A song about vulnerability management

My contribution to the debate surrounding the CISO of Equifax having only a music comp degree: a song about vulnerability management! I don’t know what kind of statement it makes, just thought it was an amusing bit of timing when I finished the song at the same time the breach hits the news.

I make music for fun, and write about what I know (or at least deal with for the majority of my waking hours.)

The Visitor

The weight of Nick’s body was evaporating, while his feet stayed firmly planted on the leaf-strewn earth. It was really an uncomfortable feeling, like an itch from the inside that spread everywhere.

“It is your essence leaving your corpus,” the visitor explained, again. It seemed bored or irritated.

“I’m feeling lightheaded.”

“It is normal.” It casually reached up and plucked the only brown leaf from an otherwise healthy tree. It examined it closely, turning the leaf back and forth by rolling the stem between its ashen thumb and forefinger. Nick watched, fascinated, as the visitor’s appearance was becoming increasingly human in complexion and substance, while he felt more and more like a store mannequin.

“I’ve never been immortal before,” Nick mused aloud, looking down at his own hands to see color fade from them. “Good to be on the right side of history, eh? The winning team. When your_” It was becoming difficult for him to string words together to form sentences. “When your…species…take over Earth, what happens then? If they’re…killed, what happens…bodies?”

The visitor dropped the dead leaf and turned back to Nick, regarding him with large black eyes that slowly contracted. White formed around their circumference and expanded inward. Brown color poured into irises like coffee. It leaned in and held Nick’s face with cold hands.
“Just let go, Nick,” it said as lips blossomed around a widening mouth and teeth erupted from bloody gums. “I’ll take good care of your vessel.” Nick shuddered.

“M-nik-bok!” A voice shouted. It was loud and ubiquitous but had no echo. The visitor quickly let go of his face and spun around. Out from a cluster of trees another visitor appeared and marched towards them.
The first groaned something unintelligible and stood at attention. The second approached and stopped, standing across from the first. They stared at each other silently and without moving. Nick noticed the feeling of emptiness was fading and he felt like he was returning to normal. Actually, better than normal. The sensation made him grin as he saw the color return to his hands. Then he looked at the bare back of the visitor to see its width atrophy and pallor fade to the grayish color of when Nick and it first met.

“Hello?” Nick finally called, confidence returning with his sense of presence. “Can you stop the mind chat?” They both turned to face him. He was taken aback by how quickly Visitor 1’s appearance returned to its default. They both looked identical now: skinny, pale gray aliens with big heads and black ovoid eyes.

“My leader says it is not time,” Visitor 1 explained, tiny mouth unmoving.

“You are not ready.”

“But I am ready,” Nick argued a little too forcefully. But he wanted to make his point. There was nothing for him here. Life had turned into a lonely monochrome void: a failed marriage, no friends, no interests, and a dead end job that just serviced an insurmountable pile of debt. Just when he was at his lowest, the visitor showed up in his kitchen and offered him immortality, instructing him to go to the woods for Transference. He couldn’t go back now. On the verge of divorce, there was no one left for him to go back to.

“We had a deal! I transfer my body to you, then you and your friends take over Earth. I…my body…lives on forever as one of you. It’s the ultimate middle finger to everyone. Especially Lucy. Meanwhile, you get to walk around and go anywhere you want because you look just like me…” Wait, that didn’t make sense. The logic of what the visitor had said and promised was unraveling. If the visitors were taking over Earth, and eliminating everyone on it, why did any of them have to look like Earthlings? Why didn’t they just get rid of everyone and be done with it?
Visitor 2 stepped forward. “There is a misunderstanding,” it explained.

“M-nik-bok just likes to visit your planet on holiday. M-nik-bok enjoys your Earthly distractions. Your Reuben sandwiches and superhero movies. A disguise is necessary to visit without drawing attention.”

“A disguise?” Tears of betrayal stung Nick’s eyes. “That’s all I’d be? Just so you could be a tourist on Earth? A…a shell?”

Visitor 1 took a step forward. “Yes. Your corpus would be used and you would cease to exist,” the visitor answered. “Since this appears to cause you anxiety, perhaps being just a shell does not agree with you.”

