b.cognosco

MacLockPick: A Vital Tool For Our Trusted Protectors

terrywfrazier@gmail.com — Thu, 17 May 2007 18:21:00 GMT

Only $499 and available in bulk from Subrosasoft, The MacLockPick is a handy little device for computer-illiterate trusted civil servants to plug into sleeping MacBooks and collect data from all those computers left lying around at crime scenes - just like on TV. Via Digital Trends Magazine:

MacLockPick Pulls Private Data Via USB Port
Friday, April 27th 2007 @ 6:50 AM PDT
By Nick Mokey
Staff Writer, Digital Trends News

Uncle Sam has a new way to pry into your data, and it's as simple as popping in a thumb drive.

Lock up your MacBooks, Apple fans: SubRosaSoft announced Friday that they are shipping a USB thumb drive, dubbed MacLockPick, that can extract passwords, Internet history, and system settings from an OS X user just by slipping it into a USB drive.

Of course, the drive is only available to law enforcement, but we have to wonder if the same technology that powers it will ever become available to less scrupulous individuals. […]

Anyone wonder just what security measures are in place to ensure that only law enforcement can purchase this. Better yet, what security is in place to ensure that law enforcement doesn't lose, misplace, or steal the device? Not that it does anything that a power user couldn't do given a little private time with the computer, but it does make it seamless, simple, silent, and quick - just the thing for the sort of abuse-prone neanderthals that seem to make up far too much of the law enforcement population.

The following is a list of file items that can be extracted using SubRosaSoft’s MacLockPick:
Apple Keychain Passwords

System - The user password of the logged in user. Often this is shared for root access and FileVault encryption.
General - Includes (but is not limited to) passwords for encrypted disk images, wifi base stations, iTunes music store, iChat login, Apple Remote Desktop.
Internet - Includes (but is not limited to) login and password details for web sites, email accounts, some peer to peer networks, online services and stores, auction sites, and .mac accounts.
AppleShare - A list of login and password details for appleshare servers this mac has connected to.

Files and Folder details

Folder Dates - A list of all the key user folders along with their creation date, date of last modification, date of first access, and date of the most recent access.
Disk Images - Paths to the most recent disk images that have been mounted on this mac.
Preview - Full paths to recent files that have been viewed in the preview program.
QuickTime - File names for recently viewed movies fro the QuickTime player applications
Recent Applications, Documents, and Servers - Program names for the most recently used items on this Macintosh computer.

Instant Messaging

Default Login - for iChat instant messenger system.
Complete buddy list - including buddies who have since been deleted.

eMail

Account Details - login names and server addresses used.

Address Book - Address details for entries in the address book including contacts that have been deleted. This address book is used by most communication programs on the Mac and is used to synchronize with the iPod and other portable devices.

Opened Attachments - Paths to files that have been received as an attachment then saved or opened including the date and time of opening.

Web History and Preferences

Search Strings - The most recent items that the user has searched for using the google toolbar in safari.
Cached Bookmarks - Sites that have been bookmarked in Safari including items that have been deleted.
Current Bookmarks - Sites that are currently bookmarked in Safari.
Cookies - A full list of cookies include the server address the cookie value and the date and time of assignment.
History - Complete details of browsing history including the number of times visited and the date and time of the most recent visit.

Hardware Preferences

iPod - Serial numbers of any iPod that have been connected to this Mac along with the date and time it was first used.

Bluetooth Devices - hardware address of any bluetooth devices that have been paired with this mac along with the most recent time these devices have been paired.

Wifi Connections - Listings for wifi base stations that have been used on this computer including the base address and the date and time of the first connection.

Network Interfaces - MAC address for each integrated network interface on the suspect's machine.

No doubt there will be, if there isn't already, an open source version of this or a free set of instructions to DIY for anyone with the time and inclination to do so.

Tracking The Loss of Private Data

terrywfrazier@gmail.com — Wed, 16 May 2007 13:23:06 GMT

If you're interested in the subject of data breeches, data loss, and mishandling of private information you might want to have a look at etiolated.org.

Site features real-time graphs, statistics, and searchable full-text database of company names, event summaries, and comments. Thanks to my friend Al Macintyre.

