Categories
What I’m Up To

Interview number 2

Tap to see the article about the previous interview.

This time, it was on Zoom, so I had more than one reason to dress up.

I think it went pretty well.

Categories
Programming What I’m Up To

A more Pythonic approach to one of my “Capture the Flag” solutions

In my article about the Capture the Flag at The Undercroft in which I recently participated, I wrote about my solution to this particular challenge:

Your answer lies in the 1’s and 0’s…

0010111 00001111 00010111, 00011001 00001111 10101 00000001 00010010 00000101 00010010 00001001 00000111 00001000 00010100

(Make sure to use the comma, and spaces correctly)

The first part of my solution was turning those numbers into a list. Copy the numbers into a text editor, stick 0b in front of each one, and then turn the sequence into a Python list:

numbers = [0b0010111, 0b00001111, 0b00010111, 0b00011001, 0b00001111, 0b10101, 0b00000001, 0b00010010, 0b00000101, 0b00010010, 0b00001001, 0b00000111, 0b00001000, 0b00010100]

Paste the list into a Python REPL and then display its contents to see the numbers in decimal:

>>> numbers
[23, 15, 23, 25, 15, 21, 1, 18, 5, 18, 9, 7, 8, 20]

The next step is to convert those numbers into letters. Once again, the Unicode/ASCII value for “A” is 65, so the trick is to add 64 to each number and convert the resulting number into a character.

Here’s how I did that:

>>> characters = map(lambda number: chr(number + 64), numbers)
>>> list(characters)
['W', 'O', 'W', 'Y', 'O', 'U', 'A', 'R', 'E', 'R', 'I', 'G', 'H', 'T']

I could’ve gone super-functional and done it in one line:

>>> list(map(lambda number: chr(number + 64), numbers))
['W', 'O', 'W', 'Y', 'O', 'U', 'A', 'R', 'E', 'R', 'I', 'G', 'H', 'T']
Tap to find out more about lambda functions in Python.

Between lambda and map(), there’s a whole lot of functional programming concepts to solve a relatively simple problem.

I could write a whole article — and I probably should — based on just that single line of code, but in the meantime, I thought I’d post an easier, more Pythonic solution.

This simpler solution uses good ol’ list comprehensions:

>>> characters = [chr(number + 64) for number in numbers]
>>> characters
['W', 'O', 'W', 'Y', 'O', 'U', 'A', 'R', 'E', 'R', 'I', 'G', 'H', 'T']

Most programming languages don’t have list comprehensions. In those languages, if you want to perform some operation on every item in an array, you use a mapping function, typically named map(), but sometimes collect() or select().

Hence my original solution with lambda and map() — it’s force of habit from working in JavaScript, Kotlin, Ruby, and Swift, which don’t have Python’s nifty list comprehensions.

Categories
Humor Security

I’ll admit it: This Facebook trick question impressed me.

Look at that stat: 87,672 shares. I wonder how many people posted an answer.

I should come up with a list of the other common security questions, cleverly re-phrased.

Categories
Tampa Bay What I’m Up To

My time at The Undercroft’s Capture the Flag

Photo credit: The Undercroft.

The final event of UC Baseline, The Undercroft’s cybersecurity training program, was the Capture the Flag competition, which took place last Friday morning.

In computing “Capture the Flag” events, the flag isn’t a physical one, but some kind of challenge. Sometimes, it’s something you need to retrieve from a program, website, or even a piece of hardware with an intentionally built-in vulnerability that you must exploit. Sometimes it’s a problem or puzzle you must solve. It may also be a trivia challenge.

Solving each challenge earns you a specified number of points, with the tougher challenges being worth more points. The player with the most points wins.

Since it wasn’t scheduled as a day of actual class — the last day of class was on Wednesday — I’d booked a doctor’s appointment for that morning. A plumbing problem also required me to be at home for a little bit.

By the bye, if you’re looking for a great plumber in Tampa, I highly recommend Joshua Tree Plumbing.

The challenges

Still, since most of the challenges were posted online and since I’d never participated in a CTF before, I decided to try anyway. I decided to treat my schedule as if it was a golfer’s handicap. Since some of the challenges were just questions where you’d either select an answer or type one in, I did them on my phone while waiting for the doctor.

