LOCUS DEMENTIA

We have an RX4100 and a DX400 series Sentinel device in two separate networks. Every week I get an IPS hit on 78.137.100.54 for a buffer overflow: Watchguard IPS Notice I've ignored this in the past because I couldn't find much information about it. Plus, the IPS is denying it, so I didn't pay much attention to it. Today, though, I dug a little bit deeper.Turns out 78.137.100.54 is Star Wind, which is a virtual storage software provider (in Germany). https://www.starwindsoftware.com/ I couldn't find the offending header that was triggering the IPS. We don't track that level of detail in the IPS detection, unfortunately. That would be a nice thing to have. Why the WD devices are contacting StarWind on a weekly basis is unknown to me. I don't recall any disclosures about that activity when I bought these devices. We're retiring that RX4100 soon. It's network cards always go offline for no apparent reason. Other IT people have reported a simil...

The first track-back (reversal) I did was on some Japanese hackers who staged out of South America. Here's an excerpt from the log of the server they attacked: 200.165.33.242 - - [18/Jun/2006:19:16:50 -0500] "GET /cgi-bin/ikonboard.cgi HTTP/1.1" 200 51 200.165.33.242 - - [18/Jun/2006:20:32:28 -0500] "GET /cgi-bin/ikonboard.cgi HTTP/1.1" 200 62 200.165.33.242 - - [18/Jun/2006:20:32:34 -0500] "GET /cgi-bin/ikonboard.cgi HTTP/1.1" 200 6568 200.165.33.242 - - [18/Jun/2006:20:33:04 -0500] "GET /cgi-bin/ikonboard.cgi HTTP/1.1" 200 34 200.165.33.242 - - [18/Jun/2006:20:33:08 -0500] "GET /cgi-bin/ikonboard.cgi HTTP/1.1" 200 6564 200.165.33.242 - - [18/Jun/2006:20:33:14 -0500] "GET /cgi-bin/ikonboard.cgi HTTP/1.1" 200 34 200.165.33.242 - - [18/Jun/2006:20:33:19 -0500] "GET /cgi-bin/ikonboard.cgi HTTP/1.1" 200 6574 200.165.33.242 - - [18/Jun/2006:20:33:25 -0500] "GET /cgi-bin/ikonboard.cgi HTTP/1.1" 200 34 200....

Dear Mr. Perez, the CIA does not engage in "guesswork." To say on national news (CNN 12/12/2016, 12:02PM Pacific, COX channel 1031) that the CIA used "guesswork" to conclude that "Russians" were engaged in cyber-espionage to influence our electoral process is insulting to an army of people who have dedicated their lives protecting your right to say that they are engaged in "guesswork." This national concern with the FBI and CIA and their "counter" analysis of the cyber activity around the DNC/RNC "hacking," is a clear show of how the American public has lost trust in its intelligence community. I wonder when the mistrust of these organizations started. Could it be the way in which Hollywood has depicted them? I can't remember the last movie I saw where FBI cyber operations was portrayed in a positive manner. The FBI investigates crime. For crime to happen there has to be a victim. You could argue "liberty" an...

Today I discovered REX. This is the regular expression extract tool for splunk. As I stared at these syslog records I wonders, how can I get the IP addresses of that shiznit? rex was the answer. A simple rex for a WatchGuard log to get the allow/deny on a report: [the search] | rex field=_raw ".(? Allow|Deny)." Yes, that's a pipe, because you are piping the results through rex. Splunk just gets more and more fantastic. Alas, I am at 82% of my license. I'm going to have to fork over another G-note to expand my collection. It's worth it because I love to bask in the orgy of denial.

