Monday, August 7, 2017

Medical CAT scanners hackable from the Internet

It seems that these have web servers (strike one) that are Internet-accessible (strike two) that have an unmatched vulnerability that lets the Bad Guy run any code they want on it (strike three):
Hackers can exploit trivial flaws in network-connected Siemens' medical scanners to run arbitrary malicious code on the equipment. 
These remotely accessible vulnerabilities lurk in all of Siemens' positron emission tomography and computed tomography (PET-CT) scanners running Microsoft Windows 7. These are the molecular imaging gizmos used to detect tumors, look for signs of brain disease, and so on, in people. They pick up gamma rays from radioactive tracers injected into patients, and perform X-ray scans of bodies. 
US Homeland Security warned on Thursday that exploits for bugs in the equipment's software are in the wild, and "an attacker with a low skill would be able to exploit these vulnerabilities." That's because the flaws lie within Microsoft and Persistent Systems' code, which runs on the Siemens hardware, and were patched years ago. 
The patches just didn't make their way to the scanners.
Of course not.  Patches?  We don' need no stencil' patches!

After all, making an Internet playground for shady Black Hats, all inside a huge X-Ray control system - what could possibly go wrong?


Lawsuit says Disney apps track kids without parent's permission

This seems pretty important:
Disney has been sued in America for allegedly collecting children's personal information without getting parents' approvals. 
A class-action lawsuit [PDF] filed Thursday in northern California accuses the unstoppable children's entertainment brand and three of its developer partners of violating privacy laws by tracking the locations and activities of kids who use their mobile games – without first asking parents to approve the activity. 
Named plaintiff Amanda Rushing is suing on behalf of herself and a class of all parents whose kids played "Disney Princess Palace Pets" and 42 other Disney-branded smartphone and tablet games that allegedly run afoul of the Children's Online Privacy Protection Act (COPPA). 
According to the suit, the Disney apps for both iOS and Android do not ask for parental permission before they use software development kits that assign unique identifiers to users and then use those identifiers to track the location of the users, as well as activities in-game and across multiple devices. The data is then fed to advertisers to serve up targeted ads.

Sunday, August 6, 2017

Now that is marketing


Well played.

Modest Mussorgsky - Pictures at an Exhibition

Late 19th century Russia saw a rebellion against the French influenced culture imported by Czars from Peter the Great through Catherine the Great and beyond.  Artists sought a return to Russian roots.  A group of composers called "The Five" (Mussorgsky, Nikolai Rimsky-Korsakov, Alexander Borodin, Cesar Cui, and Mily Balakirev) formed a loose confederation aimed at the creation of a specifically Russian form of music.

The sudden death (at quite a young age) of Viktor Hartmann (one of Mussorgsky's friends) resulted in an exposition of Hartmann's paintings.  Mussorgsky was inspired to compose a suite of ten movements based on scenes from Hartmann's memorial exposition.  While many of the paintings were done while Hartmann was outside Russia, Mussorgsky's music is perhaps the quintessential Russian music.  Arguably, it approaches the Platonic ideal of Russian music.



Emerson, Lake, and Palmer recorded a version of this in 1970, on their album "Pictures At An Exhibition".

Saturday, August 5, 2017

The World is Full of Magic Things - A Brigid Guest Post

The world is full of magic things,
 patiently waiting for our senses to grow sharper.”
― W.B. Yeats

As I grew up, I took better notice of the world around me. That kept me alive more than once, when looking away might have meant my day ending in an explosion of surprised pain.  I might not be the youngest or the most fit in the group, but when need be, I can fire out of a dangerous place as if stuffed with powder, or fight back.  It's perception, it's nothing more than awareness of things around you, when to take cover and when to take flight. You learn through time, or by staring at your reflection in the weapon of your own destruction.  I see the little things, I'm trained to, yes, but I try and look past the obvious into the shadows.