Nick stared at his reflection in its black mirror eyes. Visitor 2 made a slight bow, which Visitor 1 mimicked, and the two turned and walked away. They disappeared into the shadow of a tree canopy. Nick stared ahead numbly. After a moment he saw Visitor 1 (or was it 2?) reappear from the shadows. The visitor had returned! Nick spread his arms wide, ready to be transferred. Then he noticed that the visitor had something silver in its raised hand. And it seemed to be aimed at him.

Nick was whacked in the head by what felt like a two by four. He fell flat on his back, and struggled to get air into his lungs. When his breathing returned he sat up, confused and rubbing his forehead. “What the hell am I doing here?” he said aloud to no one. He had no idea why he was in the woods or how he had gotten there.

His cell phone rang. It was Lucy. For some reason he didn’t feel the urge to sigh or ignore the call. He missed her. He took a moment to take in his surroundings, appreciating how vibrant the verdant trees and azure sky appeared. Even the birds were singing.

He thumbed the bright green answer icon. “Hey, babe,” he said. “Up for a movie tonight? Yeah, I’m fine. Actually I’m better than fine. I feel…renewed. It’s hard to explain. But I miss you. So what do you say? Get some dinner first? I could go for a Reuben, whatever that is.”

The End

Phishing Protection Best Practices

Today Bank Info Security reports that a Ukraine bank warns of a new massive malware campaign about to be launched. Here’s the line that’s most frustrating: “It added that the attacks have been spreading via malicious Microsoft Word documents attached to emails.” So here are some best practices to follow to harden your org against phishing attacks:

  • Use GPO to disable macro execution in office documents
  • Don’t let employees log in as admin
  • Block unnecessary file extensions at email gateway (e.g. do people really send legit .dotm files)?
  • Use an email protection solution that analyzes and blocks malicious attachments before they are delivered to inboxes
  • Preface subject line of externally-sourced email with tag like [EXT]
  • Keep current with patching and updates
  • Train employees to “think before you click” (though don’t count on it as an effective preventative control)

Most of this advice is common sense. But if I’m just preaching to the choir, why are phishing-based attacks against orgs still so damned successful?

References

Ukraine Central Bank Detects Massive Attack Preparation: https://www.bankinfosecurity.com/ukraine-central-bank-detects-massive-attack-preparation-a-10209

List of Microsoft Office file extensions (block most of these): https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions

Bricks

Most people don’t own communication devices. They borrow them. And when people talk about a brick, they’re usually referring to a Community Communication Device (CCD). A brick is about the size of a bar of soap. It fits into the palm of the hand, with a rounded beige frame encasing a slab of clear acrylic. The shell is made up of a carbon-threaded polymer, making it nearly indestructible. When in contact with someone the rectangular screen instantly lights up with content specific to that individual. It can then be used to exchange text messages, read the news, or consume other digital content. The device cannot make voice calls, however, due to the increasingly unpopular Landline Only Telecommunications Act.

When no longer needed, the brick can simply be tossed onto a nearby table, counter, etc. The display instantly clears and its memory is automatically wiped. Bricks litter bars, cafes, fast food restaurants and other establishments. Inductive charging pads are embedded into the tables and counters at many of these places to help ensure that they are always ready for use. The proliferation of bricks is also responsible for a surge in hand sanitizer use.

The device and the service that gives it life are provided free of charge by a single company: Avocadeaux (“avocado”) Inc. The free bricks are part of their community outreach program to promote free learning and information sharing. Emphasis is on underserved and lower-income neighborhoods. A study was done recently that showed an inverse correlation between the average income of a business’s clientele and the number of bricks that could be found there.

When the program first started, the bricks were stolen and resold, but the company kept dropping off more until they no longer had resale value. Now you can find one just about anywhere.

Avocadeaux has always maintained that the content they serve is 100% user-driven, and usage history is completely confidential. Their mission statement reads “We don’t want to influence the information being delivered. We just want to provide access to it.” The company makes its money by selling the more upscale Personal Communication Devices (PCD’s) to consumers with disposable income.

