Be aware. Be afraid... DVT is real

It's been a while since I've posted. While the Hammerhead Research domain still exists, and the email is still active, I've not done active competitive intelligence research in about two years. Since then I've run a Cyber Threat Intelligence group for Northrop Grumman where my team and I chase very skilled attackers, attempt to understand/mitigate new threats and trends, and in general, keep a team of free-range thinkers producing really cool analysis products.

As you might imagine, a job like this requires travel -- not long distance, just a lot. I live in NH, work in MD, and fly to just about anywhere in the US that houses a Northrop Grumman location, partner, or customer. I'm not necessarily a million mile flier, but my card is Gold and the trips might range from a simple 2 hour flight to four or more.

So, on to the main subject of the story... Two weeks ago I flew round trip to LA, then home to MHT, to BWI a day later, New Orleans, drove to Mississippi, and then flew home. Three days later I flew back to BWI for meetings in the DC/BWI area and realized I had a low grade leg cramp in my lower right calf. I had no other symptoms other than the leg cramp and gave it no thought. I'm a black belt in karate. My legs are generally sore, sometimes with cramps. I figured with a couple of Tylenol the cramps would go away, so down go two Tylenol, followed by a quart or so of water and a One-a-day. The cramps went away.

Three days later the cramp reemerged.. no in two places. Again, no other symptoms other than the cramps, so back to the Tylenol, water, and multi. This time the cramp didn't go away. Just after noon I headed to lunch... two flights of stairs down, cross the street to another building, down one more to the cafeteria. The return trip to my office nearly cost me my life. After twenty minutes to recover and catch my breath, I packed up my laptop and headed to the emergency room. The CT scan revealed multiple blood clots had left my right leg moved north to the heart, passed through the pulmonary artery, and ended up in both of my lungs. I spent three days in the hospital on heavy blood thinners, followed by a re-admittance two days after release for another 48 hours. I'm told most people don't survive multiple pulmonary embolii. I'm lucky.

Why would I post this here? I found out that a colleague at another Aerospace company left a meeting we both attending (the week before I went into the ER). He left half way through to go the the ER with leg cramps. His never hit his lungs, but did pose a heck of a risk.. it was his second time.

I'm married to, and know several RNs. They tell me that most people die from this because they don't recognize the signs early enough. For me it was a cramp on the lower calf at the sock line and another behind the knee. For my colleague it was a cramp on the surface, painful to the touch, also behind the knee.

This is real stuff guys. Don't ignore the leg cramps if you're sitting or traveling for periods longer than an hour.

For more information, please take a look at:

http://en.wikipedia.org/wiki/DVT

http://en.wikipedia.org/wiki/Pulmonary_embolism



Jeff

MacWorld Expo -Totally Underwhelmed!

Yesterday I sat through part of a program on advanced functionality in OS X, and as a result posted my notes on my thoughts of OS X not being ready for enterprise. I stand by that. OS X still needs work in the remote administration of both clients and servers.

Today I had the (mis)fortune of spending my time wandering (aimlessly) through the exhibit floor looking for that one thing that would make me reach down, grab my nuts, screaming damn the wife and her stinkin checkbook, and just buy the thing.

Unfortunately, my nuts went ungrabbed and my voice never went above a moderate tone - barely audible enough to get over the crowd noise as I spoke with a truly unimpressive selection of vendors with as many new ideas as a stop sign.

I guess I should mention, one of the things I look for are security vendors, of which I could count on one hand. One cool item I saw was a tracking system for lost (stolen) computers, but after taking a few minutes became bored by the conversation which revolved around the owners thoughts on working with local law enforcement (yawn). I'm getting tired just thinking about it.

Some of the Apple tools were kinda fun though. I saw through piece of a program called "Geeks and Gadgets" in which I viewed a great demo of GarageBand -Apples computer-based music system. Unfortunately I was a Tuba player in High School and they didn't have the interface for a Tuba, nor do I have a Tuba..

Bottom line: Wanna buy a colored iPod holder? Colored earphones? A new case for your PowerBook? You could get them here. Want enterprise tools that offer solid administration? Nope, no chance. Come on guys. Innovation is a good thing!

