I only read USAToday on the can in hotel rooms. This morning I read something that I knew was going on but didn't want to face. This is important stuff. America cannot hold the moral high-ground without checks and balances.

Apparently, the NSA is most interested in the "Social Networks" that who you call when exposes. I wonder if they have mapped our social network yet ;) The other thing that concerns me about this is that the NSA basically provides their data mining service to other branches of government.

The America I know and love is in jeopardy. We must hold our leaders accountable for their actions, insure transparency and preserve checks & balances in government!

Only Qwest Didn't Capitulate

I will not be able to make it to Interz0ne this year. I have been out of the country for a month and need to tend to things at home. Black Hat Europe was great. FX rocked the house and the Skype presentation was worth the price of admission.
-angus

Reports have been circulating about pirate radio feeds of the new Sirius Howard Stern Show. Howard is not talking much about it.

I have my own theory. I personally do not think this is a coordinated effort by pirate radio broadcasters. Rather, I think it is large numbers of personal Sirius radios in their home docking stations. In areas like New York City, there would only be so many FM channels available to re-transmit the Sirus feed. This could lead to conscious or unconscious Synchronized Saturation, proving a clear FM signal to anyone who wants it. It would be very easy to light up an area even if you only a handful of common off the shelf Sirius radios. This in fact could allow the FCC to get involved. It should be a very interesting space. Remember how they got Al Capone?

Angus is heading to SHMOOCON this weekend. He will be checking out Hack or Halo. We are getting our calendar together for 2006. If you know of event that we should sanction or attend please email ANGUS at HACKSEC dot org

SHMOOCON

I hit this page tonight and noticed a bunch of sql errors. Might want to have that thing looked at.

Bug Me Not Buggy?!?!?!

Media Hype? What is up with CNN? They are like the only one's that got hit and are spinning this way out of control. Idiots!!!!

Wired has done a great interview with Mike. It should clear up a number of the questions people have had with recent events.

I would like to specifically point out one part of this interview:

WN: So ISS knew the seriousness of the bug.

Lynn: Yes, they did. In fact, at one point ... they apparently didn't get it, and they actually wanted to distribute the full working exploit very widely inside the company.... I was told ... "Give this to all the sales engineers and to all the pen testers."

WN: Why would they want you to do that?

Lynn: Well, because it bruises Cisco, remember? Mind you, this was something that Cisco hadn’t gone public with yet and that's not useful to pen testers because what do they advise their customers to do (to protect themselves if no information about the vulnerability has been released yet)?

I told them, "You do realize if you do that, it's going to leak?" And (one of the ISS guys) says, "That's Cisco's problem." And then (another ISS guy) turns to me and says that they need to understand this could be their Witty worm. I was like, Whoa, what meeting did I walk into?

(The Witty worm was a particularly aggressive and destructive code released by someone last year that targeted computer systems running a security program made by Internet Security Systems and even more specifically targeted military bases using the software. It infected more than 12,000 servers and computer systems in about an hour. Because of the worm's speed in spreading and its creators' apparent knowledge of who ISS' customers were, some security experts speculated that someone working for or connected to ISS might have been responsible for writing and releasing it.)

At that point, I told them all no, and they fought it and I resigned right there on the spot. And this was about a month ago.

I thought they were handling this in a non-ethical manner. Because it was just way too fast and loose with who can see this.... I mean, I don't even want people to see it now. (ISS talked him out of the resignation by agreeing to give him control over who could see or have the exploit.)

All I can say is WOW. A big "wow". Caps, bold, and feeling.

Anyone who says that Mike is not on the level needs to reference this. This says truly horrible things about ISS. This should cost them some serious reputation capitol.

One thing that Mike did a great job of in this interview is getting the idea out that in order to defeat the "bad guys", you must run faster then them. It is the only option.

Case in point, via the Wall Street Journal:

"The vulnerabilities are out there on the Net in full broadcast mode," said Gilman Louie, a tech-industry veteran who heads In-Q-Tel, a venture-capital firm backed by the Central Intelligence Agency. "The bad guys get to it faster than everybody else. I'd rather have disclosure and let everybody respond."

Disclosure is a great thing, but it must be done properly. I would argue that Mike did it properly. I would argue that he has displayed the best kind of ethics through this entire mess. Given the content of this Wired interview, I would argue that ISS has its head up its ass.

Router Flaw Is a Ticking Bomb | Mike Lynn Has Integrity^3

What follows is my take on “Ciscogate”, the uproar over researcher Michael Lynn’s presentation at this year’s Black Hat conference, in which he revealed that he was able to remotely execute code on Cisco routers. I have been representing Mike during this crisis, so I’m clearly partisan, and what I can say is limited by attorney-client responsibilities. But while many people are speculating about the facts, there hasn’t been much on the law, which turns out to be really interesting.

Jennifer Granick has posted the first installment of the story about her representing Mike. Its very rare you get to hear the take of a case like this directly from the lawyers involved, so this is a treat.

Earlier I suggested that everyone leave a comment on Jennifer's blog thanking her for representing Mike. I'd like to renew that suggestion. Thanks Jennifer!

After reading this, you might want to check out this collection of comments on Cryptome about the situation. It includes links to pictures of the presentation Mike actually gave, as opposed to the one that is floating around.

And seriously don't miss the truly excellent video floating around of the Cisco temp-workers slicing the materials out of the conference booklets. You can get it here or here.

The Shout | Jennifer Granick | ISS and Cisco v. Granick’s Gambling Plans

This would be cool if it weren't so scary!

iRobot Security Position

This Slate article describes a brilliant and obvious exploit for flying on someone else's ticket. Scary stuff. BTW: Delta currently uses the same system described in the story.

The not so friendly skys