You should lock down your DNS. No machine should be calling out to the DNS upstream. You should setup a local DNS relay so that all DNS goes through that, and that machine can then relay upstream to the ISP DNS. That said, you may find one day that your box is calling out to DNS on 8.8.8.8 or 8.8.4.4. A quick ARIN lookup on those and you see it's Google. Turns out, if you are using Chrome, then you will see these DNS requests appear in your logs. Chrome calls up to 8.8.8.8 and 8.8.4.4 to check "internet" health. If it can't get a connection to those IP addresses then it boldly proclaims there is no internet connection.

You asked why I don't like to invest money into 401K and IRA funds. Well, I do. The problem with a 401K is in the government management and oversight. The small business I own is designed for heavy weight at the top of the salary scale as it's a Subchapter S corporation. That means all of the profit passes through to the principal shareholder at the end of the fiscal year. That pushes my income to very high levels sometimes, much higher than the employees. As a result, the audit on the 401K causes a reimbursement of funds to make it "fair." Every year I get a fat check back out of the 401K that I don't want. So what' the point of investing money into a retirement fund that refuses to grow past an arbitrary limit. it's a waste for me and so I don't put excess money into it. The IRA is another fun vehicle. There are limits on how much you can put into that type of fund. Then you have to hope that it grows. I have a Legg-Mason IRA and for about 5 year...

Some time ago, feels like years, my cousin's daughter proclaimed that she wanted to be a robot. She was 6 at the time, I think. Samurai Lucy probably knows the exact date of this conversation I had with my cousin, as it was on facebook. I told my cousin that her daughter was the greatest robot ever built. Indeed we are. Our soft bodies are cushions for the hard endoskeleton that keeps our body able to be rigid. We have control circuitry distributed throughout our bodies with a central computer. That central computer is controlled by an expert system that knows how to integrate signals and train several connected neural networks. We are the greatest robot ever built because we are self-locomotive. We create our own energy, don't need to get an external battery to replace old ones. Our computer is capable of work using single electrons and their quantum spin. Our ligature learns how to adapt to its environment, like those incredible Boston Dynamics [1] robots. We are the gr...

Today I added some add-ons to my splunk and did some sysadmin on the server. Restarted and noted the splunkd was not running. Ahh, well, that's typical. Starting the splunk daemon is easy enough: Start Splunk  - from the people who made splunk. There are two ways to start splunk, as you can read from above. One is to run the "splunk" process from your root shell after logging in. This will run splunk as root. The other is to use the nifty systemctl service script to daemonize the process. Prior to today, I had the same problem and ran the splunk process as root. This was foolish. If you happen to have once started splunk as root, and then successfully started splunk as the "splunk" user, you will find that your splunk login page is empty. You get the background picture, but no input controls. Damn. Google that, nada. Damn again. Today, I learned alot more about selinux and permissions and labels, so I investigated the "web_service" log (/opt/...

If you google "named custom logs selinux" you will find quite a bit of chatter about setting up custom logs outside of /var/log for DNS (named). These posts are interesting, but they tend to be run on posts about learning selinux and becoming an expert on named. What you need to know? If you have setup custom logging locations in your /etc/named.conf file, such as:     channel default_file {         file "/var/log/named/default.log" versions 3 size 5m;         severity dynamic;         print-time yes;     }; Then you will likely see errors like this in /var/log/messages: Oct 26 11:41:13 namedsvr setroubleshoot: SELinux is preventing /usr/sbin/named from write access on the directory /var/named/chroot/var/log/named. For complete SELinux messages. run sealert -l 6eab4aaf-e615-4ade-9e88-4efdc789eaf2 Then you run the sealert command as suggested by the very friendly selinux audit log and yo...

In Microsoft SQL Server you can hash using T-SQL [1] : declare @hash varchar(200) set @hash = '15174141714252' print hashbytes('MD5', @hash) This is a nifty feature, of course, because you can now send your passwords over the unsecured SQL connection and do your hashing on the server. Secure your connection [2] , please, before doing this. Note the use of varchar(200) in the code block. The Microsoft sample shows the use of nVarChar. Does it matter what we use? Turns out, yes. The code block above returns: 0x5B17965D4E33B04FD8848E536165D013 That is also the same hash produced using System.Encoding.GetBytes(blah) and the .NET MD5 digest provider. If you opt to use nVarChar: declare @hash nvarchar(200) set @hash = convert(nvarchar(200), '15174141714252') print hashbytes('MD5', @hash) You will get something different: 0xBA48394E1385A2C633AB7F8339231B56 nVarChar and nChar use Unicode encoding [3] to process the string bytes. The default ...

