10 Red Balloons (got me thinking)

January 30th, 2010 Michael Wilkes 2 comments

I stumbled across this article about a clever challenge involving 10 red balloons. I read about it after following a link on a design studio’s Twitter posting. DARPA (Defense Advanced Research Projects Agency of the US government and creators of the internet back in the cold war days of the 1960s… read Bruce Sterling’s “A Short History of the Internet” written in 1993 if you have never heard of DARPA) took the 40th anniversary of the creation of the internet to pose the question: “Can any real world problems be solved by using the internet?” They came up with the DARPA Network Challenge.

So basically DARPA hid 10 red weather balloons all over the continental United States, and the challenge was to find them all, submit their latitude and longitude, and to find them first. Of course a team from MIT won the competition. How long did it take to find them? A month? A week? Just 8 hours and 52 minutes. How did they do this? By using social media and social networks of course.

Officially the DARPA Network Challenge states:

The DARPA Network Challenge is a competition that will explore the roles the Internet and social networking play in the timely communication, wide-area team building, trust and urgent mobilization required to solve broad-scope, time-critical problems.

So that’s all well and good, fun and interesting and such. But the thing that got me thinking, the thing touched on in the marketing website article was not the discovery of the (in advertising lingo) “big idea” a.k.a. the red balloons. But rather it was the MIT team’s process and approach to solving the problem that is the new “big idea.” The process invented by MIT’s team to rapidly assemble and task it’s newly formed “red balloon team” community worked, and it easily slipped into the operational ethos of bloggers, Facebook users and Twitter users (of course, having decided to donate the $40,000 cash prize to a charity probably helped too). The success of that process demonstrates to me (and DARPA who will interview the MIT team and it’s “community” of participants) the real value of social networks and the internet.

What the marketing website article is trying to say is that ad agencies used to be doing nothing but looking for the next “big idea” and then pitching it to their clients. But along came the internet and changed all that. There are plenty of these big ideas to go around, and depending on how immersed you are in all this social media/networking stuff, more and more of them are starting to come from end-users or consumers. Take the Swiffer for example, it was an idea suggested by a consumer responding to an initiative called “Connect and Develop” from Proctor and Gamble to gather feedback and ideas from their customers.

Crowd sourcing: No one is as smart as everyone.

This is one of the ideas that forms the center of the disruptive technology called the internet. We experience successive waves of change that are emanating from the fact that virtually anyone can publish their thoughts, ideas, images, and video for the rest of the world to find. And sometimes conditions conspire to allow a simple idea or thought to permeate the minds and hearts of millions of people in a near instant. Such things are often called internet memes.

The first wave that hits you is email. Everyone starts here and sees the value of being able to send and receive email. Even my parents have been hit by the power of this medium of communication. The next wave I think that hit was port 80 traffic: http protocols for websites and web pages. Then e-commerce as a wave of online shopping, followed by an MP3 wave (napster at first, iTunes music store now), and most recently by a youtube.com or video wave.

In each of these waves, traditional media entities have been deeply disrupted by the free flowing of ideas and assets. Email killed the telegram (Western Union decommissioned the service in 2006 after over 150 years of use) and is digging into postal service revenues since day one. The websites and webpages have largely up-ended magazines and newspapers so that printed editions are now becoming increasingly scarce. MP3s have both salvaged and savaged the recording industry. And in January 2009 YouTube.com recorded over 100,000,000 viewings per day.

So all of this will continue happening, the waves of disruption (disruptive to traditional thinking and doing at least) will keep on coming. Publishing will become easier, in all sorts of media. Access will be expanded to include more and more people. And our part in all of it, at least in my view, is to remember to try to step back and think about the process of change that is going on. The new ways we can solve problems using this incredible web of technologies and people addicted to them. That will remain a valuable skill and insight to achieve and maintain. Learning how to program perl is great, or some other language. But eventually perl won’t matter that much. We won’t need to pay so much attention to the underlying technologies of the internet because they will (rightly) recede into the background. What will remain will be pure freedom of communication and expression I imagine. And the possibilities at that point will be blinding. So don’t fret about the big red balloons, just try to keep being a curious, problem-solving clever monkey and you’ll always have interesting work to do.