It's not just situations, it's not just  people, it's words.  Politics will teach us, if anything, that words are just that, words, and without any sort of commitment to their substantiation, they mean nothing. Words not just spoken, but crafted and spun and spun yet again until they are as lightweight and meaningless as brittle thread.
Simple words, but words that bear power.  Remember the big fuss when Crayola had to get rid of the crayons we all colored with for generations, one called "Flesh" because it was a light shade, the color of Caucasian skin.  Like "Indian Red" it was soon sent to the bin of obsolete colors. Flesh, certainly, is every hue and shade, but what the word brings back is whatever you bring to it, that small exposed place on the inside of the wrist just below a cuff of blue shirt, the shadow there beneath the nape of the neck, where the hair is as soft as down underneath your lips as you slip down into colorless dark.

Indian Red.  For me that does not bring to mind a Native American, but the fire, the variated sky of the desert, the hues of life and death.  It is the color of nature's power and the deceit of man's ego, which not only rises but sometimes sets, on crimson holes in a ravaged shirt, that bloomed like sudden flowers in the darkness.  It is  the color of muddy, bloodied ground, from which the soul strives to leave before being pulled beneath it forever. It is the color of a sunrise in your lovers eyes, the light of hope and given promise.
Words, just words, that bring to them meaning which is yours alone.

A person is more than their words, and more than their form.  As a woman, not just a mother, I hate to see the images being given to our daughters, in word, in pictures, as to what is "beautiful".

Models in magazines aren't just thin and pretty but they have every single pore and "imperfection" photo-shopped away.  Wrinkles aren't a badge of a life well lived, but yet another thing to be blurred by a computer, and heaven forbid we be a healthy weight, as apparently if you're not a size zero you should just go buy your Muumuu and hide at home..

How did we reach such a place where what is considered beautiful or desirable is defined by a magazine?  You must be this thin, you must be this age, this shape; you must be this tall to ride the ride.  And I watch, we watch, as a nation of daughters starve themselves into an image that was never their perception of beauty, only their perception of belonging.  Men can be no different, for that pain of  unrealistic expectations knows no gender.
It's a sad world indeed, when we care more about how someone looks than what they can create. When one's worth is based upon what they can give us in our lacking, not what they are. But we are the population that, for the most part, would rather watch the talentless of reality TV than pick up a book written two hundred years ago that is still sold today.  Who among them, has ever experienced sitting in quiet with such a book, as words come swift and secret in the night, dressed in garments of longing and lust and greed and triumph, the likes of which no episode of reality TV would even scratch the surface of.

It's perception. It's how you look at the world and how much of the world out there, hidden away from prying eyes, you take the time to really look at.  To many - a life lived is little more than breathing, pleasures and darkness. To others it is a richly layered landscape of both risk and reward.

Two different people looking at the same thing will never see it the same way. Standing at a Western art show looking at works representing bygone eras,  I'm entranced by a one particular painting,  It is a simple one of an older woman on the prairie wearing clothing from a bygone era.  A young woman next to me gives it a cursory glance and says - "old woman in ugly dress, moving along".
I look at it and see so much more.  The woman in the painting is not twenty, nor is she beautiful by today's standards.  The artist has her in a shapeless dress, the dark colors of which could represent widowhood or mourning. but do not still the hunger of the flesh that's there in her eyes.  I do not notice her fashion choice or her form, only hinted at under the voluminous folds of faded fabric.  I simply see a face calm in what had to be an era of great suffering, I see hands that can weave cloth, cook, plow a field or bury a stillborn baby, standing there in the painting, much as the guide was in this auditorium, steadily watching and waiting for what life still remained.

The dilapidated farmhouse behind her looks empty, the land is covered in dust.  There are no children or others around her, just her form, standing straight and tall looking off to the horizon.  There is no history as to what the painting represents. but looking at it, I see her not as a woman approaching middle age, but the form of a butterfly as it emerges from the cocoon, carrying nothing of what it was into what it is,  emerging complete and intact as the wild rose that suddenly blooms from barren soil.
"Old woman in ugly dress".  I shudder to think how little the younger generation may really see, beyond what's on their smart phone or current "selfie".