***

In the alley behind Gary’s Pub (about fifteen minutes west of the Chicago loop) Detective Emily Jensen kneels next to the motionless body of a man in his early 20’s. He is propped up in a corner formed by a dumpster against a brick wall. His wrists and ankles are bound by duct tape. His lower face is also covered with tape, a charred hole where his mouth used to be. She peers into the burnt orifice with a penlight to confirm her suspicion: death by OC. A brick was shoved into the victim’s mouth, and taped over so that it couldn’t be removed. Then a hacked induction transmitter was used to overcharge the device’s high-density battery until it exploded, shooting fragments into the brain cavity.

There are shards of plastic in the smoldering cavern, looking like bundles of toothpicks. It reeks of burnt plastic and flesh. “Fire in the hole,” she overhears an officer say. Emily frowns but says nothing as she stands to assess the victim a final time. Then she nods to the coroner who has been waiting for approval to bag the deceased.

The detective goes to the sidewalk at the opening of the alley, carefully stepping over yellow evidence markers along the way. She closes her eyes and tilts her head back to feel the afternoon sun on her face. This is the second homicide she caught in as many weeks with this M.O. The murder rate in this area has been increasing exponentially over the past few months. True, it always got worse in the summer, but this year has already outpaced the last one by a long shot.

She opens her eyes and looks around the neighborhood. It used to be a safe place. Lower rent, sure, but always a strong sense of family and community. It’s like there’s something dragging neighborhoods like this down, she mulls. Something multi-tentacled and powerful reaching up from the inky depths.

Emily enters Gary’s Pub and scans the poorly lit room. There are a few people hunched over the bar who could be regulars, and a man with a trim gray beard behind the counter. He is staring down at a brick in his hand. She approaches him.

“Are you the owner?”

He looks up and answers, “I am.” He deftly slides the brick down the bar where it comes to a rest atop an induction charging pad.

“Do you know who did this?” she asks.

“I already told you cops I didn’t see nothin’, don’t know nothin’, and don’t want no part of it. This is a respectable establishment, okay? That alley is public property, got no control over that.”

Defensiveness is another thing that has increased over the past few months. Fewer witnesses willing to speak up, and less cooperation with police.

“The victim looks like he’s not even 20,” she says. “Don’t know who his parents are by chance?” She asks this to try to evoke some sympathy and willingness to help. He closes his lips tight, looking like he’s working hard not to be swayed by emotion. She waits a few moments for a reply but gets none.

“Okay, well, if you think of anything…” She places her card on the bar. He ignores it and picks up a different brick which flashes to life, resuming the video he was watching a few minutes ago. She looks at the small screen. On it is Ed Buryanski, a challenger in the upcoming Chicago mayoral election. He is at a rally, talking tough about crime and cleaning up the city.

***

Emily sits on a worn couch in her Rogers Park apartment, drinking a Goose Island pilsner. She is dressed in sweatpants and an Army T-shirt that still faintly reeks of sweaty workouts from her time in the service. She is using her laptop to view the Avocadeaux, Inc. web site, looking at CCD usage statistics. The company makes this information publicly available as a free service.

Emily zooms into a map of Chicago, and clicks the “sentiment” box. Semi-transparent blobs of different colors overlay the map. The colors represent different emotions: blue is sad, orange is happy, yellow is afraid, and red is angry. She clicks and drags left, away from Lake Michigan, and red shows as the predominant color over Garfield Park, the 29th precinct where she was earlier today. She clicks the “trend view” box and the map morphs into a line chart. The same colors are used, now shown as curves over a timeline. The red line of anger arcs upward at a severe angle.

She switches tabs in her browser to bring up the Chicago Police Department site. She navigates to the crime stats page which also has a map of Chicago. She checks boxes labeled “homicide” and “past 30 days”, and red dots appear on the map. The densest cluster appears over the same neighborhood.

“Thought so,” she says to herself. She sees a correlation between negative CCD user sentiment and the murder rate.