  • Share/Bookmark

CA will not start… What do you mean, cannot download CRL…

January 20th, 2010 Frank Breedijk No comments

As part of my work I was installing a Microsoft PKi infrastructure with two tiers. A root CA and an issuing CA.

Since the root CA is in another domain then the issuing CA, it took some fiddling and tweaking around with my CDP and AIA extensions, but that is another blogpost all together.

I knew I was in for some fun when when the following happened:

  • I installed my Issuing CA and generated the certificate request
  • I issued the request to my Root CA and generated the Issuing CA certificate
  • I tried to install the Issuing CA certificate and got the following error:
Cannot verify certificate chain. Do you whish to ignore the error and continue? The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2168885613)

Cannot verify certificate chain. Do you whish to ignore the error and continue? The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2168885613)

My first reaction was to call one of the network guest and notify him that I needed http access to the Issuing CA to the CDP location. But whil on the phone, I decided to try and to my surprise I was actually able to manually pull down the crl.

Intregued, I decided to check a few things:

  • I could download the CRL from both CDP locations with Internet Exporer
  • I could open the downloaded CRLs
  • I could telnet to port 80 of the both webservers
  • I could telnet to port 80 manually issue the GET /crl/CRLname.crl HTTP/1.0 command and get data back

O.K. what is going on here… Lets open PKI view, which is now included in Windows 2008 and Vista and can be downloaded for Windows 2000 and 2003.

It seemed that PKI view as in agreement, it too could not download the CRL from the CDP location

PKI view shows "Unable To Download" for both CDP locations

PKI view shows "Unable To Download" for both CDP locations

This did sent me on a wild goose chase:

But, as stated, I would use certutil to get the “best” answer on how is my configuration.
Certutil -verify -urlfetch “certfile.cer” will check *every* CDP and AIA URL (including OCSP) and tell you how they are all doing *at that specific instance in time” since it goes to the URLs immediately.
Brian

I exported the Issuing CA certificate from the certificate database of the Root CA and ran the command against is and this is what I found

E:\>certutil -verify -urlfetch <certfile>.cer
Issuer:
CN=Root CA
Subject:
CN=Issuing CA
Cert Serial Number: 115d5f6400020000000b
<snip>

—————-  Certificate AIA  —————-
Verified “Certificate (0)” Time: 0
[0.0] http://IIS1.domain1local/crl/Root-CA.crt

Verified “Certificate (0)” Time: 0
[1.0] http://IIS2.domain1.local/crl/Root-CA.crt

—————-  Certificate CDP  —————-
Wrong Issuer “Base CRL (13)” Time: 0
[0.0] http://IIS1.domain1.local/crl/Root-CA.crl

Wrong Issuer “Base CRL (13)” Time: 0
[1.0] http://IIS2.domain1.local/crl/Root-CA.crl

<snip>
E:\>

So while PKI view and the other error messages I was getting all pointed to the most common cause, it actually turned out that the CRl did get downloaded, but was not cryptographically relevant to what the system believes is the Root CA certificate.

Root cause

Inspection of the CRLs generated and the Root certificates installed showed what had caused the problem. In order to test the CDP extensions I had reissued the Root CA certificate, causing the Root CA to have three active certificates. Each with a different key.

This CA has three CA certificates

This CA has three CA certificates

When validating the Issuing CA certificate, validation would end at the last certificate issued, however the CA still signs its CRLs with the key pair of the first certificate.

I guess for me there is nothing left but to reinstall the entire chain.

  • Share/Bookmark

Seccubus.com website is online…

December 13th, 2009 Frank Breedijk No comments
The new Seccubus logo

The new Seccubus logo

Last month our coworker Frank Breedijk rechristened his vulnerability management tool Seccubus. Today he has launched his new website Seccubus.com

With the new website author Frank also unveiled the new logo for Seccubus drawn bij Schuberg Philis collegue Robert Heuvel.

  • Share/Bookmark

Lisa 2009 #3

December 4th, 2009 Frits Brusse No comments

Most of the information about lisa09 is already mentioned by my colleagues Adam and Sjoerd in lisa-2009 and lisa09-02.