Why You Need To Be As Smart As Your Doctor

terrywfrazier@gmail.com — Tue, 15 May 2007 19:38:00 GMT

In August of last year a 43-year-old woman undergoing chemotherapy treatment for nasal cancer died after receiving a massive overdose of the chemotherapy drug flourouacil. According to an Incident Report (pdf) issued by the Institute of Safe Medicine Practices Canada the dose was miscalculated by two different nurses and incorrectly programmed into an electronically-controlled pump. The woman was then sent home, where the pump poured four (4) days worth of drug into her in four (4) hours.

When the woman returned to the cancer clinic to report the problem a nursing supervisor contacted the doctor on call and was told nothing could be done - there was no antidote - and the woman should be advised to call the next morning. The woman was warned of vomiting and nausea and instructed to stay hydrated.

For the next couple of days no one at the clinic paid much mind to this incident and no one advised the patient of the potential severity of consequences. On the third day someone contacted the patient and advised her to come in the next day. By the fourth day the patient was sick and returned to the clinic but there were no beds available. She was admitted the next day.

For the next two weeks this woman's body systematically destroyed itself in a rather grotesque and painful sequence of events that led to her death in ICU approximately two weeks after her admission.

This event happened in Canada, but it could happen anywhere. It could happen in every hospital or clinic I've ever been in. The problem is that we rely to much on our doctors, and our nurses, to get things right and they just don't always do so. We simply must know what they are pumping into our bodies. We must know what it is, what it does, and what the potential consequences are.
More importantly we need someone with us, and intelligent advocate, any time we undergo such a procedure because as patients we simply aren't in any shape to think straight and ask the important questions. Someone should have noticed after an hour that the woman's medicine was now 1/4 gone and stopped it. Someone should have known, and told the patient, that she was being poisoned (intentionally) and that an overdose would almost certainly be fatal.

My experience is that when you go into a hospital or clinic you are given a form to sign that says you could die. You get that for everything from having an ingrown toenail removed to open heart surgery. But the realistic outcomes are simply not the same for both cases. And the verbal instructions and warnings given by staff are designed to be comprehended by fifth graders and not raise anyone's anxiety level. The result is everyone signs the form without reading it (I'm not sure it contains anything useful anyway) and, as the report shows, we rarely get the full scoop via verbal instructions or even written discharge orders.

We have made enormous improvements in healthcare over the last 50 years, but we are just nowhere near where we need to be. Until we are we all need to educate ourselves as much as possible on what the doctors are doing to us, what the (realistic) potential consequences are, and what we should be watching for.

Denim Site Sketching: Free-form Web Design

terrywfrazier@gmail.com — Tue, 15 May 2007 13:21:33 GMT

For the past couple of weeks I’ve been working on a new site design for a client – InterviewRX.com. We actually have the structure and information architecture pretty well mapped out and are focusing on look and feel, but this type of tool could still come in handy. Even though I am not a designer I’ve taken to creating my own mockups over the years because I find starting from ground zero with a designer to be incredibly frustrating and expensive – it just takes forever for a designer, even a good one, to figure out what you want if you can’t draw at least a basic picture of it yourself. So now I create a fairly complete mockup and then have a designer polish it. That works out much better for me.

But even though I’m getting better at it, I still go through lots of iterations – especially in basic information architecture. Something like Denim could come in handy. I like the mindmap-style sketch interface – seems to me the two are quite similar. I’ll be trying it out later this week. Hat tip to Jim McGee:

Web Design Tool: Denim Site Sketching

When you are making websites, inevitably some form of sketching will be done to rough out it’s design and interactivity.

Whether you’re the web designer or someone trying to communicate your ideas to a web designer, this little piece of software, called Denim, will come in handy.

What Denim does is allow you to create a mock website, with linking pages, just from your rough sketches. Obviously, this will work particularly well with a tablet interface.

Supports Windows, Mac and Unix.

Denim by the University Of Washington

Netgear FVS124G and Vonage

terrywfrazier@gmail.com — Tue, 15 May 2007 00:12:35 GMT

A few weeks ago I reported that I had purchased a new firewall, a Netgear FVS124G. I was enthusiastic about it at first but, like most technology, the teething problems showed up rather quickly. Between then and now I've been dealing with technology at a level that I no longer enjoy. But it does appear that, with the help of people at the Vonage Forum, the Netgear Support Forum, and Netgear tech support I have managed to get most things working correctly.

