More tampering with computer hardware at factory

El Reg is running a story (based on a Telegraph article) describing trojaned POS (Point Of Sale) terminals. Apparently during manufacture or shortly after (and before shipment) the chip-and-pin devices were modified to send account details "overseas" (Pakistan is named). (Europe has a high penetration of smart cards that act as currency/credit cards unlocked at the time of purchase by a PIN the owner enters on a device at the store.)

The perpetrators apparently wait a couple of months after getting the data before making fraudulent transactions, making it harder to determine what's going on.

Much like the Cisco issue this highlights supply-chain control problems.

QRCode

Process Control Systems Forum Conference

I'm going to the PCSF conference on August 25. The forum provides a venue for those interested in the security of control systems (SCADA, etc.) to collaborate and define best practices. This is the annual meeting. There are several training classes available to attendees for free (which are normally rather expensive).

HOPE Streaming

The New York City hacker conference HOPE is streaming live all weekend long. They are considering streaming video in the next few hours.

Hardware-free KVM

Synergy lets you control a variety of systems with a single keyboard and mouse. It communicates over an open TCP protocol, but you can (much like VNC) wrap it with OpenSSH. (And in my experience with VNC, turning on compression in OpenSSH improves performance as well.) It adds cross-platform clipboard as well.

Cory's latest is out

Little Brother is released. Educate the next generation. Get it on dead trees or in a non-DRM unabridged audiobook below.

Security Tweets

No, not TWITs, but Infosec folks who are on Twitter. I might be pegging my SMS tolerance, but what the heck. Mediaphyter has collected some prominent ones.

See you in 160 characters or less!

Rails on Ubuntu

Aagh. Ubuntu has let me down (doesn't happen often). An install of everything Ruby like so:

sudo apt-get install ruby-full

completes just fine, but gems is broken when you try to run an application:

ruby script/server

I found a great page to help here.

Rails

So I'm starting to learn Rails. I'm trying to get my head around MVC (model, view, controller) programming, and Java isn't helping. The first notable thing I've come across is that the testing subsystem is automatically generated when you create models. They're stubs, but filling them out before populating your models appears to be a way to write specifications into the testing harness before you actually create the code, which then forces you to wire the code to meet the tests (instead of the other way 'round).

There's some application here for high-assurance programming... Perhaps if a formal modeling system kicks out Ruby test cases instead of (or in addition to) ML we'd have something...

Charity of the Month

The Electronic Frontier Foundation (EFF). No foolin'.

They work to protect your rights in the digital domain. Because you didn't wake up this morning and decide you wanted to do less with your CDs, DVDs and other media.

Shmoocon!

Well, Shmoocon is done. I participated in the Labs, and learned a tremendous amount. Since I missed presentations during the weekend I bought ten of the videos (I usually buy a bunch to support the video team).

I did the Hack or Halo again. Got my butt handed to me in Halo (I accepted the default controller config, forgetting I always run with inverted controls... aghhh! Lots of floor-to-ceiling head-snaps). Rick joined me in the Hack side, and we each had a session, tag-teaming. We missed an opportunity to do the lockpick (didn't take advantage of a fsck-delay we hit), but I think we ended up with nearly a dozen points. Didn't win, of course, but had a blast. Apparently I was one of the few who recognized the Turing ASCII-art. (Does that mean I passed the Turing test?)