Her PCD vibrates on the table. She leans over to see the display. “Code 4. West Van Buren and South Sacramento.”

“Great,” she says. “Back to the 29th.”

***

It is almost midnight on a Tuesday when Emily arrives at the gas station. There is a crowd of about 15 people gathered on the other side of the yellow police tape that surrounds the crime scene. Many of them shout and jeer, and hold up CCD’s with the same headline on the display: “Civil Rights No Longer Guaranteed.”

The victim lies on the stained concrete next to a gas pump. A plastic sheet has been draped over the body. Dark crimson pools out from beneath the sheet and reflects purple in the fluorescent lights above.

“What happened here?” Emily asks a sergeant standing near the body. He reads from his notebook.

“Looks like an argument, which he lost. Vic still has his wallet. Took two to the chest. Found brass for a 45. No witnesses so far, of course. The gentleman working behind the counter says the cameras work but don’t record worth a damn.”

She kneels down and pulls back a corner of the sheet to reveal the face of a male in his late 30’s to mid-40’s. His eyes are closed, and looks like he is in a peaceful sleep. She replaces the sheet, stands, then looks out at the agitated crowd. She goes up to the tape, standing across from an older woman who is waving a CCD and shouting, “You can’t make this a police state! That goes against everything this country stands for!”

“Can I see your brick?” Emily asks. The woman stops, looking a little perplexed, then quickly holds the CCD close to the detective’s face. Startled, she leans back a little and examines the display. She then looks at the other bricks being held in the air. They all have the same message on their screens.

“May I remind you that we’re the taxpayer,” the woman continues. “And that you work for us?”

Emily does not respond. Instead she holds out her hand, palm up. The woman hesitates, then hands over her brick. During the handoff, the screen goes dark. Once in her hand it lights up again. But the display is the same as before. That doesn’t make sense, Emily observes silently. I should be seeing my own content.

She hands it back and nods thanks. She studies the other people who have gathered, looking for anyone who stands out. In the back is a man in his mid-to-late 30s. He has shaggy, curly brown hair, his face is unshaven and gaunt, and has a slightly cleft upper lip. He just stands there with a blank expression, not caught up in the fervor of the crowd. He also has a canvas backpack with him. He sees her staring and quickly turns to leave. She goes up to two uniforms nearby and points. They give chase and Emily quickly follows. She unholsters her 9mm and holds it at her side as she runs. She is thankful she wore her gym shoes.

The suspect runs down an alley and jumps a chain link fence into a backyard. The cop in the lead busts through the gate, his partner following. Emily instead runs down the sidewalk to the next block and turns down the street to see the man dart out of the yard, cross the street, and disappear into the shadows of another yard. The streetlamp is out, feeding the darkness.

The uniforms and Emily stop in the front yard, panting as they search the darkness with flashlights. They listen for any clues of where he has disappeared to. Suddenly the homeowner throws open the front door, a shotgun in his hands. The cops raise their handguns in response.

“Lower your weapon!” one shouts.

“Don’t you do it!” yells the other.

Emily holsters her weapon and raises her hands. “Easy, easy! We’re just looking for someone. Please lower your weapon.”

The man is older and appears confused, eyes wide, mouth agape. He points the gun at her, lowers it, then raises it at the cops. Two deafening thunderclaps rend the night. The homeowner is thrown back against the railing that surrounds his porch and it breaks. He falls into the perfectly square bushes below. The shotgun crushes a garden gnome as it thuds heavily on the ground.

***

Emily is in a bar working on her third Maker’s Mark, neat. She is in The Loop, which might as well be a world away from the neighborhood she keeps answers calls for. She is drained from the two homicides yesterday, the accidental shooting, and the debrief and paperwork that followed. As she mentally unwinds everything, a dark thought keeps creeping back: It’s almost like the neighborhood itself is cursed.

A beige brick is on the bar next to her. She took it from Gary’s Pub a couple days ago. There are no other CCD’s here, of course. The place is too nice. Her gaze keeps returning to the brick and its scuffed acrylic screen, as if staring at it long enough will divine its secrets. Someone’s building something, she considers. And they’re using CCD’s to build it.

