Northern Lights Chasing in Iceland with the Nikon D810

There’s nothing quite as magical as seeing a bright green and pink Aurora Borealis dancing in the sky. One of the world’s most dazzling natural light displays, the Aurora is produced when charged particles from solar winds encounter our atmosphere, penetrating the Earth’s magnetic field, exciting Oxygen and Nitrogen to produce green and pink Auroras, respectively. It’s just wicked awesome science. One of the best things about Aurora photography is that it’s always changing; there’s always a new dance to capture, and plenty of foregrounds to shoot from. My wife and I have been Aurora chasing for a few years now, and have captured her in Norway, Iceland, and New England. Along the way, we’ve picked up a few tricks, and gotten some practice in taking astrophotography in between.

We’ve spent the past two years raising our little girl, Lily, so we haven’t been traveling internationally. This fall, we’ll be out chasing again (with a junior explorer), so I’ve been brushing up on my skills including my skills at developing these photos, which I’ve updated.

Cosmos

Zeiss 15mm, f/2.8, 13s, ISO 1600

Continue reading “Northern Lights Chasing in Iceland with the Nikon D810”

Just Following Orders

“In a democracy people get the leaders they deserve.” (Joseph de Maistre)

The President recently reversed his own decision to separate children from their parents after crossing into the United States, an action that the United Nations office of human rights condemned as a violation of basic human rights of children. They weren’t alone. The Pope spoke out citing such a disgraceful policy as contrary to Catholic values, and immoral. The Methodist Church called it child abuse and racism. Other religious leaders echoed this sentiment. Business leaders spoke out publicly condemning it. All five living first ladies spoke out against it. It was clear to the world that the United States, under the direction of the Trump administration, was committing violations of human rights of children. Yes, it was disgusting and disgraceful, and the world was ashamed of us. Yes, I blame the Trump administration as the root cause of it. I also blame the people that carried it out, who all too often get away with no accountability for “just following orders”.

Such a mandate to violate human rights should have never gotten past the terrible leadership call; the orders should have been outright refused by the people who were tasked with handing them down, and ultimately by the ICE agents carrying them out. But they weren’t refused. They were carried out. From many reports, some agents enjoyed what they did. There are many horrors beyond family separation being reported, and what’s most disturbing is that these were done by Americans. Not faceless machines, but by members of our society. Yet refusing inhumane orders is what separates us from a history of atrocities. Why didn’t these orders get refused on a large scale? We should consider this very seriously. There are only two possibilities: either the agents who carried these orders out didn’t realize they were abusing the children as they were removing them from their parents’ care and putting them in cages, or they were willing to commit acts they knew to be immoral and inhumane. If even a small portion of lawsuits about living conditions are to be believed, there is no question that agents knew what they were doing. In either case, we are dealing with a very dark part of humanity that would do such a thing, even under orders.

Continue reading “Just Following Orders”

How Social Media Changed Us

The current young generation will soon have grown up without ever knowing what it’s like to not have social media. They’re also growing up without a sense of how society was before social media came into play. Whether you use social media or not, it’s likely affected your life because it’s changed how people relate to one another – including you. While there are many good aspects of social media and the concept of bringing people together, there are also many negative changes it’s had on how we relate to one another.

I’ve spent a lot of time observing others and how social media has affected them online over time, and seen the problems it can create. For me personally, I’ve never been happier to be off of social media than the past year or so when I finally ditched Twitter for good. Twitter is a creepy and toxic place, which seems to be exactly what their CEO wants it to be. I found that I didn’t like the person I had to become in order to stay on it. Most social media is a dumpster fire, but Twitter was a particularly awful experience. It simply isn’t worth the stress and distraction in order to relate to a bunch of randos on the Internet whose only goal in life is to cause misery. Social media doesn’t deserve to have the power to change you, but they do. Getting back to the humanity of relationships is almost like waking up from a bad dream: you’d almost forgotten the goodness in what normal relationships with others (professional, friendships, etc.) feels like.