But among my generation we can be just as nearsighted.  Some people would look at a small safe in which lie several new and historical firearms and simply see "gun nut!" (often muttered with the same tone as "shark!").  Others would see money that could have been given to others, as how selfish to actually wish to enjoy the fruits of my years of hard work.  Others will see what I do, tools of value and defense, of which I am the custodian of their careful use, just as I am the custodian of the world I carry around inside me.
I finish up preparing for my day, gathering up notes on what has been torn apart, and set them under a stone. It's a rough piece of rock, that when cut in half, would reveal the most incredible colors.  Look closely, look deeply.  There's a dark purple so rare, that for a commoner in ancient times to don it, would be on pain of death. There's startled jays of blue, soft pinks and whites that flower from within, the color of flesh, dripping from limbs like paint, forbidden fruits, their taste only a memory as you trace the emotion of those hues with the tip of a finger

To some, this would simply be a "rock", never turned over, not examined closely, never revealing that beauty that emerges when it has been cut.  To not see that, to not know that, will be their loss.

I turn the desk light off, as the morning sun vanquishes the darkness, wondering too, if these words will be just words, spun off into the dark.  But it's enough to know, that, which I've learned through the years, that seeing and hearing are both blind and deaf, but the well worn heart can see that which is absolute magic.
 - Brigid

Alabama - If You're Gonna Play in Texas (You Gotta Have a Fiddle in the Band)

The Queen Of The World and I went to a 1980s party at the local Harley HOG chapter last night.  The Queen's "Madonna" outfit wasn't helped by her knee brace (or the crutches she's been on since the surgery), but she was a real trooper.  I did my best Don Johnson, but she clearly outshone me.



But when you think of the 1980s and Country Music, you have to think about Alabama.  They had 27 #1 hits in that decade and 7 multi-platinum albums in that decade, and were named the artist of the decade by the Academy of Country Music.

This was one of my favorites.  It's just fun.



Alabama - If You're Gonna Play in Texas (You Gotta Have a Fiddle in the Band) (Songwriters: Murray Kellum, Dan Mitchell)
If you're gonna play in Texas,
You gotta have a fiddle in the band
That lead guitar is hot,
But not for "Louisiana man"
So rosin up that bow for "faded love"
And let's all dance
If you're gonna play in Texas,
You gotta have a fiddle in the band 
I remember down in Houston
We were puttin' on a show
When a cowboy in the back stood up and yelled,
"Cotton-Eyed Joe"!
He said, "we love what you're doin'
Boys don't get us wrong,
There's just somethin' missin' in your song 
If you're gonna play in Texas,
You gotta have a fiddle in the band
That lead guitar is hot,
But not for "Louisiana man"
So rosin up that bow for "faded love"
And let's all dance
If you're gonna play in Texas,
You gotta have a fiddle in the band 
So we dusted off our boots and put our cowboy hats on straight
Them Texans raised the roof when Jeff opened up his case
You say y'all all want to two-step. you say ya want to doe-si-doe
Well, here's a fiddlin' song before we go 
If you're gonna play in Texas,
You gotta have a fiddle in the band
That lead guitar is hot,
But not for "Louisiana man"
So rosin up that bow for "faded love"
And let's all dance
If you're gonna play in Texas,
You gotta have a fiddle in the band 
If you're gonna play in Texas,
You gotta have a fiddle in the band
That lead guitar is hot,
But not for "Louisiana man"
So rosin up that bow for "faded love"
And let's all dance
If you're gonna play in Texas,
You gotta have a fiddle in the band

Friday, August 4, 2017

Next, I guess it will be Watermelon-on-the-cob


What do you get when you cross a fish tank with a computer?

You get a target for hackers:
Hackers are constantly looking for new ways to access people’s data.Most recently, the way was as simple as a fish tank.
The hackers attempted to acquire data from a North American casino by using an Internet-connected fish tank, according to a report released Thursday by cybersecurity firm Darktrace.
The fish tank had sensors connected to a PC that regulated the temperature, food and cleanliness of the tank.
“Somebody got into the fish tank and used it to move around into other areas (of the network) and sent out data,” said Justin Fier, Darktrace’s director of cyber intelligence. 