She overhears a conversation between two guys sitting a stool away. At some point one of them will try to engage her in conversation. She will be leaving soon, so will hopefully avoid the awkwardness of letting him down. She does not have the energy to be nice about it.

“They’re going to let you make phone calls on them,” one says. “One day, you’ll see. It’s just a matter of time.”

“Telecom’s too strong,” says the other. “They have lobbyists working full time to prevent that from ever happening. We’ll be using copper lines forever!”

In the reflection of the mirror wall behind the bar, she sees the one closest to her hold up his own black and shiny PCD as an example. Its screen lights up.

“So, we’re just going to keep using bricks that we can’t make phone calls on?” His friend lifts his own from the bar and holds it up. It has a brushed metal frame and also glows to life.

“Until the friggin telecom companies let the government change the landline act, yeah,” he answers.

“You mean the other way around. The voters will be heard!”

“Our new mayor will be heard!” They laugh.

She drains the glass and places it back on the napkin on the bar.

“Is that yours?” The question is distant, and it takes a moment for Emily to realize it is directed at her. She turns right and follows his nod to the brick next to her.

“Yes.”

“I’m surprised. I mean, a community POS? You’re much too fine for that.” He smirks.

She looks at the PCD he holds, then at the PCD held by his friend. The content on each is very different. One shows lacrosse scores and the other displays a stock ticker. She looks down and picks up the CCD. It glows to life and the screen shows information about Chicago homicides. The guy sitting closest to her notes this.

“That’s pretty grim,” he says.

“It is,” she agrees. “But that’s my job.”

This catches him by surprise. He sits back a little, eyes going a little wider momentarily. His movements are exaggerated and sloppy from the alcohol swimming in his veins.

“Well, I guess I’d be drinking too, then.” He raises his glass. “Here’s to our new mayor. May he bring a bunch of his military friends to help you out.”

“And get you some good news to look at for once,” adds the other.

***

Emily edges her way past a crowd of uniforms that line a dark apartment building hallway. It smells of piss and decay. She stops in an apartment doorway that opens up to the kitchen. The front door has been kicked in. There is a yellow Formica table in the center. The deceased is seated behind the table in a chair that is tilted back on two legs, leaning against the sink counter. His arms are down at his sides, his head back, mouth open and eyes closed. She recognizes the cleft lip. She also observes that a chunk of flesh is missing from the left side of his neck. On his shirt, dark blood has blossomed around his throat, from the center of his chest, and from his stomach. A CCD is jutting out from each of the two torso wounds. A third brick is embedded in a toaster on the counter behind the victim’s head. The kitchen wall is splashed with blood and debris like a frozen fireworks display.

She recalls a recent demonstration provided by the local FBI at an outdoor gun range. On exhibit was a weapon called a bricker that was recovered from a drug bust. A bricker is a bastardized version of a pitching machine that runs on a car battery, with a gear train that massively increases the motor’s output. The result is a portable cannon that can launch CCD’s at close to 800 miles per hour. Bricks make great high velocity ammo because of their ubiquity and near-indestructible nature. It was invented as a novelty hack, but ever since the plans went public, a bricker has been the murder weapon in at least half a dozen homicides so far this year. She remembers the sounds of the bricks shooting out with a clap (the sound of the projectile breaking the sound barrier) and obliterating a slab of ballistics gel from 50 yards away. The victim probably died of fright when he saw the weapon pointed at him from the doorway.

“And you think you’re having a bad day,” jokes a uniform standing nearby. Emily resists the urge to slap the grin off his face. She stretches latex gloves over her hands as she approaches the victim. She notes that the CCD’s impaling the body are active. An article with the headline “Violence Erupts in West Chicago Neighborhood” lights up their display.

On the floor against the oven is the canvas bag she saw the man with earlier. She goes to it, carefully expands the loosely cinched opening, and peers inside with a penlight. There is a box with blinking purple lights, connected to a battery pack. From the box extends two thick sticks that look like antennae. It reminds her of a wireless router, but military grade. She reaches in and yanks the power cord out from the back of the device. She knows this is reckless and done partially out of anger. The lights on the box go dark. She takes a deep breath and exhales slowly to regain self-control.