In between a couple of car trips, I managed to eke out a little over an hour and a half of time in the CTF, so I think I placed rather well, all things considered:

Here’s a sampling of some of the challenges:

  • Who’s on 80? (300 points):
    Scan the host at (IP=10.10.1.1) and enumerate the service running on open port, 80.Use the following syntax for your answer: nmap [scan type] [ options] [target]
  • The Big Kahuna, part 1 (1200 points):
    Using the Linux OS and boot method of your choice (VM or live boot):Add the “Kali Linux Headless” Repository to your repository list. Download and install the Kali Tools Headless package to your Linux operating system. Get the Metasploit Framework running. Show one of the staff when you’re finished.
  • Don’t cross the streams! (500 points):
    An attacker got onto a machine and created a rogue user. Dig through the attached PCAP file and identify the rogue user.The flag is the user name. This flag IS case sensitive.
  • Execution is everything! (400 points):
    What are the four different execution policies for Powershell?

    • Restricted, Unrestricted, AllSigned, RemoteSigned
    • Unrestricted, Restricted, AllSigned, PartiallySigned
    • Restricted, Unrestricted, PartiallySigned, RemoteSigned
    • Unrestricted, Restricted, PartiallySigned, UnSigned
  • Pick these locks (a buttload of points):

A couple of Python solutions

I solved a couple of the challenges with Python, and I’m sharing them here (with the permission of the instructors, of course):

Are you sure? (200 points)

Your answer lies in the 1’s and 0’s…

0010111 00001111 00010111, 00011001 00001111 10101 00000001 00010010 00000101 00010010 00001001 00000111 00001000 00010100

(Make sure to use the comma, and spaces correctly)

My first instinct was to copy these numbers, into a text editor, stick 0b in front of each one, and then turn the sequence into a Python list:

numbers = [0b0010111, 0b00001111, 0b00010111, 0b00011001, 0b00001111, 0b10101, 0b00000001, 0b00010010, 0b00000101, 0b00010010, 0b00001001, 0b00000111, 0b00001000, 0b00010100]

I pasted the list into a Python REPL and then displayed its contents, to see the numbers in decimal:

>>> numbers
[23, 15, 23, 25, 15, 21, 1, 18, 5, 18, 9, 7, 8, 20]

All the numbers were between 1 and 26 inclusive, suggesting letters of the alphabet.

The ASCII/Unicode value for “A” is 65. If you offset the numbers by adding 64 to each, and then convert each number to a character, you should get the message:

>>> characters = map(lambda number: chr(number + 64), numbers)
>>> list(characters)
['W', 'O', 'W', 'Y', 'O', 'U', 'A', 'R', 'E', 'R', 'I', 'G', 'H', 'T']

Remembering the instructions to “use the comma, and spaces correctly,” the answer is:

WOW, YOU ARE RIGHT

The big kahuna part 2 (700 points)

Using the Linux OS and boot method of your choice (VM or live boot):

Create a folder. In that folder, create 100 directories that are uniquely named incrementally (ergo directory1, directory2, etc.). Inside each of those 100 directories, create 100 directories that are uniquely named incrementally. Inside each of those 100 directories, create 100 files named incrementally (file1, file2, file3, etc.). The contents of each file should include the lyrics to the “Battle Hymn of the Republic” by Julia Ward Howe.

When complete, show a staff member.

Cochise (artist’s conception).

This challenge is phrased in such a way that it could only have been written by our Linux instructor Cochise (pictured to the right).

Creating those 100 directories in Linux is a one-liner:

mkdir directory{1..100}

The rest of the task calls for some scripting.

I’m terrible at shell scripting. I’m perfectly comfortable with using the shell interactively, in that classic enter-a-line/get-a-response fashion. However, once I have to deal with those half-baked control structures, I tend to walk away and say “Forget this — I’m doing it in Python.”

Here’s a cleaned-up, easier to read version of my solution to the challenge. It assumes that there’s a file called battle.txt in the same directory, and that the file contains the lyrics to the Battle Hymn of the Republic:

import os
import shutil
import sys

for directory_number in range (1, 101):

  # Create the directory.
  directory_name = f"directory{directory_number}"
  try:
    os.mkdir(directory_name)
  except:
    error = sys.exc_info()[0]
    print(f"Failed to create directory {directory_name}.\n{error}")
    quit()

  # Go into the newly-created directory.
  os.chdir(directory_name)

  # Create the files within the directory
  # by copying battle.txt from the directory above
  # 100 times, naming them file1...file100.
  for file_number in range(1, 101):
    filename = f"file{file_number}"
    try:
      shutil.copy("../battle.txt", f"file{file_number}")
    except:
      error = sys.exc_info()[0]
      print(f"Failed to create file {filename}.\n{error}")
      quit()
  
  # Let’s go back up one directory level,
  # so that we can create the next directory.
  os.chdir("..")

I had a lot of fun on my first CTF, even if I got to take part in a fraction of it. I’ll have to join The Undercroft’s next one!