The FVS124G has several features that attracted me:

Dual WAN support
Built-in VPN support
Gigabit LAN ports
Built-in dynamic DNS support

Combined with my little Netgear GS608 Gigabit switched hub it makes a perfectly adequate small office backbone. The trouble was the firmware didn't actually work in many areas. The idea behind dual WAN ports is that you can have two broadband connections. The firewall offers three modes of connecting:

Manual selection
Auto-rollover
Load Balancing

Manual mode means one WAN port is active. If it goes down (a daily occurrence with DSL in my area) you manually switch to the secondary (cable modem in my case.) Auto-rollover means that the firewall monitors the state of the primary WAN and if it senses failure it automatically switches over to the secondary. Load balancing is where both WAN ports are active and the firewall distributes traffic between them.

I wanted to use Load Balancing mode, taking advantage of the bandwidth available via both my DSL line and my cable modem line. I naively thought I could get better performance and reliability with less hassle. This is sorta true, sorta not. Everything has a price.

It turns out that lots of net connections require continuity - that is, they can't send packets over two different broadband connections because the source IP address changes. HTTPS is one such protocol. VoIP is another. There are others, I'm sure. When these connections get broken up over two source IP addresses they cease to work. Since I'm a Vonage VoIP user once I switched to Load Balancing mode my phone stopped working. Not good.

I fiddled with that for quite a while, trying different firewall rules, QoS settings, etc. Nothing worked. The FVS124G has a protocol binding function which, in theory, would let me force all traffic from a given device or protocol to a specific WAN port. But it didn't work. Even after setting up the correct rules a packet trace showed that VoIP packets were going over both WAN ports.

After reading some tech notes and forum entries I upgraded to the latest Netgear firmware release (v 1.1.38.) That was a disaster. The new firmware slowed my DSL connection to a crawl - about the same as an old 56k dial-up connection. It was terrible. So even if the other problems had be resolved, the new problems were worse. So I went back to my original firmware (v 1.1.30) and eventually got back to my starting point. But I couldn't use Load Balancing.

The only way I could get the Vonage device to make a clean connection was to switch to Manual or Auto-rollover. Even with that I had to go through some hoops, as v 1.1.30 wasn't SIP compliant and all the SIP functions had to be manually disabled by telneting into the box and issuing some arcane commands via a command line. In the end I settled on using Auto-rollover mode so that if my cable modem (now primary) went down (which it did with some regularity) the firewall would switch to DSL which, hopefully, would choose some different time to be down each day.

The trouble with this arrangement was that once the firewall "rolled over" to DSL it did not recover when the primary WAN came back online, instead going into Load Balancing mode and using both WAN ports. Which killed my phone service. Again. And required that I reboot the firewall.

Not much better than having to manually switch it.

As a result of all this testing, experimenting, and tech support contact the folks at Netgear asked if I would try an intermediate version of firmware, v 1.1.33, and try again.

I'm pleased to report that v 1.1.33 seems to be much better behaved. The protocol binding issue appears to be resolved, as well as having full SIP compliance. In fairly short order I have been able to verify that packets from the Vonage device are, indeed, staying on the WAN port for which they are designated. But there is still no free lunch.

You see, distributing traffic across two broadband connections adds overhead. Somewhere some processor must decide what packets go where, and that takes time. The net result is that total throughput in Load Balancing mode is actually somewhat lower than when using a single, dedicated WAN port. I had not thought about this.

To minimize the problem I can setup protocol binding rules to shape traffic and, essentially, perform manual load balancing. This seems to work pretty well. It lets me address my basic problem which is that my local LAN traffic was breaking up my VoIP connection, but it does little to add reliability. Now any given service or connection is subject to the service level of the broadband connection to which it is dedicated.

If my DSL line goes down (two or three times a day for 5-10 minutes each) my phone doesn't work. If my cable modem goes down (this is getting rarer now) my e-mail and web browser don't work. So I'm pretty much back where I started, except I do have clearer VoIP connections.

At least there is symmetry.

Backing Up Is Moving Forward

terrywfrazier@gmail.com — Fri, 11 May 2007 21:39:30 GMT

I downloaded a fresh copy of Acronis TrueImage Home 9.0 today and installed it on my ThinkPad. I'll be imaging the ThinkPad hard drive to an external drive tonight. Over the next week I'll be embarking on building a couple of computers. I used to enjoy doing that, but not anymore. I'm only doing it because I want to rebuild my two primary workstations - the one that went up in flames 3 years ago, and its replacement which cratered due to a dead drive controller on the mother board last summer.