“Okay, we’re going to need to get all of this to the tech team,” she announces to the room. “Bag everything.” She looks at the body again and notices that the content on the CCD’s has changed. The devices now display anime.

***

They are sitting in a caged lab located in the basement of the 18th precinct station house. The wireless router sits on a nearby table, it’s antenna sticks removed. “It’s a MITM…a man-in-the-middle device,” the forensic tech explains. He is a man in his early 20’s with jittery black eyes. “It injects content into the communication stream of any brick that’s in range.”

“I thought bricks were locked down,” Emily says. “That only Avocadeaux could serve them content.”

“Well,” he answers. “It looks like he figured out a way around it. Or got some help. I’m still working it out. It might be in the firmware which can be a little harder to reverse engineer.”

Emily considers this for a moment, then asks, “Do you know what content was being pushed?”

“I was able to look at the source code for a daemon that runs on the router. The program reads a text file that’s located in the same directory. It has a bunch of news articles that it cycles through. The comments in the code aren’t as well written as the articles, so maybe he got them from somewhere else. I’d ask him where he got them from, but…” the tech trails off. Though the tech wasn’t told the details about where the gear came from, he has a suspicion that the owner is dead.

“Can I see some of the headlines?”

The tech brings them up on a flat panel. Emily leans closer to him to read. She can hear his respiration rate quicken.

“Violence Erupts in West Chicago Neighborhood, Civil Rights No Longer Guaranteed, Wage Gap Continues to Increase, Anger Sometimes is the Best Medicine, OC How-To Manual Now Available Online.”

Emily sits back, crossing her arms. “Do you think he acted alone?” she asks.

“I don’t know,” the tech replies. “I guess it’s possible. Someone probably got him the router, though. It’s serious, not something you can just get on eBay. I did find something kind of interesting though…” He picks up the router, turns it over and holds it under an examination light. He points to two words scratched into the case: The Truthmaker.

“Looks like he took his work personally,” Emily comments. “Maybe he was acting alone after all.”

Emily thinks for a moment, then asks “Have you explained to anyone else how this works?” The tech looks slightly confused and appears to choose his next words carefully. “I haven’t logged anything yet,” he said. Emily nods slightly. She stands, takes the transmitter and antennae and stuffs them into the backpack and cinches the top. “Let’s just shelve this for now then,” she says.

***

Emily is in the precinct captain’s office. The door is closed. The captain sits across from her, behind his imposing mahogany desk. His fingers are interlocked precisely and placed atop the mirror-polished surface.

“The device is made by Sigma Tech,” she reports. “It’s a military contracting company that Ed Buryanski worked for.”

“The leading mayoral candidate,” he confirms. She nods, fighting a tinge of nervousness.

“Do you know how the perp got the gear?” he asks.

“Not at this time.”

“Do you know where he got the news articles from?”

“We’re still working on that. We’re thinking it came from anonymous sources. He might have just known where to look.”

“Did you get his browsing history?”

“Didn’t find any computers at his residence and his service provider was Avocadeaux so…”

“…so it’s confidential,” he finishes. “Got it.”

She sees him glance at someone behind her, beyond the glass window that looks out onto the desk floor. She does not turn to see who he is looking at, but she has a strong suspicion it is the unfamiliar suit she passed on her way here.

He exhales deeply. “I’ll advise you not to make any allegations you can’t retract, Detective Jensen.”

“I’m just trying to get the bottom of this, sir.” This is followed by an uncomfortable silence while she considers her next move. She decides to roll the dice. “It seems pretty coincidental that someone is trying to stir up a hornet’s nest,” she says. “In a part of town that a mayoral candidate says he’s going to clean up by bringing in military hardware that his own company sells.”

The captain’s eyebrows furrow almost imperceptibly. While this is the only outward indicator of his emotional state, she knows that he is furious. He unlocks his hands and places them on the armrests of his worn leather chair. He grips the rounded edges tightly, but otherwise remains composed.