MacWorld Expo Boston

3:00:

Sat in the Mac OS X Advanced Topics program for much of the morning and part of the afternoon. I keep wanting (desperately) to believe OS X can and should replace many of the servers in the datacenter today. They seem to have most of the required functions needed, but just can't seem to pull it together. It may be the need for more decision-maker OS X training, or it may just be the fact that most admins are well over the Windows learning curve, but as it stands, OS X just isn't making it to prime time enterprise.

Why would I say such a thing? Those of you who know me know I've been a Mac user for many years, and infact am writing this blog on my trusty old 15" G3 Powerbook. The problem is, as I look around the room and have conversations with the admins there, most of the users are small to medium sized enterprises, and the one medium size enterprise admin I talked to didn't have very much to say about OS X's ability to scale to true enterprise requirements. Although the servers have the ability to do all of the networking, functions, and do role based access quite well, there's still a delta in the remote management functionality.

Two sysadmins were used as examples -one operates a medium sized publishing company, with 1000 servers located across the country. The other is a small advertising agency with fifty users.

The first admin in the medium sized company offered two speedbumps, that in my security mind, would make the hair on my neck stand up screaming. First, all backups are local, to local RAID. OK, I'll buy that. How then do you do business contuity planning with local data stored locally? Answer? They don't. Second, with over 1000 servers in his network, he states they have no centralized management of all 1000! I know there's something wrong here. I asked about this because I was curious about how they handle things like updating antivirus signatures, firewall rules, and typically associated Mac functionality. The only centralized control is in the Mac networking capability, but security features are handled locally... ouch.

Interestingly enough the instructor was talking about remove managegment of config files. He recommended keeping text files on a local (client) firewire drive, and pushing them out to the servers are needed. His answer to remote administration was to simply keep one configuration, and modify the computer name and IP address as needed. Ouch again. This would be fine in a network with five servers, but what about the enterprise with 5000?

The second admin told me that he has fifty users, mostly running OS 9, and one OS X server, where he maintains 3Tb of storage for the images his users generate for clients. After a period of time, the images are moved from the 3Tb storage system to a DVD, and distributed back to the users.

I asked him 'What keeps you from moving to OS X enterprise wide?'..his answer, not surprisingly was the lack of ability to manage everything (including his 50 OS 9 users) remotely.

OK Apple. Two doesn't make a sample, but when I hear from two different admins that the speedbump in their path to enterprise-wide deployment is the ability to easily manage users and servers centrally and remotely, it makes me believe we're missing something.

-js

MacWorld Expo Boston

10:45: Arrived at MacWorld Expo about an hour or so ago and checked in for my Media Pass. I've signed up for tomorrows Mac OS X Server session on Advanced Concepts and Administration, to take advantage of the session on Security and Mac OS X Server. Should be a good session.

The schedule loooke interesting, although I'm a bit disappointed to not see a keynote from Jobs. I guess Boston just isn't that important. I'll let you know as the day progresses.

Jeff

Usenix Technical conference: Day 5 (Thursday)

The crowds seem to be slimming a bit today, presumably due to the happy hour hosted by the vendors last night, and the gameshow excitement generated by Mr. T during the followon hours. BOF sessions are numerous, and I would expect they're taking there toll on the attendees, who seem to want nothing more than sleep this morning. Unfortunately I missed the morning session due to heavy traffic coming into Boston (I've been commuting in from New Hampshire each day), but did have the opportunity to catch one of the more interesting topics of the week --Open Source Flight Simulator. Having had experience looking at both arial and satalite imagery, I was amazed at the level of detail provided by this package. OK, it had nothing to do with information security or system administration, but was none-the-less, a fun topic. This afternoon is a set of UseLinux Refereed Papers, followed by a session on "System Administration/General" or "Deploying the Luster Cluster File System". It actually makes me happy I've got a con call scheduled during that exact timeslot. This evenings session however looks to be fun --the Super User Linux Group --Usenix took the opportunity to invite any of the Linux folks in the local area to participate. All of the local user groups got invitations. Should be a blast. It'll be followed by a Linux BOF led by Mad Dog (can you imagine a guy calling himself Mad Dog, simply because he runs Linux?? There's gotta be more!)

Standby, more to follow.