So at the risk of the next generation never knowing what it’s like to have a normal relationship with others, I’ve written down  just a few of the things that are important in building friendships and other types of relationships – things social media seems to have endangered… at least, from the perspective of this old Gen-X’er. Writing all of this makes me really miss how people were before social media existed.

Continue reading “How Social Media Changed Us”

Moving the Needle on Gun Violence

Gun violence is a complex problem. No single solution will prevent all gun violence, and while some of the more sensible solutions I’ve written about are a significant part of a larger solution, there are a lot of other things we can do too. In other words, no one thing is ever going to be a complete solution. The gun industry knows this, as do the lawmakers they fund, which is why the only thing many congressmen have been capable of offering are thoughts and prayers. It’s easy for politicians to attack any single idea if it’s only one piece of the puzzle. Just like other complex problems, a multi-faceted solution is needed here. Also like other complex problems, the success metric shouldn’t be reducing gun violence to zero, but rather how much we can move the needle down from the 33,000 lives lost to gun violence each year. The need for a creative and sophisticated solution is especially true in the United States, as there is an inherent fear among part of the country that we will become just like Australia – a country that has had zero mass murders in the past 20 years, and yet still remains a democracy. This sounds simply awful to some.

Rather than go on about the need to follow Australia’s model (which we should), or the desperate need this country has to fire most of our politicians and reform campaign finance law (which we should), I’ll attempt to outline my opinion of what I think would move the needle on gun violence significantly in this country, keeping what is realistic in sight.

Continue reading “Moving the Needle on Gun Violence”

Reclassifying Semi-Auto Rifles under the National Firearms Act

I originally wrote this article in summer 2016, and have been revising and tweaking it every time there’s a mass shooting in the news. This has been a lot lately. It has become a very sad and depressing thing to constantly bump the date on this content, knowing that it will simply fall on deaf ears again and again. Some days it feels as though the value our country puts on human life is so very little. It gets harder and harder to convince myself that there is still good in our society, but in the midst of these horrifying tragedies, the good still manages to emerge.

I’ve been a long time responsible gun owner, by the old definition of what that used to mean. Like a vast majority of them, I’ve wanted more controls on semi-automatic rifles – particularly, assault rifles, for a long time. Indeed, there’s Kool-Aid on both sides about assault weapons, and both have some questionable notions about them. The extreme left seems to have developed an irrational fear and hatred of all guns and the extreme right believes the only solution to guns are more guns. Consider this alternative perspective from someone who’s spent over 15 years shooting and working on guns, obtained NRA certifications to supervise ranges and carry concealed weapons, and up until a few years ago – when I sold the rights to it – produced the #1 ballistics calculator in the App Store.

What much of the nation does not know is that there is already a system in place to perform strict checks of individuals looking to own firearms categorized as highly lethal. Introduced in the National Firearms Act, this system applies to machine guns, short barrel rifles, silencers, sawed off shotguns, and other types of firearms that individuals can still legally own today, but with more than the casual regulation of AR-15s and other such firearms.

There is a lot to chew on here, but if you follow this article to the very end, I think you’ll see how it all comes together to a solution that would address this very complex problem should Congress ever act. It’s important first to lay the groundwork necessary to build up to these working points.

Continue reading “Reclassifying Semi-Auto Rifles under the National Firearms Act”

Attacking the Phishing Epidemic

As long as people can be tricked, there will always be phishing (or social engineering) on some level or another, but there’s a lot more that we can do with technology to reduce the effectiveness of phishing, and the number of people falling victim to common theft. Making phishing less effective ultimately increases the cost to the criminal, and reduces the total payoff. Few will argue that our existing authentication technologies are stuck in a time warp, with some websites still using standards that date back to the 1990s. Browser design hasn’t changed very much since the Netscape days either, so it’s no wonder many people are so easily fooled by website counterfeits.