Pull up Bing (www.bing.com) and search on "Hack Fund." There you will see the PureFunds ISE Cyber Security ETF [2] . This is an exchange traded fund [1] , meaning that a constellation of computers is constantly monitoring this fund's price and making long and short positions to take micro profits all through the trading day. The fund is made up of security technology companies who are directly involved in the infosec world. You will have to become an investor in the fund to get the full prospectus of the funds that are being traded. On the PureFunds web site [2] you can see the top 10 holdings in the fund, such as IL, SAIC, PFPT, FTNT, SPLK. Wait, Splunk? Indeed, the log file analysis company, Splunk, Inc. [3] , is part of the HACK fund. That's an interesting addition to the fund. This post is not about the analysis of the holdings, but rather a warning about the fund. Recently Kaspersky Labs claimed to have been hacked by external "nation state" hacke...

I have had an Apple device in my life since 1990. My first Apple computer was a Mac SE which was my second computer, the first being a Commodore 64. The Mac SE was a beautiful design, smoother, encephalon like form that was entirely contained. It was the second generation of Apple's unified hardware design, something copied only in the mid 2000's by Hewlett Packard. When Steve Jobs left Apple in the 90s we saw a diversion in Apple's aesthetic designs. They moved away from the unibody computer and moved forward with the pizza box architecture that plagued the IBM PC/x86 world. They still had the characteristic platinum coloring of their units, but now you had a bunch of boxes that ran Apple software. It all stopped looking like Apple. Jobs continued with his own aesthetic designs at NeXT, but that did not go well. While he tried to realize the greater encephalon design (that's a computer that looks like a head, by the way), the software didn't have the stability t...

Every person who is a customer of private banking agrees that banks are corrupt entities. We all say that because they charge senseless fees and spill out busy talk that nobody understands except used car salesmen. Yet, has anyone ever tried to quantify a case of RICO [1] against a bank, or the banking industry at large? We are going through a refinance transaction on our house. There are two mortgages to refinance. The first is the larger of the instruments and is the target of our refinance transaction. The second is serviced by another bank and is much smaller than the first. The second is termed the "subordinate" loan [2] . After approval of the new loan we were informed that there is a fee that must be paid to the subordinate loan servicing bank for the bank to review the terms of the refinancing agreement. In this case, the fee we must pay is $250 [3]. I complained to the "mortgage consultant" that is refinancing our loan and he conveyed his equal disdain...

I am a developer. Today, I hooked up the device log to my android tablet which has Cut The Rope on it (Zeptolabs). Surprised, I found a curious series of log entries: 01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.djinnworks.StickmanBaseJumper.lite 01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.duckduckmoosedesign.ibs 01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.facebook.katana 01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.fandango Furthermore, it even sends application usage information: 01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): CommManager: processesRequest() [threa...

Before you read this, you need to download the accounting spreadsheet from IRS: IRS Accounting Spreadsheet You want to click on the "2010" link as that is the most current data. After you download the XLS file, open it and see the Table 29 "Collections, Costs, Personnel, and U.S. Population, Fiscal Years 1980 - 2010". For each 5 year span marked in the table: 1980 - 1984: 24% increase in tax 30% increase in IRS cost ($998M) 4% increase in population 1985 - 1989: 27% increase in tax 31% increase in IRS cost ($1.597B) 4% increase in population 1990 - 1994: 17% increase in tax 25% increase in IRS cost ($1.804B) 5% increase in population 1995 - 1999: 28% increase in tax 11% increase in IRS cost ($879M) 5% increase in population 2000 - 2004: 4% decrease in tax 15% increase in IRS cost ($1.497B) 4% increase in population 2005 - 2010: 3% increase in tax 16% increase in IRS cost ($1.955B) 4% increase in populatio...

