Charlie Miller (big name)

I was reading for TWU (again more always) and ran into the name "Charlie Miller" which was discussed as if of course the reader would know who it was, so I looked him up. I can't believe I didn't know who this guy was.

http://www.zdnet.com/blog/security/questions-for-pwn2own-hacker-charlie-miller/2941

http://www.dailytech.com/Charlie+Miller+to+Unveil+20+Zeroday+OS+X+Exploits+at+CanSecWest/article17934.htm

http://www.zdnet.com/blog/security/pwn2own-2009-safarimacbook-falls-in-seconds/2917

http://threatpost.com/en_us/blogs/charlie-miller-mac-os-x-pwn2own-and-writing-exploits-031810

I find it interesting that he can hold the whole thing in his head at once.

Clear wifi

If you are connected to a Clear wifi hotspot (in my case, one that I own) then go to its IP, which is 192.168.1.1

At this point you can log in as admin / admin (unless someone's changed the defaults)

Or you can go to 192.168.1.1/super and log in as super / super and change the admin password from there. There's no GUI way to change the super password, but if you go into the .htapassword file, you can change it there I believe.

I'm still experimenting... while keeping in mind that there's no "reset" button on this thing and if I screw up then I will have no internet until I go somewhere else...

This idea came from an article about how to hack the Clear iSpot, which only works for apple devices and which is rather cheap per month. Therefore, if it can be hacked to work for non-mac devices... one would get a good return. Since it's all Clear hardware... it seems that it's the same. Sigh.

I'm perfectly content with my current Clear services and I don't intend to hack anything... but I'm concerned that someone could potentially log into my Clear device and change my admin password (which is no longer the default password, of course...)

So, what are the security defects here?

• The informed populace can log into my wifi hotspot and change my admin password
• There's no way (yet) for me to stop them
• Presumably, the "informed populace" can also go in and screw with my security settings, therefore opening a way for them to gather my data, including credit card information if and when I send that over the network.

Why are these security defects not that bad?

• The "informed populace" is so far very small. The wifi hotspot is also small. It's unlikely that anyone within range of it will be able to figure out how to use it... or hack those using it.
• this is probably Clear's way of resetting *lusers' admin passwords when they forget them, which is a necessary task
• With some work, I can probably change the password on the super account.

* luser is a contraction of loser and user and means an uninformed user.

ThoughtWorks Home Office Day

ThoughtWorks Home Office Day apparently hasn't happened in a while... like, a year or so (although Chi-Fridays happen every month?) Anyway, one of them happened today. I met Ronnigan, who's also a new hire starting in January. I introduced us as Newb One and Newb Two. I met a ridiculous number of people whose names I don't really remember, including the head of TW in the Americas, to whom I said "well, shit." I think that falls under the category of putting my foot in my mouth rather than speaking truth to power. He didn't seem to take it badly.

Joanne explained that TW has a very "flat" structure... which basically means that 1. I will someday get to meet Martin Fowler !!!!!!!! 2. It's normal to mingle socially at company events with people who are serious firepower.

I went to a session on Mingle, which is software that TW made to manage Agile projects with. It looks like it'll actually be useful. I like large parts of the UI. However, I am severely disappointed by how slowly that chart rendered. Seriously, it took over two minutes. Nothing should take over two minutes. Especially something that you need to do all the time...

I went to a session on noSQL, which as cool... mostly review for me, but shiny. MongoDB is a big thing at TW, it seems.

Went to a session on "the cloud" which was interesting. Lots of stuff about how it can apply to current and future TW projects, and things to watch out for... i.e. reserved vs. non-reserved instances.

I wonder what my life would be like if CleverSafe (a cloud services company) had hired me. I hope they fix the problems that the one marketing guy left behind. I still wonder how their algorithms work, dammit. (InStep Software called me to schedule an interview a couple days ago but I told them that I was currently employed. I am charmed that they called, though.)

I went to the lightning talks. I liked the one that was basically a State of the Union talk on what's up with Oracle and Java. It's all a little complicated... There was also a talk from the women's shelter people that the in-office hackathon was benefiting. And one from Julie and her Grace Hopper peeps, so that was cool.

There was a large session which focused on the three columns... breaking up into groups, etc. Post-its are awesome is the lesson here...

I went to the birds of a feather meetup and sat in the dev circle... it was pretty awesome. When Ron said "Flash" he got a kinda incredulous/eew reaction. When I said "crypto" I just got a hell of a lot of perfectly straight faces...

By the way, it turns out that the Borders that I pass on my way to TW has a bitching hacker section in their CS books. It's on the third floor... somehow, before tonight I was under the impression that there were only two floors. -shrug- Now I know. I intend to make some serious purchases someday soon... probably on Amazon, because those books are fucking expensive in-store.

As for further festivities at TW... there was beer pong, and a wine tasting... and excessive amounts of tasty beer, including Sierra and Blue Moon. So I can't fault their taste, although if there had been Guinness or cider I would've chosen that over anything.

After TW, I went to the IIT acappella concert. It was glorious. I think that it's the first time in perhaps several weeks that I've felt genuinely moved by something. They're having some trouble producing and delivering the CD that they took many pre-orders for, several months ago. I wish they would just distribute it on Bandcamp.

One of my friends bought a welding torch and he and some of the guys were practicing pulling good welding beads... on the kitchen floor... which is now scorched... sigh. Well, that can be covered up. I have to say, I'm excited to have access to a torch. (Yes, they also have a helmet facemask shield thing.) I plan to take pics of the welding in action.

prank@WSU Nov 5 awesome

"So far I've received emails from 3 news reporters, 1 job offer at Google, one from someone in Lighty, one from an angry "IT" guy, and hundreds from fans. All in all a good day. Now just to hope my real goal, students making this university a better place, will be achieved."

http://www.facebook.com/pages/WSU-1812/166561193368233?v=wall

http://twitter.com/search?q=%23wsu1812

https://chronicle.com/blogs/wiredcampus/hacker-makes-the-fifth-of-november-one-to-remember/28076?sid=wc&utm_source=wc&utm_medium=en

I admire this guy because

1. Awesome technical skills (IT actually had to pull the hardware to shut this thing off before his auto-off)
2. Whitehat (he included an auto-off at 5:01 pm and an uninstall script, with instructions on his website)
3. V for Vendetta is awesome (yes, I celebrate Guy Fawkes day by watching it)
4. He knows how to cover his tracks (hasn't been identified yet)
5. Google offered him a job without knowing his identity
6. He wants to improve his campus (yeah, I was in student government when I was in college... can you tell?)

I mean... isn't that enough? Dude.