I made a mistake.
I've got a lot of work related books to read, and the list is getting longer all the time. Over the weekend I picked up a book on speed reading. 2 actually, at the local library. 1 is a 10 day program, the other I'm not sure about.
Anyway... The NEW 3rd edition of Hacking for Dummies (something recommended at the Ethical Hacker Forums) is coming out soon. The other week, I asked if I should get 2nd ed for 15.00 via Amazon, or wait until December. They said if I could get it now, and read it now, I'd learn more by practicing now, than waiting for the new edition in December. Since I have so much to read, I figured I'd wait. Focus on things that need to get done at work. (Things like setting the networking graphs up (got the ones I needed done), setting up the server monitoring tools (large book), fixing the broken servers (waiting on parts) ).
For some reason between last week, and this week I started looking at the online 2nd edition of HfD on Safari. They won't let me download the whole book, I'm assuming because the new one is coming out. But other than speed reading, that's all I read today (book wise). I finished the preface, the introduction and the first 2 chapters (printed the chapters off for a car pool that did not happen). I've been using some of the tricks I'm picking up in the speed reading book.
Although my reading speed is still between 265 and 300 wpm, with a comp between 70 to 90 % right now.
I'm enjoying Hacking for Dummies, I can't wait to read chapter 3... but I really really should finish Firewalls and Internet Security. I'm about 2/3 of the way done with it so far. The furthest I ever made it. I'm still torn between buying 2nd or 3rd edition of HfD too. I have a feeling I'll end up buying both.
Lastly I should really, really, really be studying for a certification exam (and trying to find a way to pay for it (CCNA, LPI, wouldn't mind Sec+ but I have the books for the other ones)), or writing the essay that's due tomorrow for my 1st gup test in Tang Soo Do.
Lots to do at work too... I'd say I need a time management book, but I've already read Time Management for the System Administrator 2x, and how I'm finding time to do everything I need. I've got a block of time (ie lunch tomorrow) for the essay questions (note they're designed for kids).
Of course, the biggest question at this point is where do I want my career to go?
Monday, August 31, 2009
Saturday, August 29, 2009
Four lies and one martial arts fact
Jesse at The Martial Explorer has tagged me in a silly internet blogger chain-meme-thingie. (copying and pasting with minor edits the first 2 paragraphs and the question at the end). I don't have any regular Martial Arts readers that I can think of, so if you do Martial Arts, and read this, consider yourself tagged. I also don't normally do these (friends comment about me not doing them when they tag me elsewhere), but it could be fun.
The meme works as follows. You post five things about yourself. Four are untrue. One is true. All are so outlandish, implausible or ridiculous that no one would be inclined to believe that any of them are true. And despite the pleas from your readers, you never divulge which is true and which are fabrications. You then tag five other people (four seriously and one person you are pretty sure would never participate).
1) I threw up on my Grand Master at the club Christmas Dinner when I was a kid.
2) I broke my foot doing a kidnapping drill in the Kid's class.
3) I threw my partner through the judging table on my 4th gup test.
4) I once did 200 punishment push-ups.
5) I had my 2nd gup test canceled in the middle of it, so I could be rushed to the ER after having my hand cut open during the knife and club defense part.
Do you know which one is the truth?
The meme works as follows. You post five things about yourself. Four are untrue. One is true. All are so outlandish, implausible or ridiculous that no one would be inclined to believe that any of them are true. And despite the pleas from your readers, you never divulge which is true and which are fabrications. You then tag five other people (four seriously and one person you are pretty sure would never participate).
1) I threw up on my Grand Master at the club Christmas Dinner when I was a kid.
2) I broke my foot doing a kidnapping drill in the Kid's class.
3) I threw my partner through the judging table on my 4th gup test.
4) I once did 200 punishment push-ups.
5) I had my 2nd gup test canceled in the middle of it, so I could be rushed to the ER after having my hand cut open during the knife and club defense part.
Do you know which one is the truth?
Sunday, August 23, 2009
How I spent my Saturday Night...
I'm a geek. I know it. Being broke doesn't help matters much.
