Category Archives: History

History, Sailing, Security

$200M Sea Shadow Sent to the Chopping Block

Leave a comment

The LA Times has posted an amusing story on the current GSA auction for a giant invisible catamaran.

Sea Shadow

…the U.S. Navy, which — after five years of trying and failing to donate the stealthy Sea Shadow to a museum — is now selling the ship for scrap metal in an online auction. All bids must be in at 3 p.m. Pacific time Friday. But there’s a catch. To win the auction, the successful bidder must agree to dismantle and scrap the Sea Shadow within six months…

What if you are a museum? Suddenly it is not good enough to be a museum?

Obviously the ship’s stealth is limited, otherwise the government would not be able to know what you did with it after winning the auction, right?

This is my favorite part of the story.

“On a typical night of testing, the Navy sub-hunter planes made 57 passes at us and detected the ship only twice,” he wrote. “A typical warship was a very high reflector of radar — a radar profile equal to about fifty barns. Our frigate would show up a hell of a lot smaller than a dinghy.”

That’s good news. The test success suggests that stealth technology in use today has come a long way from $200 million invested in 1985. Perhaps stealthy floating sea barns would now appear to be oar-sized? What’s a unit smaller than a dinghy? Life preserver?

More to the point, who in the world uses barns as a measure of size, especially when looking for something floating on the water? Perhaps it comes from people who think differently than the average person; people who use very precise and technical language to present their view of the world. People like this:

“I am amazed that it’s up for auction and a museum didn’t take it,” said Sherm Mullin, retired head of Lockheed’s Skunk Works. “But when I stop to think about it for about 10 microseconds, it becomes apparent to me that ships are difficult to take care of — a lot more difficult than airplanes.”

10 what? I would not even qualify 10 microseconds as a stop. That’s more like a yield in my mind. A speed bump at best.

Personally I would consider making bids for it but sadly it only comes with one microwave oven. I’d want at least a camp stove if I’m going to spend over $100K on a yacht. Although, I bet that microwave can cook food faster than anything on the market. Tuna in 10 microseconds anyone?

History, Poetry, Security

At the Edge of the Abyss

Leave a comment

Tablet Magazine has posted a book review for a new English version of At the Edge of the Abyss: A Concentration Camp Diary, 1943-1944.

Three things mark At the Edge of the Abyss as an utterly distinctive and unique work of Holocaust literature that must be read now that an English-language translation exists. First, the insider account of a camp; second, Koker’s literary and analytic abilities; and third, the only first-person report of an encounter between a Jew and Heinrich Himmler, head Nazi and overseer of all the camps.

[…]

Somehow, Koker also finds beauty inside the physical landscape of the camp. From one poem dated May 17, 1943: “The evening air so pure and intimate/ A sky that’s hazed in whiteness by the sun/ and trees with foliage in great profusion/ with glittering flecks of silver from the sun.” He is also occasionally magnificently insightful. Jan. 6, 1944: “The goal is neither happiness nor unhappiness. It’s the unfolding of human potential. The development of that piece of the universe that you represent, as it were, even when it happens at the expense of what people call the self and their own welfare. Actually, it always happens at their expense. By feeling a lot we expand the world.”

One of the interesting aspects of the story is how the diary survived. The original documents have been digitised and can be found online at the Koninklijke Bibliotheek, GeheugenVanNederland

Oorlogsdagboek van Koker, David

History, Security

VMware Security Note: ESX Source Posted

Leave a comment

The VMware Security Response Center has just posted the following announcement

Yesterday, April 23, 2012, our security team became aware of the public posting of a single file from the VMware ESX source code and the possibility that more files may be posted in the future. The posted code and associated commentary dates to the 2003 to 2004 timeframe.

The fact that the source code may have been publicly shared does not necessarily mean that there is any increased risk to VMware customers

Update, April 25th: I’ve been contacted to discuss this story in more detail. Here are some general points I have made.

