Too Lazy to Fail

Banking on Security - A security consultant gives a first-hand account of posing as a copier technician and breaching the security of a bank network, at the request of bank management.

We were recently hired by a regional bank to assess its security. When negotiating the services agreement with the bank president we agreed to perform the standard network security penetration testing, but he insisted we also test the security awareness of the bank staff.

What he really wanted to discover was whether employees have become complacent in verifying credentials of the customers, but more importantly checking out the people who service the bank’s needs. The bank had recently outsourced its IT functions, and although they were promised a dedicated technician by the outsourcing firm, the revolving door of technicians coming and going had become the standard.

After signing some legal boilerplate and “get out of jail free” paperwork, here’s what we agreed to: Pose as a vendor, enter the facility, plug into the network, sniff traffic, look for login and passwords, then try to become domain administrator of the network.

Dear misinformed driver crossing the intersection near my home:

When approaching a four-way flashing red light, you are to treat it as a four-way stop. Let’s split this into two parts for clarity’s sake, shall we? Four-way means that the rule applies to four directions in the intersection. While it is technically possible to construct a five-or-more-way intersection, I have yet to find one in Tennessee. Let’s assume that since there are only four directions marked on this intersection, the term four-way applies to ALL directions. Stop means that one should come to a complete halt. This means that your brakes should be fully engaged, and your speed reduced to Zero.

If you are the only driver at the intersection, you may cross freely.

If you are met at the intersection by another driver, proceed only if you were the first to arrive. If you were the first to arrive, do NOT “be a nice guy” and let the other driver goes first. This will lead to uncertainty in the minds of all drivers involved, and will likely end only in several delays followed by both of you attempting to cross at once. I do not want you to be nice to me. I want you to continue according to the rules of the intersection so that we may both arrive at our destinations in a timely manner.

If you are met simultaneously by two or more other motorists, it is customary to allow the vehicle on your right to proceed first. In the unlikely event that four vehicles arrive simultaneously, you can be forgiven for some confusion as to which driver should be allowed right-of-way. This sort of embarrassing scenario usually leads to significant looks, uncertain hand gestures, and mutual misunderstanding. Most such encounters end in a positive way, so please do not become paralyzed with indecision. Allow safety and common sense to prevail, and all will be shiny.

If you arrive at a particularly well-traveled four-way stop, you may find yourself behind another motorist. When the car in front of you accelerates across the intersection you are not permitted to follow immediately after him. Come to a COMPLETE stop, and then accept that you are now last in this four-way queue and will wait until a car has crossed from all three opposing directions.

If you follow immediately after the car before you in crossing the intersection, and I was next in line to turn left, I will continue my turn (as possible within the bounds of safety) while firing my horn in a three-second burst. You will either come to a sudden, shocked stop while I wheel in front of you, or you will continue on illegally with my headlights (and horn!) three feet away from your driver’s side window.

You will undoubtedly feel the urge to return my horn’s signal, or hoist a single digit in my direction, but will be prevented from doing either because your non-driving hand is holding a cell-phone or a Big Mac. Instead, you will stare slack-jawed as my unfeeling gaze peers calmly into your soul. Please notice that my lack of preoccupation while driving has left me with two hands, one of which is available for properly signaling turns and warning people like you of the danger you are causing yourself and others by driving in an unsafe manner.

Thank you for your time.

Could you be a Rising Star? A Rising Star is a senior who exemplifies
professionalism, initiative, intellect (especially in their major or
discipline), and who is able to communicate effective!

I’m so proud of my university.

So a few moments after I made that last post, I leaned back and took a sip of my soda. It was at that moment that the heads of all three bolts decided that they didn’t have to take this anymore, and promptly sheered off. My exact thoughts as I plummeted toward the floor, I kid you not, were as follows:

“I knew this would eventually happen.”
“I hope there’s nothing sharp or hard on the floor. I think I got everything when I cleaned up earlier. Did I?”
“Don’t spill the soda!”

So there I was, my calves resting on the seat of the chair, my back still in contact with the now-detached portion of the backrest, my head on the floor…

and my hand holding aloft my half-full can of Diet Mountain Dew, not a drop of it spilled.

So I still have my half soda, which pleases me, but now the bottom half of my back is warm and tingling, which I’m not sure is a good sign.

Now that I’ve figured how to get WordPress to not barf on ingestion of a YouTube or Google Video object, I can re-post the video that got me more traffic than all others combined.

Ladies and gentlemen, Pug Bowling.

Onlamp user chromatic wrote this amusing rant about challenge-response spam filtering:

I just love challenge-response mail confirmation systems. “Hi, I get a lot of spam and someone sent me an e-mail pretending to be you. Would you mind filtering my spam for me? It only takes a minute, and if someone’s forging your address on spam, I’ll totally let it through if you simply respond to this message!”

My mail server publishes perfectly valid SPF records. I’ll give you a hint: if someone sends a message purporting to be from me but it fails the SPF checks, not only is the message not from me, but I don’t want to hear about it.

Perhaps I’d feel better if all challenge-response mail confirmation system users published their home phone numbers. It’s just a little bit of work to connect Asterisk, Festival, and procmail to dial their numbers and read my questionable mail to them. Clearly they have plenty of free time, if they’re getting so much spam that there’s no possible way they can filter it all without pushing the burden back to everyone else on the Internet.

It seems like a fair trade to me. If I do your mail filtering for you, I should get something of equal value in return - unless they believe that their time is far more valuable than mine. (Nah, can’t be. Otherwise they would have whitelisted me when they first sent me messages.)

Brilliant!

Jackson, Tennessee has been ranked 9th most dangerous metropolitan area in the nation by Morgan Quintino Press. The Jackson Sun wrote a feel-good piece about it not being as bad as Quintino suggests:

Jackson City Councilman Johnny Dodd on Tuesday said he doesn’t dispute that Jackson has a crime problem, but he questions the accuracy of the crime ranking for Jackson.

“You can’t just base it on the size of our city. That’s not fair,” Dodd said. “Crime varies depending on the seasons, the economy and the surrounding areas we have.

“You’ve got people that come here (to Jackson) and commit crimes and get back on the highway,” he said. “That makes our numbers go up. The last murder (on Roland Avenue), where was he from? Memphis. I think Jackson’s probably still one of the nicest places to raise a family.”

It doesn’t matter if a criminal comes from Mars, Mr. Dodd. The crime still occurs in our town, and that contributes to the danger we face as Jackson residents, fair or not.

The folks at Union University’s student paper, the Cardinal & Cream, who apparently don’t think that keeping their online edition current past May is important, ran a similar story before the Quintino statistics were released. Not having the paper, which I threw away, in front of me, and not having the online edition, I’ll do my best to paraphrase from memory:

There’s been a rash of school shootings nationwide, and a few local cases of car break-ins and runaway fugitives on Union’s campus, but not to worry: Our staff of ten retirees with walkie-talkies and flashlights have been very well trained to respond quickly to a threat on campus, whether that be a fistfight or an active shooter. They are absolutely prepared to evacuate students and call the police.

The story ends with quotes from students walking around campus who say that they feel perfectly safe, thank you very much and don’t think anything “like that” could ever happen at their school.

I’m not saying that we need night-vision cameras and attack helicopters, but these when I listen to these folks talk all I hear is… Baaaaaaaaaah.

(As a more positive aside, next to the “I’m OK, You’re OK” article on the front page of the Jackson Sun was a story written by my wife. There’s some unexpected publicity.)