For fun tonight I played with the Network Forensics Puzzle that was on ISC.SANS.ORG earlier this week.
I'm no expert, some stuff was beyond my skills tonight before I started. In fact I only started playing, not doing the contest, because someone in a forum posted what tool to use to extract the data. Here is a quick walk through of what I did, without giving to much away I hope.
Downloaded the pcap file and checked the md5sum
They matched so I moved on.
I knew how to load a pcap file into 2 different programs, so I ran it in both, filtering on just the ip address I needed (the user's ip address).
I then looked through the data, using what I knew of layout to get the username of who the spy was talking too.
Then I found the first comment. Using the same method (reading), I found the name of the file being transferred.
Then I extracted the data that was transferred from the stream. If I knew the magic number, the only part I wasn't able to find, it might have been easier. I used tcpxtract for that bit of magic.
At fist I was thinking what was extracted was more like rar files you can find online. Where you unrar the first file, and the rest are used to build the first. While I was eating I realized that might not be the case, and there may have been 37 different files that were actually transferred. It was a case of having just learned to use tcpxtract.
Once I realized that, I found the files that would open with Ark, and which ones didn't. The ones that didn't I ignored. I then tried to extract the others. Only 2 extracted. Again the others I ignored. One was a manifest file, the other the file I wanted. I looked up the document in the file and got the recipe.
Then after bashing my head around some, I figured out, based on comments others had made and how the file is really stored, to change the un-extracted file's name to the right name, and tried opening it with Open Office. it worked. Grabbed the md5sum off that.
Out of the 6.5 requests in the challenge, I did 5 of them. I never found the magic number. :( and I didn't bother to try to script it (computer program) to do the work for me. Because I never found the magic number, and I don't think my programing skills are sharp enough. Although, I didn't think my computer forensics skills were sharp enough at the beginning either.
For fun tonight I played with the Network Forensics Puzzle that was on ISC.SANS.ORG earlier this week.
I'm no expert, some stuff was beyond my skills tonight before I started. In fact I only started playing, not doing the contest, because someone in a forum posted what tool to use to extract the data. Here is a quick walk through of what I did, without giving to much away I hope.
Downloaded the pcap file and checked the md5sum
They matched so I moved on.
I knew how to load a pcap file into 2 different programs, so I ran it in both, filtering on just the ip address I needed (the user's ip address).
I then looked through the data, using what I knew of layout to get the username of who the spy was talking too.
Then I found the first comment. Using the same method (reading), I found the name of the file being transferred.
Then I extracted the data that was transferred from the stream. If I knew the magic number, the only part I wasn't able to find, it might have been easier. I used tcpxtract for that bit of magic.
At fist I was thinking what was extracted was more like rar files you can find online. Where you unrar the first file, and the rest are used to build the first. While I was eating I realized that might not be the case, and there may have been 37 different files that were actually transferred. It was a case of having just learned to use tcpxtract.
Once I realized that, I found the files that would open with Ark, and which ones didn't. The ones that didn't I ignored. I then tried to extract the others. Only 2 extracted. Again the others I ignored. One was a manifest file, the other the file I wanted. I looked up the document in the file and got the recipe.
Then after bashing my head around some, I figured out, based on comments others had made and how the file is really stored, to change the un-extracted file's name to the right name, and tried opening it with Open Office. it worked. Grabbed the md5sum off that.
Out of the 6.5 requests in the challenge, I did 5 of them. I never found the magic number. :( and I didn't bother to try to script it (computer program) to do the work for me. Because I never found the magic number, and I don't think my programing skills are sharp enough. Although, I didn't think my computer forensics skills were sharp enough at the beginning either.
Tuesday, August 18, 2009
Another Open Letter to AT&T
Dear AT&T:
On occasion to support my position at work I have to use my home system. One of the things I do is run Nmap (network mapper) on work's Net-Block. I use it to find out what ports are open, and make sure that only the ones that should be are open. I usually do this via an SSH connection from work.
Each time, coming home. I've had problems using my home PC. Trying to access anything on the internet, anything that wasn't an active session when AT&T / 2WIRE did their magic, brings up a page an error page. Other things, like my mail monitoring tool don't have that problem and when I opened my web email, it worked. However going to other sites from there brings back up the error page, and sets off ABE (application boundaries enforcer).