The Internet of Things and computer controlled everything is a bigger risk for corporations and governments, because they have more data that is worth stealing.  I know people who did "White Hat" penetration tests (hired by the Casino to check their security) who got into the main network via the Ethernet that was hooked up to the minibar in the room.  That was at least ten years ago

Thursday, August 3, 2017

Have a Flinging Friday - A Brigid Guest Post

The neighbor's teenagers playing their music too loud as they come up the country road? The same youngsters gathered around, smoking cigarettes upwind of your property just because Mom and Dad aren't home?

Forget that sissy method of telling them keep it down, which will instantly label you "old geezer". Just get yourself a trebuchet.

After all, nothing says "pipe down" quite like a rotten sheep carcass on fire arcing over the back fence onto their stereo.


We've got combines and tractors, corn and trucks. But looking around the countryside there aren't enough trebuchets out here.

In those boring days before gunpowder, folks had to come up with other methods of tossing death and destruction at each other. They started by simply throwing rocks at one another, advancing to flinging giant stones, and then to hurling a few boulders. Street crime was probably not a problem, Imagine some thug coming up to you on the street and saying "catapultum habeo. Nisi pecuniam omnen mihi dabis, ad caput tumm saxum immane mittam."(I have a catapult. Give me all the money or I will fling an enormous rock at your head).

But as a weapon of warfare, they have been around a long time. Being half Scandahoovian I was curious as to when they reached the Vikings. The Vikings may have known of them at a very early stage, as the monk Abbo de St. Germain reported in his epic De bello Parisiaco (time frame 890) that engines of war were used on the siege of Paris. Nordic people or "the Norsemen" were documented as using engines of war at the siege of Angers as early as 873. The trebuchet is essentially a gravity powered energy conversion machine, turning potential energy into kinetic energy and using it to throw something of mass.

The counterweight trebuchet appeared in both Christian and Muslim lands around the Mediterranean in the twelfth century, flinging projectiles weighing several hundred pounds at high speeds into enemy fortifications. Fortifications had evolved over the course of the Middle ages, the most well recognized being the castle. The castle served as a protected place for the local elites (sort of like Congress). Inside was refuge from armies too large to face in open battle. The ability of the heavy cavalry to dominate a battle on an open field was useless against fortifications. The siege engine was then further developed and honed.
In June and July of 1191, Richard the Lionheart (the Duke of Normandy) laid siege to the city of Acre as part of the medieval Crusades.

The Duke concentrated on constructing siege machines and placing trebuchets (literally, stone hurler) in suitable places. He arranged for these to shoot continually day and night. He had one excellent one which he called "Bad Neighbor" (Malvoisine). The constant bombardment shattered the Cursed Tower after breaching the city walls. On one side the Templars' trebuchet wrought a frantic devestation, while the Hospitallers trebuchet hurled and hurled, to the abject fear of the Turks. Besides these, there was a trebuchet that had been constructed at general expense, which they called "God's Stone-Thrower". (Which was much more effective than the Holy Hand Grenade of Antioch). A priest, a man of great probity, always stood next to it preaching and collecting money for its continual repair and for hiring people to gather the stones for its ammunition. This machine at last demolished the wall next to the Cursed Tower for around "two perches' Length" (10-11 yards ). *

Range and size of the weapons varied. In 1421 the future Charles VII of France commissioned a trebuchet that was said to have been able to shoot a stone of over 1500 pounds but that was not the norm. Rate of fire could be noteworthy: at the siege of Lison in 1147 it was said there were two engines were capable of launching a stone every 15 seconds. (my question? How to you reload those babies?)

Many times trash and debris were lobbed over castle walls to rain down upon unsuspecting masses or invading armies. On occasion, disease-infected corpses were flung into cities in an attempt to infect or terrorize the people under siege—a medieval form of biological warfare.

Then gunpowder was invented and rock warfare became passé quickly, with the trebuchet losing its place as the siege engine of choice to the cannon and later, firearms.

