what would pee wee say?

Q: What would Pee Wee Herman say if he were a malware analyst?

A: "Connect the bots, la la la la" 

loose clicks sink ships again

one of the items in this section of the secmeme store

so, i have no idea where i originally heard the catch phrase "loose clicks sink ships" but i thought it was a pretty cool play on "loose lips sink ships" and it certainly promotes the idea of being careful where you click and/or what you do online. so cool in fact that i made a graphic to go along with it and put it on a whole bunch of stuff, including a mouse pad (so you can be reminded to be cautious every time you click).

as always there's zero markup for me so the prices are as low as i am able to make them. want a shirt or a sticker or something else to remind people to be careful where they click? go get one.

loose clicks sink ships

from here (source image one, two, three, and four)

am i blaming the victim? well, there's really no right way to announce to the world that your valuables are unguarded.

sharing your vacation status on sites like facebook or twitter while you're actually gone is a good example of the catch phrase:

loose clicks sink ships

i iz nigerian prinz

from here (image source)

i can't imagine what else one would picture in their mind when reading an email from a supposed nigerian prince.

dead serious

from here (image source one, two, and three)

it's kind of amazing what happens when you give authority to people who don't deserve it. dumping human remains on the airport floor and then laughing about it seems like a rather obscene abuse of power.

if you send people's own passwords back...

if you send people's own passwords back to them when they forget, then you might be a security idiot.

the root vulnerability

from here

it may not be politically correct to blame the victim, but i'm going to call a spade a spade (or maybe even a god damned shovel) and say that if your unpatched system keeps getting pwned then ... there's your problem  right there [points at reader]...

homegrown camouflage

found on very demotivational

normally camouflage is meant to help you blend into the vegetation (or maybe the sand, or ice), but i guess if you want to sit on your deck and wait for your adversary to come to you then this could work too.

american spies

a not-so long time ago
in an iranian computer
a flash drive got plugged in
and we knew if we had our chance
we could make those centrifuges dance
and maybe then our safety could begin
but the malware got discovered,
it's true intent was soon uncovered
bad news for the POTUS,
the AV's finally caught us
i can't remember if i sighed,
a weight was gone from deep inside
but others were still filled with pride
the day that stuxnet died

so, why why did you american spies
make a virus meant to save us but infected our guys
your enemies can now repurpose your prize, singing...
this is how the cyber peace dies
this is how the cyber peace dies

did you read the art of war,
and do you know what strategy is for
or does it just sit on your shelf
when arms can be copied for free,
launching our own is stupidity
i hope that you're proud of yourself
well i know your goals were helped by flame
and i know that duqu did the same
we heard more than a peep,
oh, these secrets you can't keep
they were anonymous sources, but still
the rumour's out now and you can't kill
the idea that it was your will
the day that stuxnet died

i started singin, why why did you american spies
make a virus meant to save us but infected our guys
your enemies can now repurpose your prize, singing...
this is how the cyber peace dies
this is how the cyber peace dies

asymmetry favours attack,
unless it helps others strike back
so choose your tactics carefully
attribution is said be hard,
unless your man is a retard
who blabs about things carelessly
of all the countries one could toast
we're the ones vulnerable the most
we may think we're the best
we're more dependent than the rest
oh, the wealth of our society
is owed to our technology
so who'll be the next casualty
the day that stuxnet died

and we're singing, why why did you american spies
make a virus meant to save us but infected our guys
your enemies can now repurpose your prize, singing...
this is how the cyber peace dies
this is how the cyber peace dies

why why did you american spies
make a virus meant to save us but infected our guys
our enemies can now repurpose your prize, singing...
this is how the cyber peace dies
this is how the cyber peace dies

well, according to mikko, yesterday was the day that stuxnet stopped spreading so in celebration i couldn't help myself but build on the idea of 'the day that stuxnet died'. it may not be my best work but with this subject, if i took too long it would go stale.

as i'm sure you realize, this is a parody of american pie. it doesn't have as many verses, but the original is damn long and when i look at some of the other parodies of that song it appears that truncating the song is not unheard of.