You may have heard of a term called the line of death. This is used to describe the separation between the trusted components of a web browser (such as the address bar and toolbars) and the untrusted components of a browser, namely the browser window. Phishing is easy because this is a farce. We allow untrusted elements in the trusted windows (such as a favicon, which can display a fake lock icon), tolerate financial institutions that teach users to accept any variation of their domain, and use a tiny monochrome font that can make URLs easily mistakable, even if users were paying attention to them. Worse even, it’s the untrusted space that we’re telling users to conduct the trusted operations of authentication and credit card transactions – the untrusted website portion of the web browser!.

Our browsers are so awful today that the very best advice we can offer everyday people is to try and memorize all the domains their bank uses, and get a pair of glasses to look at the address bar. We’re teaching users to perform trusted transactions in a piece of software that has no clear demarcation of trust.

The authentication systems we use these days were designed to be able to conduct secure transactions with anyone online, not knowing who they are, but most users today know exactly who they’re doing business with; they do business with the same organizations over and over; yet to the average user, a URL or an SSL certificate with a slightly different name or fingerprint means nothing. The average user relies on the one thing we have no control over: What the content looks like.

I propose we flip this on its head.

Continue reading “Attacking the Phishing Epidemic”

Confide: A Quick Look

My inbox has been lighting up with questions about Confide, after it was allegedly found to have been used by staffers at the White House. I wish I had all of the free time that reporters think I have (I’d be so happy, living life as a broke beach bum). I did spend a little bit of time, however reverse engineering the binary and doing a simple forensic examination of it. Here’s my “literature in a rush” version.

Note: When I first wrote this blog post, I apparently had run into some corruption or some other strangeness going on with the framework; I suspect one of the tools I normally use might have decrypted it for me, and done a shoddy job without even telling me, so I have decrypted it by hand dumping memory from a debugger, and have updated my findings accordingly.

Continue reading “Confide: A Quick Look”

Protecting Your Data at a Border Crossing

With the current US administration pondering the possibility of forcing foreign travelers to give up their social media passwords at the border, a lot of recent and justifiable concern has been raised about data privacy. The first mistake you could make is presuming that such a policy won’t affect US citizens.  For decades, JTTFs (Joint Terrorism Task Forces) have engaged in intelligence sharing around the world, allowing foreign governments to spy on you on behalf of your home country, passing that information along through various databases. What few protections citizens have in their home countries end at the border, and when an ally spies on you, that data is usually fair game to share back to your home country. Think of it as a backdoor built into your constitutional rights. To underscore the significance of this, consider that the president signed an executive order just today stepping up efforts at fighting international crime, which will likely result in the strengthening of resources to a JTTFs to expand this practice of “spying on my brother’s brother for him”. With this, the president also counted the most common crimes – drugs, gangs, racketeering, etc – as matters of “national security”.

Once policies that require surrendering passwords (I’ll call them password policies from now on) are adopted, the obvious intelligence benefit will no doubt inspire other countries to establish reciprocity in order to leverage receiving better intelligence about their own citizens traveling abroad. It’s likely the US will inspire many countries, including oppressive nations, to institute the same password policies at the border. This will ultimately be used to skirt search and seizure laws by opening up your data to forensic collection. In other words, you don’t need Microsoft to service a warrant, nor will the soil your data sits on matter, because it will be a border agent connecting directly your account with special software throug the front door.

I am not a lawyer, and I can’t provide you with legal advice about your rights, or what you can do at a border crossing to protect yourself legally, but I can explain the technical implications of this, as well as provide some steps you can take to protect your data regardless of what country you’re entering. Disclaimer: You accept full responsibility and liability for taking any of this information and using it.

Continue reading “Protecting Your Data at a Border Crossing”

Slides: Crafting macOS Root Kits

Here are the slides from my talk at Dartmouth College this week; this was a basic introduction / overview of the macOS kernel and how root kits often have fun with the kernel. There’s not much new here, but the deck might be a good introduction for anyone looking to get into develop security tools or conduct security research in macOS. Note: Root kits aren’t exploits; there’s no exploit code in this deck. Sorry!