Categories
What I’m Up To

My phone interview

Tap to view at full size.

All dressed up for a 📱 PHONE ☎️ interview. Sure, they won’t know I’m dressed up, but I’LL KNOW.

[See the original Tweet.]

Categories
Hardware Humor

If you thought it was bad when your COMPUTER decides to update while you’re in the middle of something…

Tweet by @robdaemon. Tap to see the source.

…wait until your IoT grill does it.

I need to look up this grill to see what its embedded controller does. Aside from…

  • reporting its current settings and temperature, and
  • some limited ability to control it remotely (very limited, if at all — the computers in IoT devices are cheap and insecure, and attackers can cause all sorts of mischief with a networked propane tank)…

…what else does it do that needs an update, never mind an update big enough to interfere with cooking?

Categories
Reading Material Security Tampa Bay

My list of links from class discussions during UC Baseline’s InfoSec week

Photo: The Undercroft sign, featuring the Undercroft’s “mascot” — a stag standing upright in a suit, leaning jauntily against an umbrella, walking stick-style.During the Information Security week of the UC Baseline cybersecurity program, the instructors asked us a lot of questions whose answers we had to look up. As a way to maximize participation, we were encouraged to share lots of links of the class’ Slack channel, which also functioned as a backchannel, as well as a way to chat with the students who were taking the course online.

The links that we shared in class were valuable material that I thought would be worth keeping for later reference. I’ve been spending an hour here and there, gathering them up and even organizing them a little. The end result is the list below.

Since these are all publicly-available links and don’t link to any super-secret UC Baseline instructional material, I’m posting them here on Global Nerdy. Think of this list as a useful set of security-related links, something to read if you’re bored, or a peek into what gets discussed during the InfoSec week of the UC Baseline course!

The links

  • U.S. Department of Health & Human Services: Cyber Security Guidance Material
    A collection of “educational materials specifically designed to give HIPAA covered entities and business associates insight into how to respond to a cyber-related security incidents.”
  • DFIR — Digital Forensics and Incident Response
    “Digital forensics and incident response is an important part of business and law enforcement operations. It is a philosophy supported by today’s advanced technology to offer a comprehensive solution for IT security professionals who seek to provide fully secure coverage of a corporation’s internal systems.”
  • Understanding RPO and RTO
    “Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are two of the most important parameters of a disaster recovery or data protection plan. These are objectives which can guide enterprises to choose an optimal data backup plan.”

  • The 3-2-1 backup rule
    “For a one-computer user, the VMware backup strategy can be as simple as copying all important files to another device – or, ideally, several devices – and keeping them in a safe place. However, for multiple computer systems, things can be (and usually are) much more complicated, especially when it comes to virtual environments containing thousands of virtual machines. To protect physical machines, you would need to perform Windows Server backup or Linux Server backup, which might be difficult without effective backup tools. In these cases, a comprehensive data protection plan should include the 3-2-1 backup rule.”

  • Evaluating Risks Using Quantitative Risk Analysis
    “Project managers should be prepared to perform different types of risk analysis. For many projects, the quicker qualitative risk assessment is all you need. But there are occasions when you will benefit from a quantitative risk analysis.Let’s take a look at this type of analysis: What is it? Why should we perform it? When should it be performed? And how do we quantify risks?”

  • Buffer/stack overflows
  • Here are six basic human tendencies that are exploited in social engineering attacks:
    1. Authority: An attacker may call you pretending to be an executive in order to exploit your tendency to comply with authority figures.
    2. Liking: An attacker may try to build rapport with you by finding common interests, and then ask you for a “favor”.
    3. Reciprocation: An attacker may try to do something for you, or convince you that he or she has, before asking you for something in return.
    4. Consistency: An attacker might first get your verbal commitment to abide by a fake security policy, knowing that once you agree to do so, you will likely follow through with his next request in order to keep your word.
    5. Social Validation: An attacker may try to convince you to participate in a fake survey by telling you that others in your department already have. He or she may have even gotten some of their names and use them to gain your trust.
    6. Scarcity: An attacker may tell you that the first 10 people to complete a survey will automatically win a prize and that since some of your co-workers have already taken the survey, you might as well too.
  • Social Studies – A Lesson in Social Engineering Basics
    As we have become more and more vigilant against clicking on malicious links in suspicious emails, some social engineers have gone back to the classic person-to-person approach. Their basic strategy is to prey on vulnerabilities in human nature.