Dan Kaminsky's Blog

I can indeed confirm — Grandma’s coming for her fourth Black Hat. (In other news, wow, that’s a really cool bio. Thanks, Kelly!)

Saw this post over at BoingBoing: Home Inspection Nightmares photo gallery, Volume 6, a series of seriously misguided home engineering efforts. There’s a tone to this writing that is oddly familiar to anyone who’s ever done security audits. Check it out.

Hackers On A Plane. It is on. It is on like Donkey Kong.

It is fundamentally disingenuous to imagine the IT industry as a nascent utility waiting to fade into the background, as Bruce Schneier suggests in this article. Consider:

My power company provides 120 Volt electricty at 60 Hz. My water company provides me a finite amount of water at a certain pressure. My phone company provides me bidirectional speech transmission, as well as a very simple mechanism for providing routing data for that speech (touch tone).

These are commoditized, well-defined and tightly scoped resources.

However.

My power company does not own, operate, manage, take responsibility for, or even know of what their 120 Volts at 60 Hz is powering. My water company doesn’t even warm the water it gives me. My phone company does not screen my calls.

Data is not Information. Utilities provide a tightly constrained service, providing a resource that’s mostly unchanging and specifically not wildly different from customer to customer. Local pieces tend to be managed by third parties — electricians, plumbers, even users. If something goes wrong with my sink, I don’t call my water company.

I recently read Jeremy Clarkson’s I Know You Got Soul. For those who don’t know, Jeremy’s one of the hosts on Top Gear, which can basically be thought of Mythbusters if the myth was “I heard it won’t go that fast”. An interesting read, all about machinery that was the technical embodiment of hopes and dreams, quixotic or not. One of the things Jeremy mourned was the loss of Concorde (never, ever “the Concorde”. Concorde.). Never economical, the only supersonic passenger jet capable of managing three hour hops between Heathrow and JFK was grounded when one of them went up in flames a few years back. Jeremy wrote, rather wistfully, that technology was only supposed to improve. But a few years ago, you could make that trip in three hours, and now, quite simply, you could not.

Of course, not everyone could afford Concorde. The entire travel industry has realigned towards bulk transfer of people at the lowest cost possible. Airbus may very well be the most presciently named company in history. Concorde was many things, but it could never be “just a bus”.

But this is not to be a post about travel — having finally made it home after five weeks on the road (a shattered soul with a smile on his face, as predicted), I could do without planes for the moment. It was a fun trip, yielding a veritable bumper crop of pictures from my Fuji F30.

Indeed, it’s photography I’m interested in at the moment. The initimable Xeni over at BoingBoing put up a link to Nathan Myhrvold’s prognostications on the future of Digital Photography.

I have never met Nathan. Having read this, I am thoroughly convinced: This is a man who misses Concorde.

Nathan is writing about a perceived end to the revolution for digicams. He’s actually arguing, no wait, the revolution isn’t over…one can only conclude he’s thinking about the high end for SLRs, where things have somewhat settled. The war is over, digital has won. Except for the most extreme large format work, and probably motion pictures, CCD’s have won.

New Code. Not exactly packaged well. Or at all. Be happy it’s in a tarball. I was tempted just to post Base64 in this blogpost 🙂

“Docs” (can one even call slides docs?) here.

—

Side note: Whyfor the suck? Laptop screen broken…I get a few minutes here and there of use. A quick note though…

cat data | requitur -p | cfg9000 > fuzzed

Use hardcorr with the -c file option to compare a file to another file visually. Use hardcorr_flat for anything substantial.

Irfanview is the fastest way to view PGM files.

I forgot to throw in the code that does syntax highlighting for hex dumps. I’ll release that next time I get online.

Seen on CNN: “iPod flaw helps stalkers track your every move”.

Uh, guys? Every last one of you is carrying around a high power transmitter. It’s broadcasting your precise location twenty four hours a day, seven days a week. Unlike these (totally badass, but that’s besides the point) iPod/Nike hacks, there’s receivers for these transmitters all across the world. It’s called your cell phone. McNealy’s calling, pick it up.

So there’s a couple articles I’ve written this year that hadn’t yet been posted. To be honest, I’m a little bored with DNS (though DNS over DNS is just glorious), and Sony…well, they genuinely did the right thing in the end, so why beat up on them?

Still, enough people have been asking me for PDF’s, that I’ll just go ahead and post ’em:

• Explorations In Namespace: White-Hat Hacking Across The Domain Name System. This was actually fun — the ACM devoted an entire issue of their magazine to articles by hackers, to get a better idea of the mindset we work with. They asked me to contribute — I was happy to oblige.
• Learning From Sony: An External Perspective. The AV industry has something of an internal newsletter, Virus Bulletin. After Sony went down, I was invited to respond to what most people felt was a…less than satisfactory showing from the AV industry. For the record, one year later I’m cautiously optimistic that what happened with Sony wouldn’t happen again.

An interesting question for the HP board room case, one I don’t necessarily have the answer to:

Suppose that Patricia Dunn’s private investigators had kidnapped a member of the HP board and held him hostage until the leaker was successfully identified. I think Dunn would have had a reasonable case to say — look, I hired some private investigators; I didn’t think there’d be congressional hearings about what they had in mind. If I had known they’d do such a thing, I’d never have hired them.

The PI’s she hired, of course, didn’t kidnap anyone. They just picked up cell phone records, something that you don’t even need special connections to accomplish. (Kudos to the Merc News for actually reporting on this!) Did they commit a crime? Absolutely. But did these guys think they were doing anything above and beyond their normal activities? Check out this PI from the original news report in January 2006, back in the Chicago Sun Times:

Ernie Rizzo, a Chicago private investigator, said he uses a similar cell phone record service to conduct research for his clients. On Friday, for instance, Rizzo said he ordered the cell phone records of a suburban police chief whose wife suspects he is cheating on her.

“I would say the most powerful investigative tool right now is cell records,” Rizzo said. “I use it a couple times a week. A few hundred bucks a week is well worth the money.”

If not even the guys who do this stuff every day realize the criminal implications of surreptitiously acquiring cell phone records, would they have even told Dunn they were doing so? If so, would she have had any reason to have considered it unusual? Or might this have seemed legitimate due diligence, circa 2006? What a depressing commentary on the collapse of privacy in a networked society…and what a beautiful proof of the universality of McNealy’s Law.