, I crack into the safe.
………you put your file in a safe, and lock the safe in a strong/secure room, I crack the room then the safe.
………..You put the file in the safe, in the room, at the bottom of the ocean, I go elsehere to get a different file!
People often talk to me about controls, and want to know which one is best. The answer typically is either all, none, or both. The more layers you have, the more security you have. But lest we foget the basics, understand the cost of the control vs the cost of the asset through a formal Risk Assessment Process.
Related Images: [...]
InfoSecSo much has been said, good and bad, about GCHQ’s recent release of a cipher to the community. Simply a publicity stunt or well designed honey-pot? No one will ever really know, but what you don’t know is that this was an example of seeing a good idea and then totally cocking it up.
Let me start by saying these are my own words and thoughts and in no way reflect the opinion of my employer, or those organisations I am associated with.
A year or so ago, I got involved with the UK Cyber Security Challenge, which, as far as I am concerned is a good organisation, doing the right thing for the industry and those that want to be a part of it. I put a lot of my own personal time and resources into it for free, and make my employer give even more time, resources and money to the cause as well. Since I got involved with the UKCSC I have been providing them with simple on-line code breaking challenges, though my own devious thought processes and those of the many experts far better than me, that I have the pleasure of employing. We do these little challenges, typically on a quarterly basis, as well as to “support suitable and worthwhile endeavours”. One such endeavour happened recently, specifically, the London Conference on Cyberspace, hosted by the FCO. As was the usual manner for these things, I got a phone call from one of the UKCSC directors on a Friday evening asking if we could pull together a cipher for the event the following week, of course, I said we would be able to and engaged the collective grey matter of a couple of my team. The caveat to this request was that the cipher needed to somehow include GCHQ, the FCO, the UKCSC and of course my own companies brand. As such, I devised a simple 2 stage approach that would allow me to sufficiently bring together the brands and get the exposure each organisation wanted.
The cipher itself was a union jack (in keeping with the event) hosted on the FCO conference site, with a series of logos on the flag itself. It was uploaded as a PNG file and had a binary string in the middle of the flag. The binary string easily translated to a goog.le shortlink that took you to a holding page on one of my sites that had each of the organisations logo’s and a message saying thanks for playing. What was less obvious and in fact the real challenge, was that the flag actually had two binary strings embedded onto each other in such a way that if you played with the colours you would see a series of 0’s that were in fact 1’s and vice versa 🙂 This decoded to a different goog.le link that took you to a random page on a paste bin style site, where there was an ascii art pumpkin with some cipher text in it. The cipher text required a key to decrypt, and the key was hidden as a html comment in the other page that you went to if you only found the first shortlink, so to complete the entire task you had to visit both short links, and pull it all together.
It was a simple little cipher that around 100 or so people played and 3 people got right. I put the low turn out down to the last minute nature of the engagement and lack of major press coverage, but, it was still a lot of fun to pull together, and if you cant have fun in your work, what’s the point?
So, what does all this have to do with the GCHQ Cipher I hear you ask? Simple…
When my team and I developed this cipher for the event I was liaising with the guys at GCHQ careers to ensure they were happy with what we had done and that we had hit the relevant targets for them. In short, they “absolutely loved the cipher” and “thought it was a brilliant idea”.
…a few weeks later, they had their own.
Now, don’t get me wrong, I am aware I don’t own the rights to developing cipher/code breaking challenges to identify talent in the community, but I have been doing it long enough to know that you have to get the “pitching” absolutely perfect to the targets. By this I mean, there is no point in creating a cipher/challenge that would tax the most senior pen tester in the market when your using it to find talent to fill a job that pays £20K or so, in fact, this is the reason the ciphers we develop for the UKCSC are not that difficult. What these challenges do/should do is require the player to demonstrate some core requirements such as R&D/basic scripting/coding potentially, ability to think creatively etc, and then entice them in through layers of difficulty to a point where they are genuinely interested and engaged. This approach lets us target the college/university/entry to employment band of the industry and find the real talent in it to bring on board and then develop.
So, in summary, GCHQ, nice try but don’t give up your day jobs, and next time you want some help finding talent to help protect the nation, just ask, we are always happy to help.
Related Images: [...]