Both have really nice cases, top-quality power supplies, and nice peripherals that still do what I need, so I didn't want to just toss that stuff. Besides, my luck with branded PCs is no better. They go up in flames for me, too. I'm just death on computers, for reasons that completely escape me.

These two will be clones - identical motherboards, CPU chips, DIMMs, and system hard drives. That way when the first one dies I can just swap right over to the next and keep on working. In the meantime, the backup unit will serve as a file server and A/V workstation.

I really hope these are the last two computers I ever have to build. Maybe I'll switch to Macintosh when the time comes to buy another one.

Zen and the Art of the Backup

terrywfrazier@gmail.com — Thu, 10 May 2007 03:23:05 GMT

Brent Ashley reminds us all that backups are essential to peace of mind. Which reminds me... I've been living off my laptop for more than a year since my last workstation went up in flames (gawd, I hate computers) and I really need to back it up to an external drive like, right now.

The path to serenity is via regular backups

Michael O’Connor Clarke’s recent brush with near-data-death had a happy ending, and he credits my backup advice with helping to save the day. I figure now is as good a time as any to make that advice more widely known.

The ONLY successful backup strategy is one that actually gets your system backed up regularly. This means taking it out of the hands of the procrastinator and into the hands of the automator.

In my opinion the only truly workable restore strategy is to have a disk image to restore. If you have to spend untold hours loading your OS and programs, searching for license keys and farting around with settings, passwords, adding users etc etc, just to get to the point where you can restore your backed-up data, you are wasting time and money.

A regularly scheduled disk-image backup will save your otherwise very sorry ass many many times.

I use Acronis True Image to back up my laptop. The Home version suits my needs, but the Workstation and Server products are stellar as well for a business environment.

Acronis makes a compressed image of selected partitions on your hard drive. It does this in the background while you are still using your computer. You can schedule it to happen regularly so you don’t even have to think about it.

With Acronis you can:

Make a full image of your drive

Make multiple incremental images against a full image

Save the image locally or over the network, split to multiple files or CDs/DVDs

Access the images for read or restore

Mount any full or incremental image to access a snapshot of your drive via a drive letter

Restore your machine from any full or incremental state via disk, cd, network

Restore your machine from bare metal with a rescue boot CD

Schedule backups

Automate backups so you don’t have to think about them

Define pre and post commands to run

Those are the basics you need. Beyond that you can use the rescue CD to back up and restore non-windows partitions, too - Linux and BSD for instance. There are many other features too.

I have a scheduled task set up to back up my laptop every Monday and Thursday at 2am to my home server. If my laptop is plugged into my network at home at those times, it will save a full disk image to the server. If the target directory already contains a full image, it will build an incremental image.

At the start of each month, I delete the contents of my LastMonth directory and move the current image and incrementals there. I should really write a batch to invoke pre-task to do this automatically, since this is the only thing I still have to remember to do.

I’m pretty serious about my backups. On my server, I have two 250Gb hard drives that I synchronize daily using rsync. I also copy certain critical files off to a NAS device that’s at the other end of the house and take sporadic file backups to a USB drive to take offsite. You don’t have to get that crazy about it, but for the sake of your long-term sanity, by all means set up a regular image backup of your main machines.

Diffly - A New MacOSX Software Tool

terrywfrazier@gmail.com — Tue, 10 Apr 2007 15:28:29 GMT

Matt Mower has just announced the release of his first publicly available software tool for MacOSX. It’s called Diffly and is a productivity app for software programmers. Matt has a long history of developing productivity tools for niche environments. I’ve used several over the years and always found the functionality and UI to be well thought out. Diffly is the first product Matt’s released for general consumption. But since I’m not a programmer, I’m already looking forward to the next one! Congratulations, Matt.

Pain can be a great motivator (to finish your first Mac application!)

Not the best weekend on record as I seem to have developed an ear infection which is both very painful and very uncomfortable (my jaw isn't working properly). I decided that, rather than spending the day waiting in casualty to be seen by a doctor, I would take my mind off it by debugging the problem with my first MacOSX app that has been preventing me from releasing it these last few (okay 8) weeks.

So I'm quite pleased to be able to announce Diffly my first real MacOSX application written in Objective-C using the beautiful Cocoa framework.

If you're a developer, use MacOSX, and use Subversion you might want to take a look.