“I think that what we have here is a political activist who acted alone, and was met by an untimely demise. Probably at the hands of one of several enemies he made along the way.”

This is his way of bringing the matter to a swift conclusion. She stares back blankly while performing a series of a risk calculations: How far do I want to push this? Do I really want to take on the Chicago political machine? What is there to gain? To lose? Am I really ready to lose my job? My career?

She decides not to say anything and instead exhales quietly. The captain nods, probably to the same person standing outside the office. Then, with two fingers, he slides a folder from the side to the center of his desk and opens it. It’s her personnel file.

“You’ve been doing great work, Detective Jensen. You have no problem getting your hands dirty, that’s clear. How would you feel about getting reassigned perhaps? To something with more visibility and upward mobility?” He smiles and she fights the urge to recoil. “Someplace where you can actually make a difference.”

***

Emily keeps a low profile as she leaves the captain’s office and crosses the desk floor. Covertly she glances at the screens of the PCD’s held by the other detectives and officers she passes. The building turns silent for a long moment, then phones start to ring. As she approaches the stairs, she pauses to take out her own PCD from a side pocket. It displays the same thing as all the others: “Buryanski behind recent murders and attempted cop killings.”

She goes downstairs to the basement and down the poorly lit hallway that ends at the forensics cage. She opens the gate with a key and goes inside. From a shelf of various evidentiary items, she takes the backpack recovered from the dead man’s apartment and places it on a workbench. She opens the cinched top and sees the man-in-the-middle transmitter inside with its two long antennae and blinking purple lights.

She reaches in and yanks out its power cord. She then takes a silver plastic box from a nearby workbench that has a cable dangling from it. She reaches into the backpack and plugs the device into the transmitter. There is a faint sound of something frying and a smell of burning ozone. The transmitter’s purple lights glow so brightly they turn pink, then are suddenly dark.

Emily pulls the cable out, leaves it and the device in the backpack with the transmitter, and cinches the top closed. She slings the backpack over her shoulder, locks the gate, and leaves the chaos of the precinct building behind her.

Security Flashcards

I created version 2 of the Alexa skill Security Flashcards. This version uses a JSON file for content (versus having it inline in the code) and has 100 security terms (so far). To use:

  1. Enable the Security Flashcards skill on your Echo device
  2. Visit https://github.com/donfranke/Security-Flashcards for a list of terms that are available.
  3. Launch Security Flashcards
  4. Pick a term, think about what you think the definition is, then ask Alexa to define the term

The goal is to provide a tool to help prepare for security certification exams, as well as understand some concepts that are part of the foundation of information security.

Please let me know if you disagree with any definitions, or have other suggestions for improvement. If you are interested in creating your own Alexa skill, there are plenty of resources available including starter code on Github to get you started.  Enjoy!

Security Flashcards
Security Flashcards Alexa skill, companion to the book Cyber Security Basics

Android Apps

The two Android apps I created back in 2010 still are alive and kicking. ABI Calculator currently has 563 active installs, and Russian Flashcards has 1,225 active installs.

screen-shot-2016-09-24-at-10-28-28-am ABI Calculator

Really horrible app icons that show up in the Google Play store

I know these are insignificant numbers by most accounts, but for me it’s nice to see something I created being used by other people. And they’ve always been free (which I second guess sometimes.) I would have to completely rewrite the apps to get them updated. Maybe I’ll take some time off to do this.

Machines Training Humans

I was paying for my parking at a ticket machine the other day.  As I patiently followed the sequence instructed by the machine, I thought about how machines and software are increasingly training humans.  And we’re just letting it happen.  That same weekend I observed several headlines about Samsung Smart TV exceptional eavesdropping capability.  From Samsung:  “Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party.”  This isn’t new news, but it got me thinking.  It is another example of how we have to change our behavior to work around devices and software.  Again.

We can’t live without our multi-sensor devices we still call “phones.”  We trust software is doing its job and enabling these cameras and microphones only at our request.  We also trust that there are no back doors or malware on the device that enable these eavesdropping features without our knowledge.  But it comes down to well-behaved software to not facilitate eavesdropping.  The hardware is always ready.