I have a daughter who is a freshman at George Washington University. She has been in school for about 59 days now. For the last two weeks, we have gotten several appeals for more money on her "GWorld" spending card so that she can "eat." When she started school, her GWorld was funded with $1,000 and her Dining Dollars account was given $700. That's $1,700 to spend on food and sundries. After 59 days of school, and an infusion of $200, she is down to about $300 overall. We are able to get the transaction breakdown of her spending, which allowed me to come up with some metrics. Being female, she needs makeup and other girl things from a pharmacy store like CVS. To that, she spent $438, or roughly $7.42 per day. Being a hungry college kid, she spends most of her food money on carbohydrates and fast food from 7-11. To that, she has spent $745 or roughly $12.63 per day. Recently she discovered the magical elixer of caffeine, which comes in nifty packaging from Starbu...

The US GAO (Government Accounting Office) has published its audit of the federal reserve: Audit in PDF | Synopsis of Audit The audit shows the Federal Reserve Bank issuing $16 TRILLION in debt to banks and corporations around the world. Who authorized this release of US capital? The Federal Reserve Bank chairmen, such as Ben Bernanke. For the 340 Million happy citizens of the US, that $16 Trillion is about $46,376 for every citizen of the US. Remember back in the Bush Presidency where we all got a little check for $800, or $1200, or something like that as our "incentive" to go invigorate the economy? That little amount seems more like a slap in the face now. With $16T of cash, the US could have paid all of its debts and gotten China off of our back. Instead we continue to print paper with little regard to the consequences because the people in charge of said currency are not governed. We, the people of the United States, should be in charge of where our money is lent. ...

This is the configuration description for a Gateway 823 autoloader (LTO-3 8-tape loader): define tapetype GW823 { comment "Gateway 823 LTO3 Tape Autoloader" length 447129 mbytes filemark 6342 kbytes speed 38069 kps } This was generated using the amanda configuration utility against the loader and having the loader attached to an HP DL180 G6 with an LSI LVD SCSI card.

Today I noticed an odd little quirk about TSQL (Microsoft SQL) and SQL Server. If you have a smalldatetime, you only record date + hours + minutes. To get seconds, millis, and such, you need the full datetime. Well, if you are using "getdate()" to compare against the smalldatetime, then know that smalldatetime rounds the seconds UP to the next minute. The smalldatetime on 12:36:24.00 is actually 12:37:00.00. This caught me today in a query where I was doing a select looking for a record that occured after the last insertion time (smalldatetime) using "getdate()". That was always returning empty because the getdate() to smalldatetime conversion was giving me a date that was in the future thanks to the round-up behavior. To work around it, I had to convert(smalldatetime,getdate()) and then compare against my smalldatetime values. If you are inserting records with smalldatetime and using getdate() as the smalldatetime value, then those records will be recorded up to 1 ...

I was a subscriber to the AT&T Uverse service for a little over 2 years. In that time, we had experienced good service for the first year, and then it sucked. After 12 months, or there in, the service degraded quickly, and would stop working all together at times. At first it would die for a short period of time, usually when we were not home. Then it would get progressively worst, until there was an entire week of no service. We had technicians at the house trying to fix the service, but it would repeat the behavior quite consistently. On January 15th we finally gave up and switched to a lesser service, COX TV and Internet. In the past we had cable service and it was always reliable, but not as good as the AT&T digital service. COX doesn't have nearly as many HD channels, but that's not enough. We needed internet to be reliable, and AT&T couldn't deliver that. Cancelling the AT&T service was a nightmare. Try to find anything about such things on their web s...