Thinking now you want to make your own just to supplement your weapon collection? You can start by getting one of these wooden war engine kits from ThinkGeek.com that let you bring back all the fun of flinging. Each one can assemble in just a few hours, and provides a fantastic scale model of an actual war weapon of yore. ThinkGeek suggests starting with a few lobs of paper over the cubicle wall at your coworkers. But it's said that the trebuchet is better for long range targets (like the network printer). It's not intended for kids (yes you can put your eye out with this thing) and if you lob a flaming Bic lighter reinforced with thumbtacks at the boss you are likely to be fired.

There is a desktop application out there where you can configure mass, arm length, and length of flail to create and fling masses from a virtual trebuchet. Unrealistically, however, it can be manipulated so that your stones could achieve escape velocity.

It sounds like all kinds of fun in any case. For a small price, you can order Wooden War Engine Kits to lend a medieval flair to any office warfare arsenal. The Catapult Kit is rubber band powered (not included) and can hurl paper balls and other small items approximately 10 feet.

The ThinkGeek Trebuchet Kit is counter-weighted by 78 pennies (also, not included) and has a range of around 20 feet. Both kits are pre-cut and pre-drilled, and require gluing during assembly. All you need to put these little ones together is strong fingers, a cutting tool and the glue. But you can go bigger for an additional cost that's not much more than a box or two of .45 acp hollowpoints.

Here's a Floating Arm Trebuchet that you can build.Also Pre-cut and pre-drilled, with computer cut pieces for tight engineering, this is a functional model standing 34" tall, 18" long and 12" wide when built. The guillotine-action and a plunging beam can hurl a golf ball over 200 feet. Nice! It has detailed instructions complete with diagrams and equations for calculating the machine's efficiency with lots of photos.

You can't hide this in your cube, but you can take take it out on the deck.
I think I have an idea for our next cookout.

* From the 13th century writing: "Itinerarium Peregrinorum et Gesta Regis Ricardi"

There otta be a law?

I'm a little conflicted about this:
Lawmakers in the U.S. Senate today introduced a bill that would set baseline security standards for the government’s purchase and use of a broad range of Internet-connected devices, including computers, routers and security cameras. The legislation, which also seeks to remedy some widely-perceived shortcomings in existing cybercrime law, was developed in direct response to a series of massive cyber attacks in 2016 that were fueled for the most part by poorly-secured “Internet of Things” (IoT) devices.
Mostly, I don't think that there should new new laws for almost anything.  But readers know that I've been ranting about the lousy security of the Internet of Things for a long time (I see you roll your eyes at me).
The IoT Cybersecurity Improvement Act of 2017 seeks to use the government’s buying power to signal the basic level of security that IoT devices sold to Uncle Sam will need to have. For example, the bill would require vendors of Internet-connected devices purchased by the federal government make sure the devices can be patched when security updates are available; that the devices do not use hard-coded (unchangeable) passwords; and that vendors ensure the devices are free from known vulnerabilities when sold.
This seems to me to be exactly the way to approach this.  The Fed.Gov buys a bunch of stuff, so much that they can (and often do - see FIPS 140) get companies to add security to their products.  After all, the Fed.Gov doesn't have to buy anyone's products if they don't think they're fit for purpose.  Since a lot of IoT products are based off of the same software stack, there's a good chance that a lot of consumer products would pick these up since it's cheaper for the companies to support a single stack for everything, rather than a government one and a consumer one.

And then IoT companies will start competing with pure consumer competitors based on security.

All in all, this seems like a reasonable approach.  It's a carrot, not a stick.  Hard to see how it would make things worse.

Wednesday, August 2, 2017

Don't use your debit card anywhere except your bank's ATM

I've liked to use my debit card - it's like cash, only without the bother of carrying around cash.  It turns out that this is getting dangerous - "Skimmers" are devices that thieves add to point of sale cash registers and to ATMs that record the Debit card account number and PIN.  The thieves then use this to clone ATM cards and drain bank accounts.

Skimmers are getting quite sophisticated and can send data via cell phone text message (i.e. to thieves anywhere in the world).

Brian Krebs has a hair raising post about how these work and you should definitely read the whole thing.  Gas pumps in particular are being targeted, but this could be done anywhere.