I propose getting back to basics.  There should be physically controls in place to disable these cameras and microphones.  Similar to the plastic tab you pull out of a newly-purchased device to enable battery contact, or the plastic key you can yank out of a treadmill if the speed of its ad infinitum path gets too much for you.  With this would be the manufacturer’s certification that these keys, tabs, lens covers…whatever form they take…absolutely block or allow these sensors from being accessible by any software running on the device.  

Software has gotten to be too complicated.  It’s time to reintroduce physical controls.  For now there is electrical tape.

Unpatchable is Unusable

I read an interesting article pn Computerworld.com titled “Worm may create an Internet of Harmful Things.”  It discusses how, as our world becomes filled with Internet-connected devices, concerns over security grow.  There is one quote from the article that stands out for me:  “Security expert Bruce Schneier…is concerned about the broader risks to the Internet of Things. In many cases, IoT connected systems are using firmware that can be hard to patch. In fact, ‘in many cases, [it’s] unpatchable,’ he said.”   Unpatchable.  

When it comes to software security, if it cannot be updated, it should not be used.

This reminds me of an interesting (perhaps unrealistic) software development methodology called “cleanroom engineering”.  With this approach the focus is on preventing bugs or vulnerabilities from ever making it into production code.  The SDLC is heavily weighted on all phases before actual coding begins, because (per this methodology) all you have to do is code to the design, since it should be defect free.

This approach to software development seems like an analogy for vendors who release products that cannot be updated.  There three reasonings that I can see for this.  The vendor

  • assumes its product is truly 100% secure, and no vulnerabilities will ever be discovered
  • hopes that significant security issues with its product will not be discovered within a reasonable (or obligatory) timeframe
  • does not offer patchable products, but offers to sell replacement products that address the security vulnerabilities found in “last year’s model.”

Replacing products used in production is costly and disruptive, and I can’t see the news of any unpatchable security vulnerability endearing a vendor to a customer.  In our rush to Internet-ize everything, security may take a back seat again, just like the early days of the Internet or smart phones.  As a result, weaknesses will be exposed that attackers the opportunity to do embarrassing, destructive or even dangerous things.

Vendors should operate under the assumption that something will not go according to plan.  At some point, a security vulnerability will be discovered in a product even if the vendor did not find it pre-release.  And when that vulnerability is found, the vendor should be able to fix (patch) that vulnerability ASAP.  Any other approach, such as selling software products that cannot be patched, is downright irresponsible.  

Cyber Security Basics

Finally taking the time to figure out how to properly sell the book Cyber Security Basics. I have updated the pricing and updated the Kindle version, and started paying attention to the sales dashboard. To date I’ve sold 215 copies of the physical books and 58 of the Kindle ones. screen-shot-2016-09-24-at-10-05-30-am

Kindle Sales for 2016

There has recently been an upward trend that I hope will continue as I dig more into the as-of-yet untapped marketing options available to self-published authors. And there are a lot!

Thank you to everyone who has purchased a copy. Please review it in Amazon if you have a spare minute–it would be a huge help.

Splunk Certified Architect 6.3

It’s official — I got my Splunk Certified Architect 6.3 badge today. It was a lot more work than I though it would be; it’s definitely not just symbolic. Six classes at about 55 hours total (not including studying) capped off by a final lab that we had 24 hours to complete (I think I took about 8 hours, the first day running well past midnight.)

Splunk Certified Architect BadgeThe best way to learn about many technologies, I feel, is to get certified. Preparing for a certification forces you to study and learn the details and a lot of things that you might not have used before, but after learning them, may come in handy later. These classes and tests helped me understand how Splunk works and the depth of the tools and options it offers. It’s really a massive solution, and now I have a better handle on how to apply its various features for almost any type of environment.

The classes were very good as well as their instructors. The education program shows that it cares as much about the quality of their training materials and delivery as the engineers who built and support Splunk products. I always appreciated how Splunk was created and designed–it just felt like it made sense. Now that I demonstrably know a bit more, my instinct has been validated.