The error page says it's detected "a router behind a router". Which isn't the case. To "FIX / Resolve" the issue, places my home system INTO A NON-PROTECTED DMZ is not an acceptable solution. While I don't have a lot of ports open, I'd still prefer if people didn't have easy access to them. Here is section saying that everything is open.
"Allow all applications (DMZplus mode) – Set the selected computer in DMZplus mode. All inbound traffic, except traffic which has been specifically assigned to another computer using the “Allow individual applications” feature, will automatically be directed to this computer. The DMZplus-enabled computer is less secure because all unassigned firewall ports are opened for that computer."
STOP PUTTING MY EQUIPMENT AT RISK TO BLACK HATS AT&T. FIX YOUR SYSTEM.
On occasion to support my position at work I have to use my home system. One of the things I do is run Nmap (network mapper) on work's Net-Block. I use it to find out what ports are open, and make sure that only the ones that should be are open. I usually do this via an SSH connection from work.
Each time, coming home. I've had problems using my home PC. Trying to access anything on the internet, anything that wasn't an active session when AT&T / 2WIRE did their magic, brings up a page an error page. Other things, like my mail monitoring tool don't have that problem and when I opened my web email, it worked. However going to other sites from there brings back up the error page, and sets off ABE (application boundaries enforcer).
The error page says it's detected "a router behind a router". Which isn't the case. To "FIX / Resolve" the issue, places my home system INTO A NON-PROTECTED DMZ is not an acceptable solution. While I don't have a lot of ports open, I'd still prefer if people didn't have easy access to them. Here is section saying that everything is open.
"Allow all applications (DMZplus mode) – Set the selected computer in DMZplus mode. All inbound traffic, except traffic which has been specifically assigned to another computer using the “Allow individual applications” feature, will automatically be directed to this computer. The DMZplus-enabled computer is less secure because all unassigned firewall ports are opened for that computer."
STOP PUTTING MY EQUIPMENT AT RISK TO BLACK HATS AT&T. FIX YOUR SYSTEM.
Monday, August 17, 2009
centos install
So I'm rebuilding my RedHat 4es based DNS boxes at work with CentOS 5.3. Partly because I don't have RH support anymore, partly to get the latest security fixes, and lastly because I've been wanting to rebuild them for a while.
CentOS had been giving me problems with installing since Saturday Night (note these are production systems and I had to create 2 new ones to cover the load, which went with no problem last week). Now I'm sure I could have stayed and got it working in an hour or so Saturday night, but 1) I was sick. 2) I didn't have any blank discs and the DVD I was using was scratched up pretty bad.
The load on this one server, kept getting to the point where it would try to install the drivers for the usb-storage. I'm assuming that means the CD-rom drive. And I'll explain why.
Looking around wasn't much use, I was looking for something along the lines of the knoppix cheat sheet. Something that told me all my boot options. But even googling the problem I was having wasn't much use. Until I used linux.google.com.
Someone else had a similar problem with their box, and turning off USB worked for them. However when I did that, my blade no longer saw my cd-rom drive. (The cd-rom drive is connected via ILO, and I've never had this problem before). Re-enable, and tell it to start without the storage driver worked. (linux nousbstorage). However, I was then left with having to do a net based install.
I had to do those for my virtual boxes last week, so no great problem there.
Once again I wonder why I'm doing CentOS installs, but meh. Personally I'd rather do Debian or Gentoo, but this is what the business told me to run.
CentOS had been giving me problems with installing since Saturday Night (note these are production systems and I had to create 2 new ones to cover the load, which went with no problem last week). Now I'm sure I could have stayed and got it working in an hour or so Saturday night, but 1) I was sick. 2) I didn't have any blank discs and the DVD I was using was scratched up pretty bad.
The load on this one server, kept getting to the point where it would try to install the drivers for the usb-storage. I'm assuming that means the CD-rom drive. And I'll explain why.
