The Hacker Factor Blog

There's a couple of random thoughts rumbling around my head... Rather than writing a blog entry on each, I decided to just mention them here.

Oiling The Machinery

Everyone is complaining about the oil gusher in the Gulf of Mexico. And everyone seems to have their own solutions. Use hair, use hay, construct a man-made barrier island, send down sludge, and more. British Petroleum has a couple of solutions lined up -- if one fails, then they will try the next. One of their solutions won't be ready until August! Some people think the government should take over the capping processes, but our government can't even pave roads without months of debate.

A few people are blaming Obama for this problem. (These are probably the same people who are upset that the Republicans lost the election and still watch Glenn Beck.) Frankly, we can't blame Obama for this one. Blame Bush? Sure -- he caused it by easing governmental regulatory oversight between 2006 and 2008. Obama only inherited this mess. And given other messes like Health Reform, Financial Reform, Immigration Reform, and Lobbying Reform... Regulatory Oversight Reform is just another item in the to-do list.

Anyway, I think I know the solution to quickly stopping the oil gusher. Congress should pass a resolution preventing BP from collecting any revenue until the gusher is capped and the cleanup is completed. Until both of those happen, any revenue received by BP should either go toward capping and cleanup, or be forfeited to the government and impacted states. If we cut off their revenue, then they will have an incentive for achieving a faster solution.

Google and SSL

Google recently released a beta of an SSL solution for their search engine. (https://www.google.com) They claim that this will improve privacy:

This secured channel helps protect your search terms and your search results pages from being intercepted by a third party. This provides you with a more secure and private search experience.

There's a few problems here. First, SSL is a placebo. From a security perspective, it does not add very much security or privacy. To gain security and privacy, you really need SSL with client-side certificates -- but Google isn't offering that.

Second, I find it ironic that Google is offering a security and privacy solution. I mean, they store every search, associate searches with user accounts, and cache personal information. So for them to be concerned about search privacy is just... funny.

Summer's Here

Summer vacation has clearly started. The number of malware and attackers scanning my web site for vulnerabilities has increased 10x compared to last month. Looks like the k1dd13z are out of school.

The uptick includes a significant increase in scans for WordPress vulnerabilities. Sample initial scans look like this:

2010-05-03 11:10:10 | 72.46.136.130 | GET /wp-login.php

2010-05-09 17:43:28 | 188.40.73.239 | POST /wp-admin

2010-05-24 17:52:37 | 213.231.27.46 | GET /blog/wp-includes/js/tinymce/wp-mce-help.php

2010-05-24 17:52:40 | 213.231.27.46 | GET /blog/wp-admin/upgrade.php

2010-05-24 23:24:35 | 69.245.165.224 | GET /blog/wp-login.php

Of these scans, it is the tinymce one that bothers me the most. This is a WYSIWYG editor and it has a history of remote access vulnerabilities. If you don't need it, consider removing it or locking down your htaccess file and web pages.

Arizona State Lottery

Arizona recently passed Senate Bill 1070. The law basically says that people suspected of being illegal aliens will be asked to provide proof that they are permitted to be in the USA. Failure to provide proof can lead to incarceration and/or deportation.

I'm not going take a side on whether this law is racial profiling or justified. (Let's leave that debate to the pundits and citizens of Arizona.) Rather, I'm looking at this from the hacker point of view. The first US Citizen that is arrested and/or deported under this law will have a heck of a lawsuit. Most likely, the victim will receive an out-of-court settlement as an apology because the case won't have legs to stand on if a provable citizen goes to court. Anyway, this law should be called the Arizona State Lottery because you too can become a millionaire overnight!

Many years ago, I used to go to auctions to pick up computers, peripherals, and other odds and ends. Although I would get the equipment for my own use, I'd still browse through anything that came with my auction winnings.

Burnt in monitor? What did it say?
Old ribbon in a typewriter? What was last typed?
Receipts in a cash register? I can't believe someone paid that much!

But the biggest gold mine was always the hard drives. 99% of the time, there wasn't anything incriminating. Old emails, random data files, and standard (usually unpatched) operating systems. Occasionally I'd find something disturbing... love letters between a faculty member and his student, porn collected by some grad student, or passwords stored in plain text for an entire department. (Most of the auctions I attended were for old university equipment. One time they even auctioned off a Cray!)

Stored Privacy

I always found these drives to be a fun way to try new forensic tools. Deleted files, uncommon (or old) partition formats, and corrupted data made the challenge fun. But it also made me keenly aware: never give out hard drives. If a drive fails, destroy it. If a drive exists in an outdated computer, destroy it. And if a drive is just too old to use, then destroy it.

Seriously: deleting the content is rarely enough. Someone who gets it could recover data. Formatting the drive may also not be enough. (Spinrite is an awesome recovery tool.)

There is always someone who argues about using multiple formats, like "What if I format it 27 times?" or "What if I overwrite the drive with a ton of random patterns?" While those might deter recovery, you can never be 100% certain. And even if the data cannot be recovered today, there is a chance that someone will create a new tool that can recover the data tomorrow.

Frankly, the best solution is a degausser and a drill press. There are even industrial metal shredders, but those are too expensive for most small-to-midsized businesses. Besides, having a drive destroying party is actually fun for the whole family! Here's a great contest: speed destruction. Who can tear apart a drive the fastest, without damaging anything? (My fastest is 4 minutes, 21 seconds on a Barracuda. I could have cut off a minute, but I damaged one of the heads.)

Necessary Equipment

The main things you will need:

• Set of various hex screwdrivers. This includes really small, metric hex screwdrivers.
  
• A small flat and Phillips head screwdriver.
  
• One really big, flat screwdriver (for prying when all else fails).
  
• A dremmel tool (for drilling out any screws if you don't have the correct tool).
  
• A bulk tape eraser, or set of strong Earth magnets (for erasing platters).
  
• A small tin for holding all of the loose parts.

Older drives (MFM, RLL, and even old ATA) usually use flat or Phillips screws. Most newer drives use 6-sided hex screws.

Tearing the drive apart really just means removing every screw you can find. And there are always 1-2 screws under the sticker labels. I usually run my finger across the label until I find the dimple where the screws are located. Then I cut through the label (just stick a sharp screwdriver into the dimple) and remove the hidden screws.

The disk platters usually have very tiny hex screws. Remove them and the entire stack will come apart.

Finally, there are two really strong magnets that control the head's position. These are GREAT for hanging stuff on the refrigerator. These magnets are usually mounted in metal brackets -- and removing them is a serious pain. If you can remove them, then wipe them over the platters to erase the disks. Otherwise, use a bulk tape eraser. (Use the eraser AWAY from all of the other small parts, because EVERYTHING magnetic will fly toward the eraser!)

If you just want to destroy the data, then consider shattering or drilling holes in the platters.

Waste Not Want Not

The first few drives I tore apart were a learning experience, but I threw everything out. Today, I just gotta use them for something. Initially I used the parts to make techie clocks. However, after the 10th clock, it got boring.


Now I'm into more functional artwork. Like this multi-level earring holder. (She really liked it.) I stripped a broken camera tripod for the base.


I've still got a couple of dozen hard drives than need dismantling. (My last auction purchase was a RAID. It was a great $20 buy, but now it is just too slow, too small, and too power intensive. Time to make art!) So my question is, what do you do with your old hard drives? And if you make things, what do you make?