Crafting macOS Root Kits

Resolving Kernel Symbols in a Post-ASLR macOS World

There are some 21,000 symbols in the macOS kernel, but all but around 3,500 are opaque even to kernel developers. The reasoning behind this was likely twofold: first, Apple is continually making changes and improvements in the kernel, and they probably don’t want kernel developers mucking around with unstable portions of the code. Secondly, kernel dev used to be the wild wild west, especially before you needed a special code signing cert to load a kext, and there were a lot of bad devs who wrote awful code making macOS completely unstable. Customers running such software probably blamed Apple for it, instead of the developer. Apple now has tighter control over who can write kernel code, but it doesn’t mean developers have gotten any better at it. Looking at some commercial products out there, there’s unsurprisingly still terrible code to do things in the kernel that should never be done.

So most of the kernel is opaque to kernel developers for good reason, and this has reduced the amount of rope they have to hang themselves with. For some doing really advanced work though (especially in security), the kernel can sometimes feel like a Fisher Price steering wheel because of this, and so many have found ways around privatized functions by resolving these symbols and using them anyway. After all, if you’re going to combat root kits, you have to act like a root kit in many ways, and if you’re going to combat ransomware, you have to dig your claws into many of the routines that ransomware would use – some of which are privatized.

Today, there are many awful implementations of both malware and anti-malware code out there that resolve these private kernel symbols. Many of them do idiotic things like open and read the kernel from a file, scan memory looking for magic headers, and other very non-portable techniques that risk destabilizing macOS even more. So I thought I’d take a look at one of the good examples that particularly stood out to me. Some years back, Nemo and Snare wrote some good in-memory symbol resolving code that walked the LC_SYMTAB without having to read the kernel from disk, scan memory, or do any other disgusting things, and did it in a portable way that worked on whatever new versions of macOS came out. 

Continue reading “Resolving Kernel Symbols in a Post-ASLR macOS World”

Open Letter to the Law Enforcement Community

To my friends in law enforcement, and many whom I don’t know serving our country:

First, thank you. You do an incredibly difficult job that often goes unseen, and you put your life at risk to make this great country safer. For that, I am deeply grateful.

Many of you have suddenly found yourselves on the wrong side of history. Our country has what, by many appearances, seems to be an illegitimate president who may be the product of the Russian intelligence community, and possibly even the head of the FBI, both of whom played a role in defrauding or manipulating our election system. Within one week of taking office, Trump has shown himself a madman who uses racism and personal prejudice to fill in the gaps that his incompetence affords. Seemingly overnight, our country has been transformed from what many had considered a free country struggling to overcome their indifferences, now into a place of fear for basic human rights. Racist extremist minority groups, deeply rooted in our country, have suddenly become empowered to hate, igniting hostility against anyone who is different from the majority in skin tone, religion, or sexual orientation.

With the stroke of a pen, livelihoods and families have been discarded by the government, as many who have lived legally in our country for years now have had to fight against illegal deportation orders, or have been banned from re-entering the country they call home. These men, women, and children are considered among enemies of the state not for committing a crime, but for merely existing. Meanwhile, science, technology, and even the arts are being harmed through this disgraceful practice, as many of these human beings are scientists, engineers, movie directors, and other productive human beings working for large technology innovators, defense contractors, or even in Hollywood. All of them went through several layers of vetting far beyond what the president has ever been subject to, just to be in this country and get the jobs they have. We’re in very troubling times – times that frighten everyone, except those in power.

