Simple Nomad's Blog
sep 2005 | oct 2005 | nov 2005 | dec 2005 | jan 2006 | feb 2006 | mar 2006 | apr 2006
21Feb2006 - PHX Trip
Well, on the road again. This time off to Phoenix overnight to speak at PatchLink 360. My employer Vernier has some kind of partner thing with them, so I flew out to give a talk about software vulnerabilities from the 3v1L h4XX0R perspective. In other words, I dressed up in my usual black garb and scared the suits, especially when I answered honestly.
Speaking of dressing funny, as I sat down to wait for my flight out to Phoenix, there were a couple of girls (not together) sitting near the power outlet all dressed in black looking all gothy. I walked up to take the seat next to the power outlet and said "so this is the goth section?" One girl looked up long enough to roll her eyes and the other said "what the fuck is that supposed to mean?" I replied "I'll take that as a yes" and took over the power outlet. Ah, nothing like bitchy angst. I just settled in and wrapped myself in the seathing hate they radiated. Thank god I am in first and they're in coach, since I'd hate to have to actually force them to deal with me in the off chance we sit next to each other. Oh well, odds are they will be seated next to the snotty-nosed kids on the flight whose parents apparently forgot their meds.
Anyway the talk went well enough. It was a small conference, and I was pleasantly surprised I managed to just about fill my room with 40 or so people. Considering there were only about 150 total attending, I consider that pretty good.
A funny thing that happened at the conference was that Dan Verton was speaking. Ok, that part isn't the funny part, but something that happened during the Q&A. He's written the book on the insider threat -- literally. So he gives this talk and I can't really yeckle him because PatchLink invited him out, my employer partners with PatchLink, so I have to behave. But the talk was filled with a bunch of FUD stuff. Apparently things are very scary and very dire. There were gems in the talk like (paraphrasing, but still pretty close) "if you have users you have data leaking out of your company right now" and "all surveys about data loss are shit, I wrote a BOOK on the subject and I INVESTIGATED everything so MY findings are what you should use". Seriously. Now considering that Mr. investigative reporter Verton was gloriously duped when fellow journalist Brian McWilliams bought an expired terrorist sympathiser domain to see if he got email from potential terrorists (he did) and Verton emailed McWilliams without "investigating" the domain. McWilliams found this to be fairly funny, and started replying to the surpreme Verton's questions with all kinds of crazy made up shit. Yes you already know the punch line -- Verton published a story for ComputerWorld on the conversation, convicted he had the scoop of the century, and McWilliams caught him with his pants down. There was an article from McWilliams on the subject, and a mortified and hugely pissed Verton had to print a massive retraction. McWilliams caught a lot of shit, but he exposed Verton for what he is -- a sensationalist.
So of course I wanted to ask the question "why should we believe your FUD when you fell for that stunt of Brian McWilliams? Does sensationalism sell a lot of books, or was this actually researched this time?" But I couldn't. However I had made the mistake that this crowd was full of docker-and-polo-shirt-wearing sheeple. After presenting FUD stories with examples from "large companies", no real method to stop the evil, and vague data to "back it up", one audience member besides me had had enough. The scheduled one hour talk finished after 30 minutes (hey PatchLink, I hope his speaker's fee was worth a 30 minute talk), so a rather long Q&A part followed. And one brave guy asked the following: "You are giving everyone all this supposed 'data' on the insider threat, and are telling a lot of scary stories. Are you actually going to offer a solution, or are you just trying to sell books?" BURN. He fumbled through a non-answer about NDAs and his inability to back up his statements as a result. The followup question involved, "can you give us some technical examples of how these insiders were bypassing security?" You know, just tell us how they were bypassing firewalls and proxies. Technical stuff. More NDA references and no real data or answer. So to sum up his talk -- scary shit is happening to you RIGHT THE FUCK NOW, there are NO SOLUTIONS, there is NO PROOF TO SPEAK OF, and the second edition of Verton's insider book should ship in a couple months, BUY IT IMMEDIATELY. Thanks, Dan. Your shit tastes like cotton candy -- may I have more because what a wonderful cook you are.
I was only in Phoenix overnight for the talk and back to DFW and home Wednesday night. Time enough to have sex, sleep, shit, shave, and shower, then back out to the airport for a trip to San Jose for work meetings. Another overnight trip and back late Thursday night. This is the modern hacker's life -- travel, coding, research, and stealing online access when and where you can get it. I sure wish Linux would get its shit together on the wireless front, since I am having to almost exclusively use Windows XP when travelling. Nothing wrong with that, except the more interesting research stuff happens on non-Windows XP, oh and I hate Microsoft on principle like I hate all large evil companies.
The home front is going ok. We finally finished the kitchen at the beginning of February. But right now I am without my car. It seems that the heater core went out and the passenger side filled with radiator fluid. The dealership wanted $700 to fix it, so Kim found a place that would do it for $275. The only problem is that they had the car most of last week, and since the "instructions from Kia were wrong" I have to wait until they can figure out how to install the fucking thing. And due to the travel, I can't get the car back until Friday. Asshats. The bad thing about this is it takes focus away from important things like getting the server room done (awaiting tile right now).