Usenix technical conference: Day 4 (Wednesday)

I'm currently sitting in on an RSA talk about their concerns for privacy in the world of wireless, including what sounds like an all encompassing world of everything from RFID to 802.XX. They contend that the government should legislate how the wireless data should be used, how it must be stored. Frankly this "the sky is falling" idea that they're trying to push doesn't seem to be going over well in the audience. Three things come to issue in my mind..

-First how much of the research (and resulting talks) were designed to thwart competition from companies that use combinations of authentication and RF proximity to figure out if bad guys are attempting to gain access to a company's (or consumer's) wireless networks?
-Second, how different is finding RF from shortwave listening? It sounds like we they may be trying to re-eat an pre-digested elephant.
-Last, I'd be more interested in the security of the data after storage of data collected or passed via these networks. Is the database that manages the RFID inventory and consumer preferences at your local grocery store safe enough to handle your consumer preferences?

One of the scientists keeps telling the audience legislation is key. Hmmm. Doesn't HIPAA, SB-1386, S-OX... cover storage of privacy information?

It seems the audience has the RSA panel on the ropes... glad I'm not sitting up there.

GEER VS CHARNEY

Good matchup. Unfortunately, no blood, no sweat, no cage. The two were very professional. The audience was as well. Opening statements started off with Dan reading what I assumed was his paper on the monoculture of IT being a national security issue. Charney kicked off talking about his background in the Bronx with followon at Justice.

The two offered very good perspectives of each side of their respective coins. Good arguements from both sides. It seemed the audience, when given the opportunity to ask questions were more interested in jumping into the debate. Great job keeping them at bay by the moderator --with the exception of Dan's co-author.. who was debating anyway??

Regardless, the debate left the audience debating well into happy hour. Great job.

Usenix technical conference: Day 3 (Tuesday)

Great talk today by Eliot Lear from Cisco entitled "Network Complexity: How do I manage all of this?" Eliot discussed things like network discovery and the issues associated with finding devices into the high number range (10^8 devices for expanding enterprises for example), fault management, Workflow management, and commonalities of requirements for devices that can handle these problems. Identity Management, as expected was included in the discussion, and the problem of "consumers awash in keys".. great stuff. Nice job Eliot!

Usenix technical conference: Day 2 (Monday)

Had the opportunity to sit in on three rather interesting sessions today: First was prioritizing e-mail (Spam killing). Three guys, formerly of HP Labs discussed creating rules to predict (with relative certainty) which messages are spam, and which aren't. One criticism however, before going public, it'd be good to see more than one dataset. The tests ran by this team were run using log data from HP Labs. It'd be interesting to see several commercial test cases. The tests were evidently ran using collected log data from two months of traffic, but no outside datasets were run.

Next, sat in on a session entitled "Swimming in a Sea of Data", where a man with a very thick accent spoke softly into a mic, and so fast he couldn't be understood even IF he spoke into the mic. I left fifteen minutes into the preso.

System Administration: The big picture. Here, a panel of three gentlemen discussed a vision for standardizing practices by system administrators. The analogy is this: an electrician must wire houses by code. The Electrical Engineer writes the code. Why then can't sysadmins have a code by which they must follow without question. System Engineers would write the code. Good question. Speaking of questions, we had 35 minutes to ask questions. The first? How can we assess system administrators? Next, Why are so many companies outsourcing? (Somebody pull the stick out of my eye!) Other than that? Good talk.

It's 4PM. I'm outa here for the day. Tomorrow morning is the Cisco talk which also looks pretty good. Wednesday should be a blast: Dan Geer vs. Scott Charney in a cage match to the death!

Usenix technical conference Boston: Day 1 (Sunday)

"Sysadmin outsourcing sucks"

Checked in today to get my ticket for the rest of the conference and attend Orientation. After checkin, I had a couple of minutes to kill before the orientation session kicked off. I decided to check e-mail. Within seconds of sitting down, I was approached by an unemployed sysadmin who had been out of work for nearly three years (I would presume his skill our a bit rusty?), and received a fifteen minute one-way discussion on why Sysadmin outsourcing sucks (man).

Noted.

Broken Windows?

I just read a piece posted to the Fireball Blog discussing reasons why Windows has so many more viruses, worms, and other miscreant code being written to exploit it than OSX. Frankly I'm happy not having OSX in the forefront of the malicous code-writer's minds. The more attention drawn to Windows (and not OSX) from a security perspective the better.