Continue reading “Open Letter to the Law Enforcement Community”

Technical Analysis: Meitu is Junkware, but not Malicious

Last week, I live tweeted some reverse engineering of the Meitu iOS app, after it got a lot of attention on Android for some awful things, like scraping the IMEI of the phone. To summarize my own findings, the iOS version of Meitu is, in my opinion, one of thousands of types of crapware that you’ll find on any mobile platform, but does not appear to be malicious. In this context, I looked for exfiltration or destruction of personal data to be a key indicator of malicious behavior, as well as performing any kind of unauthorized code execution on the device or performing nefarious tasks… but Meitu does not appear to go beyond basic advertiser tracking. The application comes with several ad trackers and data mining packages compiled into it – which appear to be primarily responsible for the app’s suspicious behavior. While it’s unusually overloaded with tracking software, it also doesn’t seem to be performing any kind of exfiltration of personal data, with some possible exceptions to location tracking. One of the reasons the iOS app is likely less disgusting than the Android app is because it can’t get away with most of that kind of behavior on the iOS platform.

Continue reading “Technical Analysis: Meitu is Junkware, but not Malicious”

Configuring the Touch Bar for System Lockdown

The new Touch Bar is often marketed as a gimmick, but one powerful capability it has is to function as a lockdown mechanism for your machine in the event of a physical breach. By changing a few power management settings and customizing the Touch Bar, you can add a button that will instantly lock the machine’s screen and then begin a countdown (that’s configurable, e.g. 5 minutes) to lock down the entire system, which will disable the fingerprint reader, remove power to the RAM, and discard your FileVault keys, effectively locking the encryption, protecting you from cold boot attacks, and prevent the system from being unlocked by a fingerprint.

One of the reasons you may want to do this is to allow the system to remain live while you step away, answer the door, or run to the bathroom, but in the event that you don’t come back within a few minutes, lock things down. It can be ideal for the office, hotels, or anywhere you feel that you feel your system may become physically compromised. This technique offers the convenience of being able to unlock the system with your fingerprint if you come back quickly, but the safety of having the system secure itself if you don’t.

Continue reading “Configuring the Touch Bar for System Lockdown”

Backdoor: A Technical Definition

Original Date: April, 2016

A clear technical definition of the term backdoor has never reached wide consensus in the computing community. In this paper, I present a three-prong test to determine if a mechanism is a backdoor: “intent”, “consent”, and “access”; all three tests must be satisfied in order for a mechanism to meet the definition of a backdoor. This three-prong test may be applied to software, firmware, and even hardware mechanisms in any computing environment that establish a security boundary, either explicitly or implicitly. These tests, as I will explain, take more complex issues such as disclosure and authorization into account.

The technical definition I present is rigid enough to identify the taxonomy that backdoors share in common, but is also flexible enough to allow for valid arguments and discussion.

Continue reading “Backdoor: A Technical Definition”

On Christianity

I’ve often been asked why an intellectual type guy such as myself would believe in God – a figure most Americans equate to a good bedtime story, or a religious symbol for people who need that sort of thing. Quite the contrary, what I’ve discovered in my years of being a Christian is that it is highly intellectually stimulating to strive to understand God, and that my faith has been a thought-provoking and captivating journey.  I wasn’t raised in a Christian home, nor did I have any real preconceived notions about concepts such as church or the Bible. Like most, I didn’t really understand Christianity with anything other than an outside perception for the first part of my life – all I had surmised was that he was a religious symbol for religious people.

Today’s perception of Christianity is that of a hate-filled, bigoted group of racists, a title that many so-called Christians have rightfully earned for themselves. This doesn’t represent Christianity any more than the other stereotypes do, and even atheists know enough about the Bible to know that such a position is hypocritical. Since 1993, I’ve been walking in the conviction that God is more than just a story, that he’s nothing like the stereotypes, and that it takes looking outside of typical American culture to really get an idea of what God is about. In this country, I’ve seen all of the different notions of what a church should be; I think most people already know in their heart who God is, and that’s why they’re so averse to the church.