Looking around wasn't much use, I was looking for something along the lines of the knoppix cheat sheet. Something that told me all my boot options. But even googling the problem I was having wasn't much use. Until I used linux.google.com.
Someone else had a similar problem with their box, and turning off USB worked for them. However when I did that, my blade no longer saw my cd-rom drive. (The cd-rom drive is connected via ILO, and I've never had this problem before). Re-enable, and tell it to start without the storage driver worked. (linux nousbstorage). However, I was then left with having to do a net based install.
I had to do those for my virtual boxes last week, so no great problem there.
Once again I wonder why I'm doing CentOS installs, but meh. Personally I'd rather do Debian or Gentoo, but this is what the business told me to run.
My soap box on a public option
Word in the blogosphere tonight is saying the public option is dead.
Where to even start on this one. We need a public option.
Fear has been spread of Death Panels. The truth is, we already have them. On a regular basis people with "Insurance" are denied coverage for trumpet up reasons. You could say I'm being a Left wing nut job on this one, but when you have people testify to Congress that they're job was to find reasons to deny coverage (Public Record, go look it up) what else can you call it but a Death Panel? Maybe a Greed Panel is a better term for them. After all, they're not so much about killing the patient, as saving the company money. The patient dying is just a side-effect of protecting the bottom line. In other words they're saying a person's life is just part of doing business.
Between when I was hit by a car (2003) and my brother's recently broken knee (2009), I've seen it myself how the insurance companies stand between the Doctors and the patients.
I was hit by car while working, so workman's comp picked up "the bills" (just not all of them). The problems started before I even left the accident scene. Do I get life flighted or raced in the back of the ambulance? Life Flight was more expensive than the ambulance. The choice was the ambulance because they thought it would be better for me to die in that than in the air, and it'd free up the chopper for someone that might actually make it to the hospital. (I've always been stubborn, so I made it via ambulance).
While I was still in Surgical ICU the insurance company complained about the time I was spending in the hospital. After I was released, it continued to go down hill. Every time I saw a doctor, an insurance company nurse (an LPN if I remember right) was in the room. Her whole reason to be there was agree or disagree with the doctor on what treatments I needed. I HAD TO FIGHT FOR A PSYCH EVALUATION, because the personality shift I had wasn't worth them worrying about. Only reason I even got one was because I went and set it up myself. Then it became a race to see the doctor I selected vs their corporate whore / shrill of "Doctor". Then they refused to pay for it, even though they sent me to 2 of their whores (the first one agreed with the doctor I chose). I never got any of the counseling 2 of the 3 Doctors said I needed. Not once did I receive any physical therapy, and the cane I walked with for months, was paid for out of my own pocket. The PNMR guy was more interested in sucking up to the insurance company than treating the patient. Physical damage included my brain, my neck and my hip. (I had to learn to walk again, on my own).
My brother is Mental Handicapped, because of that he's on SSI (with medicare). I got him to take Tang Soo Do with me. The school I study at has a history with teaching the mentally handicapped. My brother is 5'9" and about 95lbs. When he was in jr high (in the 90s), he joined the wrestling team, and some how managed to break his knee. He had a healthier weight back then. In April or so this year (2009), he was working a kick drill, but not shifting his weight right. As a result, the knee that had the scar tissue and the like broke again. At first we thought it was a sprain, so I took him home, and our mom iced it. The next day, it was 2x the size. So I took him to the ER (he's afraid of hospitals). We had problems with one Doctor, but were able to get a second opinion. He got free crutches and a free brace for his knee (things my mom could not afford), physical therapy, x-rays at each follow up visit, and lots of great advice. Not once did someone from Medicare or the Government show up to tell the doctors what they could and could not do.
A health care co-op won't work. They won't have the power that the big companies have. They'll look good, but won't last. Not when Big Insurance can reward and punish the peasants.
During Open Enrollment last year at work, the Blue Cross rep they sent out, said we'll be punished for using our Insurance (not the exact wording but the gist of it). How? Our premiums will go up. We'll have to pay even more than we are now. But if we grit our teeth and bare it, our premium will go down, and we'll be rewarded for being good little peasants who don't upset their golden apple cart.