Your credit card company will cover you if the Bad Guys swipe your card number.  Your bank will probably cover you, but it might take a while and you'd go through a whole lot of hurt until they did.  Use your credit card for purchased, and treat your debit card like an ATM card (and only use it at your bank, which will have much better security for the ATMs than other businesses will).

Another "benefit" of "green" power

South Australia has committed to "renewable" energy to a degree that is not seen anywhere else on the planet.  So much power comes from solar and wind that the electricity grid has become unstable, with a massive state-wide blackout last year and ongoing fears of a repeat.

Well, the Experts have come up with a solution - shut down a car plant and throw 13,000 people out of work.  Alas, this is no panacea:
South Australia's forecast maximum operational demand, which usually occurs when air-conditioners kick in on very hot afternoons in summer, is expected to fall to 3,035 megawatts by 2021-22. 
The current maximum demand is 3,116MW.
Nevertheless, AEMO is forecasting widespread shortfalls of reserve power over the next two summers, prompting the State Government to invest in temporary generators.

There must be some more good paying jobs that can be killed off to usher in the Green Rapture.

Tuesday, August 1, 2017

Obvious (and some non-obvious) hacks

Great article by Rob Graham on some of the classic hacks, why they exist (bad programming, mostly) and which may not be possible to fix (social engineering a tech support line, for example).

This is some computer security inside baseball, but it's pretty accessible.  Read it, and you'll understand more about security than 99.99% of everyone.

Monday, July 31, 2017

Ten years of bloggy goodness

Earthbound Misfit has been at it for a decade now.  Stop by and leave her some commenty sugar.

There really is no "Dark Net"

So says one of the creators of the TOR network:
Roger Dingledine, one of the three founders of the Tor Project, castigated journos for mischaracterizing the pro-privacy system as a bolthole exclusively used by drug dealers and pedophiles to hide from the authorities. 
In fact, he said, only three per cent of Tor users connect to hidden services, suggesting the vast majority of folks on the network are using it to anonymously browse public websites for completely legit purposes. In other words, netizens – from journalists to activists to normal peeps – use Tor to mask their identities from website owners, and it's not just underworld villains. 
Dingledine even went as far as saying the dark web – a landscape of websites concealed within networks like Tor – is so insignificant, it can be discounted. 
“There is basically no dark web. It doesn’t exist,” he told his DEF CON audience. “It’s only a very few webpages.”
Interesting article.  I hadn't known that Facebook supports TOR.

If you care about Internet privacy, should should RTWT.

Sunday, July 30, 2017

Smile for the camera


Edward Elgar - Nursery Suite

A young couple who live in the shadow of Castle Borepatch have just been blessed with a newborn baby girl.  As a Royal command performance from the Queen Of The World, today's Sunday Classical is Sir Edward Elgar's Nursery Suite.

Sir Edward composed it in 1930 on the occasion of the birth of Princess Margret.  You see, Sir Edward was Master of the King's Music (sort of Royal Composer), so this was pretty much in his job description.  Diplomatically, he dedicated it also to Princess Elizabeth, now Elizabeth II Regina.

Saturday, July 29, 2017

Friday, July 28, 2017

Doofus of the Day

(Meme shamelessly stolen from Peter)

Don't honk at old ladies crossing the street ...



And Mercedes doesn't come off well, either - that little old lady set off his air bag.

Rest In Peace, Charlie Gard

Via Lawrence, we learn this sad news:
The parents of a terminally-ill British infant that has captured global attention on Friday said he has died. 
Connie Yates and Chris Gard said that Charlie Gard’s life had ended at eleven months old after battling a rare genetic disease.
This poor child's life became a political football, and while I have my own strong opinions it's unseemly to use him as a ventriloquist's dummy for scoring political points.

Instead, let us hope that the fullness of time will dull his parent's pain and all but their happy memories fade.  Rest in peace, little Charlie.
For you created my inmost being; you knit me together in my mother’s womb.
I praise you because I am fearfully and wonderfully made;
your works are wonderful, I know that full well.
My frame was not hidden from you when I was made in the secret place,
when I was woven together in the depths of the earth.
Your eyes saw my unformed body;
all the days ordained for me were written in your book
before one of them came to be.

- Psalm 139: 13-16