Category Archives: History

Quoted in Inc.

A writer for IncInc. has quoted me in an article called “New Ways to Keep Hackers Out of Your Business

While you might think of encryption as something we’ve been using only since the advent of computers, it’s really a rather old practice. “Encryption is based upon a secret,” says Davi Ottenheimer, expert on the Focus network and founder of San Francisco-based security consulting firm flyingpenguin, who likes to cite Julius Caesar and Thomas Jefferson as examples of historical figures who have hidden things by using cryptography.

Caesar used a substitution cipher to communicate with his generals that involved replacing the letters in a message with a shifted alphabet. For instance, a shift of three would make all the As in message Ds; Bs would become Es, and so forth.

Jefferson used a type of wheel cipher during the Revolutionary War that involved 36 disks stacked on an axle, each with a different version of a scrambled alphabet on the outer edge. When both the sender and receiver had the numbered disks in the same order and rotated them in the right way, an understandable message would appear.

“People have historically improved encryption during times of conflict or war,” Ottenheimer says. “It’s all about secrecy, really, confidentiality. It doesn’t require super-sophisticated technology as much as it requires people being fairly intelligent about how they can keep a secret.”

BayThreat 2011: Sharpening the Axe

I will be presenting “Sharpening the Axe – How to Chop Down a Cloud” at BayThreat 2011

…the 2nd annual information security conference in the South Bay at The Hacker Dojo, December 9th, 10th & 11th.

My title is in reference to President Abraham Lincoln who was said to have once quipped:

If I had eight hours to chop down a tree, I’d spend six hours sharpening my axe.

The runner-up quote from Lincoln was

If this is coffee, please bring me some tea; but if this is tea, please bring me some coffee

…but I couldn’t figure out how to make it into a full presentation, let alone a title. Perhaps “if this is cloud, please bring me on-premise; but if this is on-premise, please bring me cloud”?

The axe title works fine, though, and also is in reference to Theseus’ paradox, sometimes known as the Ship of Theseus or my grandfather’s axe, which seems appropriate given this year’s badge.

At BayThreat this year, we’re giving attendees circuit board badges. These badges are plain boards to start, but on Sunday we will have a soldering workshop where everyone can work on their badges. We will have kits available for the badge.

The presentation is based on some of the material you will find in my new book soon to be published by Wiley on security in virtual environments. Hope to see you there.

BayThreat

Facebook FAIL: ID mixup leads to lawsuit

An established German company named Merck in the 1880s sent one of its chemists to New York to import drugs to the American market and capitalize on the fast-growing economy. Things went so well that just ten years later they began to look for ways to avoid high import tariffs and manufacture drugs in America; by 1900 they expanded operations into the remote and open space of New Jersey.

The company then was caught up in the divisiveness of WWI. German companies on U.S. soil, including Merck, were confiscated and auctioned to American owners. German Merck became a completely separate and distinct entity from Merck operations in America due to the terms of reconciliation and the Treaty of Versailles in 1918. After the forced split the American company eventually grew to be much larger than the German Merck.

Fastforward to today’s news. Facebook staff made the extremely awkward, if not completely ignorant, decision to hand the American Merck control over a page setup by the German Merck.

Facebook Inc said on Monday that it made a mistake in letting Merck & Co take over a page on the social networking website from its German rival Merck KGaA.

The takeover prompted an unusual November 21 filing by Merck KGaA with a New York state court.

In it, Merck KGaA sought to force Facebook to explain how it lost the page, www.facebook.com/merck, and the ability to administer it to Merck & Co, a separate company.

[…]

“The transfer of the vanity URL Facebook.com/Merck from Merck KGaA to Merck & Co was due to an administrative error,” Facebook said in a statement. “We apologize for any inconvenience this may have caused.”

This issue of impersonation is one of the most difficult problems in identity management, to be fair. How many John Smiths are there on Facebook and what can Facebook really depend upon to distinguish them as unique users? I mean which Budweiser brewer is the real one?

More to the point, how can a provider tell husband access from wife, or parent from child? The courts are usually the best answer. If a divorce court rules that a wife gets the shared Facebook account, then Facebook will have some justification to act.

This case is odd because Facebook apparently made a decision without authority to favor the American company over the German one.

Users need assurance that a company like Facebook, entrusted with sensitive data, can handle this kind of situation without making an historic blunder. Merck is lucky to have the legal team and resources to file a formal complaint but it begs the question how many similar mistakes are being made at a lower profile. It also begs whether Facebook staff do even the most basic review or follow a transparent and monitored process before taking action.

This Day in History 1944: the 584th Squadron of the 394th Bomb Group

An American “Martin Marauder” in the 584th Squadron of the 394th Bomb Group — the “Bridge Busters” — was shot down over France on this day in 1944 during mission #148.

Captain Harper and his crew were flying in the lead position of the second box of the formation bombing Neuweid, Germany when their B26 received a direct hit from anti aircraft fire, burst into flames and crashed. No parachutes were observed by other crews, but Sgt Howard Mote was later reported as a POW, the rest of the crew were killed.

    Captain Lawrence P. Harper – Zachary Taylor National Cemetery
    1/Lt William Andrews – Zachary Taylor National Cemetery
    1/Lt Paul Stephens – Arlington National Cemetery
    1/Lt James Harrison – American Cemetery in the Netherlands
    2/Lt Kenneth Wolf – Zachary Taylor National Cemetery
    T/Sgt James Kelly,Jr. – Zachary Taylor National Cemetery
    S/Sgt Stuart Ottenheimer (second from right above – born August 7, 1922) – Zachary Taylor National Cemetery (Section E Plot 169-170)
    Sgt Ralph Pagano – Zachary Taylor National Cemetery

394th Bomb Group Insignia

Some interesting B-26 footage can be seen in this collection of propaganda films called Martin Marauder in Action

The B-26 had a very high rate of accidents in takeoff and landing until crews were trained better and (perhaps more importantly) an aspect ratio design was modified on its wings/rudder.

The following United States War Office Official Training Film 1-3301 How to Fly the B-26 Airplane was for pilots who had to fly what unofficially became known as the “Widowmaker”. Note that the lead character says

Life Begins With a Checklist…and it May End if You Don’t Use It