I want to mention some training sessions I attanted

  • Dtrace course by Jim Mauro and a lot of extra information came from Richard Elling and 1 other Sun employee. Together they provided a lot of real world examples on how to use Dtrace. And nice details about how it works in the kernel. Everyone knows Dtrace from the youtube movie by Brendan Gregg more info on his blog. So now I should enable all Dtrace probes and start screaming in the datacentre and see if I was loud enough :) YouTube Preview Image
  • ZFS by Richard Elling, I never had time to look into this FileSystem before, so a great way to learn all about it in one day. One of the nice features is the buffering of disk-writes which gives a kind of breathing or heartbeat towards the disks. And with ZFS you can buffer writes to a solid-state drive before sending it to the “slower” disks.
  • Jquery given by Tobias Oetiker,an easy way to build spiffy webpages that look the same on each browser. Like this demo . Got a really great explanation about the problem with the scope of variables in Javascript especcially because JQeury uses the “$” as a variable and how to get around it using a function. And there is a nice page with a lot of Jquery plugin material http://plugins.jquery.com.
  • Nagios Advanced Topics by Sellens , I discovered that the feature I am still missing in Nagios isn’t build yet , having two nagios hosts loadbalance the load and keeping each other in sync. We already build our own solution of nagios hosts keeping eachother in sync only the loadbalancing part needs some work maybe I need to spend some time on reading the nagios mailinglist.

The Sun guys were really pushing or should I say selling opensolaris , well they were giving away a lot of opensolaris dvd’s and they mentioned the website http://www.solarisinternals.com/ a lot. Really cool to see all the buzz about an open system.
In the hotel I had breakfast with Mike Ciavarella, we spoke about his training session about documentation and how it would secure your job and even helps getting a better position.

Attended a lot of BOF Session , one of them was with D.Brent Chapman from Netomata. About the automation of network Configuration and Management it brought back a lot of memories of the times I was managing systems that configure and monitor ADSL modems. People just turn of their modem and I needed to figure out if this was an outage or a Human action, that was fun.

Sjoerd already mentioned the national democratic institute, what really stayed in my mind is that everybody is trying to encrypt as much as possible, and think about social engineering to get information. The people at ndi need to work different, they make sure never to encrypt stuff and be as open to the world to get their Institute accepted by getting trust from governments and groups in the difficult areas where they work. Every time when I use GPG to keep others from reading my data I think about the guy we met at Lisa09.

During a Google-Wave sponsored drink met some people from Research in Motion (RIM) that manage the linux servers that make all connections from the RIM towards google , msn etc possible.

So had a lot of fun at #lisa09 , and nice weather too.

  • Share/Bookmark
Categories: Conferences, Lisa Tags: , ,

LISA09 #2

December 1st, 2009 Adam Kowalski No comments

LISA is for sure is sort of event where every geek will find himself like home. It is really good feeling to be surrounded by people who know stuff and enjoy technology everyday.

So LISA09 took place between 1 and 6th of November, 2009 in lovely Baltimore, MD. I chose to follow more the tutorials (trainings) path. Got five tutorials – one bad, two medium and two nice ones. The problem with tutorials is that sometimes they are very basic which I really didn’t expect to be a case on such event.

Read more…

  • Share/Bookmark
Categories: Conferences, Internet, Lisa, Unix Tags:

LISA 2009

November 26th, 2009 Sjoerd Tromp No comments

Already three weeks back from Lisa, and after some gentle stimulation trying to write down my experiences of this event. For the people who don’t know LISA, LISA is the Large Installation System Administration conference, a whole week of talks, trainings and workshops about various subjects all related to the work of unix admins in big IT environments.

From what I understood from people who had been here previously, the attendee list was a lot smaller than previous years. But still, there were more than enough people to share a talk with. It was good to have the opportunity to talk to people working at some big and very known companies like Yahoo, Pixar etc. But also I met some people who worked for less know companies (at least for me) but maybe even more interesting companies, for example, the national democratic institute.  A non-profit organization facilitating democracy in countries where democracy isn’t that natural as in most western countries. I don’t think a lot of system admins have to worry about problems like militia stealing servers from your datacenter.