The "Tea-baggers" have been saying that they'd lose their current health care if there was a public option. Sadly they're probably right. Not because the United States Government would mandate it, but because Companies would see it would be cheaper to force their employees into it. The company saves money, and has a better bottom line. You think they'd pass the money on the employees? Please the employees are slaves. Most of the people with jobs are doing more work with less pay.
Most employees don't realize that though. They think that the company screwing them is in the employee's best interest. From a conversation with a guy from FedEx last week. Nutshell version "Yeah, FedEx cut my pay, I have more work to do, but I still have a job". Talking about Unions and UPS. He said UPS had better benefits and pay. But because of UPS being a union shop, UPS let people go instead of doing pay cuts. (Or so the FedEx guy claimed).
Glen Beck lately has been talking about how great the American Health Care system is. Go look up his news stories from January 2008. He said on the air (at cnn I believe) that the American Health system was crap. He didn't say it just once either. He said it in a video from home when he was recovering. He said it on the air multiple times.
Now he's saying that the US has the best Health Care in the world. If that's the case, why did Remote Area Medical start opening up around the country? Remote Area Medical is supposed to be for 3rd world countries to help the people there to have a fighting chance. Has the United States become a 3rd world country?
We, The People of the United States, need change. We need to stop having a 3rd world level health care system and actually start pretending to be an industrial country again. Why is it other countries, countries we're told we're better than, have free health care? If we're so much better why don't we have a health care system they want instead of one they criticize (go look up the news papers coming out of England this week, we're being laughed at. The Daily Mirror called the U.S. The "Land of the Fee").
Where to even start on this one. We need a public option.
Fear has been spread of Death Panels. The truth is, we already have them. On a regular basis people with "Insurance" are denied coverage for trumpet up reasons. You could say I'm being a Left wing nut job on this one, but when you have people testify to Congress that they're job was to find reasons to deny coverage (Public Record, go look it up) what else can you call it but a Death Panel? Maybe a Greed Panel is a better term for them. After all, they're not so much about killing the patient, as saving the company money. The patient dying is just a side-effect of protecting the bottom line. In other words they're saying a person's life is just part of doing business.
Between when I was hit by a car (2003) and my brother's recently broken knee (2009), I've seen it myself how the insurance companies stand between the Doctors and the patients.
I was hit by car while working, so workman's comp picked up "the bills" (just not all of them). The problems started before I even left the accident scene. Do I get life flighted or raced in the back of the ambulance? Life Flight was more expensive than the ambulance. The choice was the ambulance because they thought it would be better for me to die in that than in the air, and it'd free up the chopper for someone that might actually make it to the hospital. (I've always been stubborn, so I made it via ambulance).
While I was still in Surgical ICU the insurance company complained about the time I was spending in the hospital. After I was released, it continued to go down hill. Every time I saw a doctor, an insurance company nurse (an LPN if I remember right) was in the room. Her whole reason to be there was agree or disagree with the doctor on what treatments I needed. I HAD TO FIGHT FOR A PSYCH EVALUATION, because the personality shift I had wasn't worth them worrying about. Only reason I even got one was because I went and set it up myself. Then it became a race to see the doctor I selected vs their corporate whore / shrill of "Doctor". Then they refused to pay for it, even though they sent me to 2 of their whores (the first one agreed with the doctor I chose). I never got any of the counseling 2 of the 3 Doctors said I needed. Not once did I receive any physical therapy, and the cane I walked with for months, was paid for out of my own pocket. The PNMR guy was more interested in sucking up to the insurance company than treating the patient. Physical damage included my brain, my neck and my hip. (I had to learn to walk again, on my own).
My brother is Mental Handicapped, because of that he's on SSI (with medicare). I got him to take Tang Soo Do with me. The school I study at has a history with teaching the mentally handicapped. My brother is 5'9" and about 95lbs. When he was in jr high (in the 90s), he joined the wrestling team, and some how managed to break his knee. He had a healthier weight back then. In April or so this year (2009), he was working a kick drill, but not shifting his weight right. As a result, the knee that had the scar tissue and the like broke again. At first we thought it was a sprain, so I took him home, and our mom iced it. The next day, it was 2x the size. So I took him to the ER (he's afraid of hospitals). We had problems with one Doctor, but were able to get a second opinion. He got free crutches and a free brace for his knee (things my mom could not afford), physical therapy, x-rays at each follow up visit, and lots of great advice. Not once did someone from Medicare or the Government show up to tell the doctors what they could and could not do.