Continue reading “On Christianity”

On NCCIC/FBI Joint Report JAR-16-20296

Social media is ripe with analysis of an FBI joint report on Russian malicious cyber activity, and whether or not it provides sufficient evidence to tie Russia to election hacking. What most people are missing is that the JAR was not intended as a presentation of evidence, but rather a statement about the Russian compromises, followed by a detailed scavenger hunt for administrators to identify the possibility of a compromise on their systems. The data included indicators of compromise, not the evidentiary artifacts that tie Russia to the DNC hack.

One thing that’s been made clear by recent statements by James Clapper and Admiral Rogers is that they don’t know how deep inside American computing infrastructure Russia has been able to get a foothold. Rogers cited his biggest fear as the possibility of Russian interference by injection of false data into existing computer systems. Imagine the financial systems that drive the stock market, criminal databases, driver’s license databases, and other infrastructure being subject to malicious records injection (or deletion) by a nation state. The FBI is clearly scared that Russia has penetrated more systems than we know about, and has put out pages of information to help admins go on the equivalent of a bug bounty.

Continue reading “On NCCIC/FBI Joint Report JAR-16-20296”

Three Recommendations to Harden iOS Against Jailbreaks and Malware

Apple has been fighting for a secure iPhone since 2007, when the first jailbreaks came out about two weeks after the phone was released. Since then, they’ve gotten quite good at keeping the jailbreak community on the defensive side of this cat and mouse game, and hardened their OS to an impressive degree. Nonetheless, as we see every release, there are still vulnerabilities and tomhackery to be had. Among the most notable recent exploits, iOS 9 was patched for a WebKit memory corruption vulnerability that was used to deploy the Trident / Pegasus surveillance kit on selected nation state targets, and Google Project Zero recently announced plans to release a jailbreak for iOS 10.1 after submitting an impressive number of critical vulnerabilities to Apple (props to Ian Beer, who should be promoted to wizard).

I’ve been thinking about ways to harden iOS against jailbreaks, and came up with three recommendations that would up the game considerably for attackers. Two of them involve leveraging the Secure Enclave, and one is an OS hardening technique.

Security is about increasing the cost and time it takes to penetrate a target. These recommendations are designed to do just that: They’d greatly frustrate and upset current ongoing jailbreak and malware efforts.

Continue reading “Three Recommendations to Harden iOS Against Jailbreaks and Malware”

Putting the 16GB “Pro” Myth to Rest

Apple’s latest MacBook Pro line is limited to 16GB due to energy (and likely heat) constraints, and that’s gotten a lot of people complaining that it simply isn’t enough for “real pros”. Ironically, many of the people saying that don’t quite fall into what many others would consider a “real pro” themselves; at least based on the target demographic of Apple’s “pro” line, which has traditionally been geared toward working professionals such as photographers, producers, engineers, and the like (not managers and bloggers). But even so, let’s take a look at what it takes to really pin your MacBook Pro’s memory, from a “professional’s” perspective.

I fired up a bunch of apps and projects (more than I’d ever work on at one time) in every app I could possibly think of on my MacBook Pro. These included apps you’d find professional photographers, designers, software engineers, penetration testers, reverse engineers, and other types running – and I ran them all at once, and switched between them, making “professionally-type-stuff” happen as I go.

Here’s a list of everything I ran at once:

Continue reading “Putting the 16GB “Pro” Myth to Rest”

San Bernardino: Behind the Scenes

I wasn’t originally going to dig into some of the ugly details about San Bernardino, but with FBI Director Comey’s latest actions to publicly embarrass Hillary Clinton (who I don’t support), or to possibly tip the election towards Donald Trump (who I also don’t support), I am getting to learn more about James Comey and from what I’ve learned, a pattern of pushing a private agenda seems to be emerging. This is relevant because the San Bernardino iPhone matter saw numerous accusations of pushing a private agenda by Comey as well; that it was a power grab for the bureau and an attempt to get a court precedent to force private business to backdoor encryption, while lying to the public and possibly misleading the courts under the guise of terrorism.

Continue reading “San Bernardino: Behind the Scenes”