The first 5 days I followed a set of trainings, some days training for the whole day, some days a morning and an afternoon session. In general I was a bit disappointed by the trainings, they covered a lot of basic stuff, a whole day can be a very long sit for just 2 new bits of information. But a few sessions were quite interesting and/or entertaining.

Read more…

  • Share/Bookmark
Categories: Conferences, Internet, Lisa, Unix Tags:

Confidence 2009.02 – Underground economy – Raoul Chiesa

November 20th, 2009 Frank Breedijk No comments

Subtitle: Why we should be fully-updated on this topic: InfoSec players, Finance world, citizens

Raoul is a member of UNICRI (http://www.unicri.it/), a United Nations crime and justice research institute.

Unicri research technology as well, because if normal people use technology, the bad guys use it as well.

“Every new technology opens the door to new criminal approaches”

In the 70s the first wave of hackers where searching for knowledge. In the early 80s the second wave of hackers was driven by curiosity. The third wave of hackers in the 90s where eager to hack and started to exchange information. The first communities where created. The current fourth wave is now driven by anger and money. Hacking has met politics (hacktivism) and money (cybercrime).

Why is cybercrime on the rise?
1)    There are more and more targets, thanks to broadband
2)    A need to make money, think economical crisis
3)    Hacking got easier, 0-day attacks and skimmers can be easily bought online.
4)    Fall guys are easy to recruit, e.g. for money laundering
5)    The criminals think they cannot be caught
6)    There is no violence, no need to face your victims

Read more…

  • Share/Bookmark

Confidence 2009.02 – The Tor Project – Jacob Appelbaum

November 20th, 2009 Frank Breedijk No comments

The Tor project is a non-profit organization that has a full documented network that provides anonymity and privacy by design and is fully documented. Tor is funded by both the US DoD, EFF, Voice of America, Human Rights Watch, Google, NLnet, and you?

Tor is really a community of developers and volunteers and is still looking for developers and volunteers to enhance themselves.

Top countries in the world in bandwidth:
•    Germany
•    USA
•    Netherlands
•    France
•    Sweden

Anonymity means different things to different people:
•    Private citizens – Privacy
•    Government – Traffic analysis resistance
•    Human rights activists – Reachability
•    Businesses – Network Security

Read more…

  • Share/Bookmark

Confidence 2009.02 – Power Hungy People – Nick DePetrillo

November 20th, 2009 Frank Breedijk No comments

Subtitle of the talk: Making sense of new critical infrastructure threats

The talk is about the “Smart Grid”. The key components are and advanced metering infrastructure, Transmission and distribution and generation of electricity.

Advanced Metering Infrastructure enables two way communication between the meters in your home and the power company. It offers the following features:
•    Load control works like this: Some power offer a discount in return for control over the thermostat of your AC or by allowing them to turn off your clothes dryer during peak hours. The main reason for this is officially to prevent black outs, but it can be used to prevent penalties as well.
•    Demand response: It allows for dynamic rates to be loaded to your meter.

Why move to a smart gird?
•    Energy conservation
•    Cost reduction
•    Improved Reliability of Delivery

Smart Grid security is significant because it has national security implications, because there are millions of entry points into the grid.

Read more…

  • Share/Bookmark

Confidence 2009.02 – Mifare Classic anaysis – Pavol Luptak

November 19th, 2009 Frank Breedijk No comments

Pavol started by showing the cards he cracked that same day at the conference. Two Polish public transport cards, one Slovacian public transport card and, by coincidence, a Dutch Public Transport Card.

He also released, into open source, an offline MiFare cracking utility that can be used to crack any MiFare card for 30 euros and with just a few hours of work.

In the past MiFare’s encryption technology, Crypto1, was only available in hardware and thus survived for a surprisingly long time.

Pavol explained how his program can computer derived keys from the main key by using the time distance between the keys.

For those people that dodn’t know. MiFare Classic can be cloned in 99.6% (Except for sector 0 that cannot be written) a ProxMark3 card emulator can emulate all cards 100% perfect.

There are currently three countermeasures:
1)    User safe cards (Mifare Plus/Mifare Desfire or other)
2)    Use decrement counter protection (workaround)
3)    Use online checking

Read more…

  • Share/Bookmark