A health care co-op won't work. They won't have the power that the big companies have. They'll look good, but won't last. Not when Big Insurance can reward and punish the peasants.
During Open Enrollment last year at work, the Blue Cross rep they sent out, said we'll be punished for using our Insurance (not the exact wording but the gist of it). How? Our premiums will go up. We'll have to pay even more than we are now. But if we grit our teeth and bare it, our premium will go down, and we'll be rewarded for being good little peasants who don't upset their golden apple cart.
The "Tea-baggers" have been saying that they'd lose their current health care if there was a public option. Sadly they're probably right. Not because the United States Government would mandate it, but because Companies would see it would be cheaper to force their employees into it. The company saves money, and has a better bottom line. You think they'd pass the money on the employees? Please the employees are slaves. Most of the people with jobs are doing more work with less pay.
Most employees don't realize that though. They think that the company screwing them is in the employee's best interest. From a conversation with a guy from FedEx last week. Nutshell version "Yeah, FedEx cut my pay, I have more work to do, but I still have a job". Talking about Unions and UPS. He said UPS had better benefits and pay. But because of UPS being a union shop, UPS let people go instead of doing pay cuts. (Or so the FedEx guy claimed).
Glen Beck lately has been talking about how great the American Health Care system is. Go look up his news stories from January 2008. He said on the air (at cnn I believe) that the American Health system was crap. He didn't say it just once either. He said it in a video from home when he was recovering. He said it on the air multiple times.
Now he's saying that the US has the best Health Care in the world. If that's the case, why did Remote Area Medical start opening up around the country? Remote Area Medical is supposed to be for 3rd world countries to help the people there to have a fighting chance. Has the United States become a 3rd world country?
We, The People of the United States, need change. We need to stop having a 3rd world level health care system and actually start pretending to be an industrial country again. Why is it other countries, countries we're told we're better than, have free health care? If we're so much better why don't we have a health care system they want instead of one they criticize (go look up the news papers coming out of England this week, we're being laughed at. The Daily Mirror called the U.S. The "Land of the Fee").
Thursday, August 13, 2009
ugh this week
I've felt like crap this week. I've been popping Tums. If you know me, 1 roll will last me 3 years easy... They usually go bad before I can get through about 1/4 a roll. However I have 2 open rolls right now. one at work and one at home.
Only think I can think is different, is I'm eating more mixed nuts.
My weight went from 232 Sunday, to 238 Wednesday, and 235 today.
In the good news though. My diet and exercise goal worked. Even if I didn't make all 6 weeks like I had wanted to. The goal was to fit into a size 5 toe balk. The reason is because I have 2 or 3, with the club patches on it. Maybe someday I'll get a decent flag and put on it (have to find the right one first). Either a world citizen logo flag, a UN flag, or a black flag. That's a political discussion for another day.
Anyway, I wore a size five tonight. It was a little tight. Couldn't get my knees as high as usual in chamber, the top was a little tight around the stomach and sides.
I'm actually pretty geeked about it really.
Only think I can think is different, is I'm eating more mixed nuts.
My weight went from 232 Sunday, to 238 Wednesday, and 235 today.
In the good news though. My diet and exercise goal worked. Even if I didn't make all 6 weeks like I had wanted to. The goal was to fit into a size 5 toe balk. The reason is because I have 2 or 3, with the club patches on it. Maybe someday I'll get a decent flag and put on it (have to find the right one first). Either a world citizen logo flag, a UN flag, or a black flag. That's a political discussion for another day.
Anyway, I wore a size five tonight. It was a little tight. Couldn't get my knees as high as usual in chamber, the top was a little tight around the stomach and sides.
I'm actually pretty geeked about it really.
Subscribe to:
Posts (Atom)