  • VMware is being proactive in notifying customers and the public. They will provide further details if/when necessary but you can see from the announcement that they are attentive to risk and assessing it thoroughly. There was no prior announcement.
  • The breach of the China National Electronic Import-Export Company (CEIEC) at the start of this month (Apr 2nd) is being reported as related to this announcement. The US Government imposed sanctions against CEIEC in December of 2006 (FR Doc No: E6-22630) under “Section 3 of the Iran and Syria Nonproliferation Act”.
  • Do not download files from the CEIEC breach without taking special precaution against malware and exploits

2nd Update, April 25th: The Register has posted a blurry image of the stolen code, covered in “Death Card” images. That is probably an historical reference to the “Ace of Spades,” which has been popularised as a victory taunt in American pop-culture.

The actual effect of the card, however, is far from what has been depicted in Hollywood and thus likely to be different from what was intended by those releasing the ESX code. Its history and effect is explained in detail by PsyWarrior, who includes a quote attributed to “Lieutenant Colonel William J. Beck who commanded the 4th PSYOP Group from 15 October 1967 to 7 October 1968”:

Any survey of the PSYOP program in Vietnam reveals that many psy-operators are frustrated by the lack of signs of tangible success in the PSYOP effort…Perhaps in an attempt to overcome this deficit many appear to be impressed with the values of what can only be called propaganda gimmicks. This includes the use of the ace of spades, special lighting effects, and ghostly loudspeaker broadcasts.

This aspect, unfortunately has often reduced idea formation on the part of these operators and staff to the level of “gimmicky” and more or less desperate attempts to find a quick solution and dramatic breakthrough. This is not good PSYOP.

The Ace of Spades, therefore, appears historically to be a reference to attackers who struggle from “lack of signs of tangible success”.

History, Security

Sleep and the 25% breached

Leave a comment

CDW has published a Data Loss Straw Poll with the headline “One in four organizations has experienced a data loss in the last two years.”

CDW’s Data Loss Straw Poll surveyed 654 IT professionals from business, financial services, healthcare and higher education about data loss and what’s still keeping them up at night.

That is a typically low sample. As I have explained in my RSA presentations since 2009, sample size really does matter. There are nearly 6 million companies in America. Are we confident to extrapolate from these 654 people?

They also make a strange assumption that IT managers actually sleep at night. I thought the whole idea of alerts and mobile devices was to prevent anyone in IT from ever sleeping again. CDW’s report centers around the obvious connection between a device that is always with you, delivering bad news, and a resulting anxiety that makes it difficult to relax or rest.

DATA LOSS = SLEEP LOSS […] MOBILITY TRIGGERS SLEEPLESS NIGHTS

I think it’s more accurate to say change triggers sleepless nights. Mobility is not new, but the changes in mobility that has been driven by consumers keeps IT from settling down. CDW also tries to make a statement of who is less tired, but I don’t buy this analysis at all:

Financial services organizations can sleep more soundly than their colleagues in other markets

I could make the argument, for example, that those sleeping more soundly have their phones turned off, or have their alerts disabled, or are simply unable to detect issues in real-time — they wake up rested and only then discover data loss. So there’s a false dichotomy of sleep versus security. You might actually be more secure when you are losing sleep…SLEEP LOSS = SAFETY?

In my 2010 presentation at RSA I used the Siege of Yodfat in 67 CE as an example of this exact issue.

The sentries slept at a particular time. An insider leaked that information to the Roman armies and enabled them to finally breach an impenetrable perimeter. In other words, they slept soundly because they thought they were safe enough to rest, which actually in itself created a weakness. The flip side of this argument is sustainability. Sleep loss is a resource management issue and begs the question of reserves, offsets (e.g. Basel II), etc. but rather than get into the deeper economics and history of managing loss here (I do that in my presentations) I just wanted to point out that the CDW report needs further analysis.