veracode has found a weakness

found on veracode's site

veracode has found my weakness - for tower defense games. have fun trying to be productive for the rest of the day.

i'd laugh too

found on memebase

i suppose if you're trying to hide your presence from water foul this might actually work, even though it obviously wouldn't work on people. knowing your target's capabilities (or 'knowing your enemy' as sun tzu might put it) allows you to do just enough to get by.

facebook cares

from here (source image one and two)

i have a feeling that facebook's expressed concern over the privacy of job applicants had more to do with territoriality than real altruism.

backupdate or screwupdate: choose wisely

from here

inspired in part by a tweet from bob rudis but also by the issue surround flame's spoofing of microsoft windows update. i don't know about others, but i have for some time been taking a current drive images before applying updates, then restoring a previous saved image (from the previous time i applied updates), then applying the updates, and then taking another drive image (to restore the next time i apply updates). it's already saved my bacon a time or two without having anything to do with malware. it's always good to have a way to undo things.

that's a suspicious package

from here

i really shouldn't be surprised that something essentially equivalent to "you've got mail" is being used as a lure to get people to open malware-laden emails.

the use of the F-word in anti-virus

the folks at f-secure posted this unlisted, non-embedable video to youtube with the description that it was a "rejected campaign idea", and then managed to find an indirect way to share it on twitter

it's a funny video, and the retro style reminds me a bit of a campaign by panda, but i can't help get the idea they're being a little bit disingenuous by disavowing it in one breath and then sharing it with the world in the next. how rejected can it be if you're putting it out there and letting it do it's job?

(and yes, the title of this post is an homage to bowser & blue)

a different take on anti-virus

thanks to @Xylit0l for tweeting this

i don't know about unbeatable detection rates, but oh boy, if only we could really productize common sense like that. then (and only then) people could actually have the "common sense" that some folks like to suggest as an alternative to traditional anti-virus software.

obscurity through security

found on very demotivational

although it's generally accepted that using the same security control multiple times doesn't represent additional security, when taken to absurd extremes i'm sure there's a deterrent effect - but i doubt it's worth it. i have no doubt it's still faster for the attacker to open those locks (destructively) than it is for the bike owner.

nothing to see here

from here (source image)

you might wonder why on earth i would be posting a normal lolcat picture here. the reason is because of lolsecurity.se who let you embed secret messages in lolcat pictures using steganography. it's a great idea, especially because there are few pictures shared more on the internet than funny cat pictures. the only problem is that lolsecurity has a very limited selection of lolcats to choose from and doesn't appear to let you select your own (the above image is not one of theirs). apparently the for fee, downloadable version lets you use any picture, but i can't attest to it's safety.

more stickers

thanks to chris shoghoian for tweeting this

as you can see by the tiny text in the lower left-hand corner, this is from facebook. last friday's post about stickers involved sans. i'm getting the feeling that maybe the next time i make something over at cafepress i should think about making stickers and not just clothes.

touched for the very first time

found on the memebase voting page

TSA: making virgins feel special since november 19, 2001.

security awareness sticker challenge

sans is putting on a contest to come up with the best security awareness stickers. today is the last day to enter (sorry i didn't get around to posting about this sooner). go ahead and check it out and submit your idea. mine is the one above. hopefully the graphic artists sans has working on bringing their submissions to life are better than me and can come up with something that isn't just a tracing of this photo.

mobile app security

found on dilbert.com of course

"we upload the data but we don't store it" sounds suspiciously like "i tried some weed but didn't inhale".

rememeber remember the 12th of december?

found on someone's facebook wall

choosing passwords is never ideal, but if you are going to go with a chosen one instead of a generated one, don't let someone else choose it for you.

well something seems broken

from here (source image)

the earlier post about spam-related memes inspired me to make one of my own.

it also gave me an opportunity to learn why i should do google image searches for "walleyed" instead of "cockeyed" (unless, perhaps, i wanted to make fun of enlargement spam).

all spammed up memes

found on the all spammed up blog

so, the all spammed up blog had a post a while back about a variety of macro image memes (egads, i'm starting to sound like that know your meme guy) about spam and other assorted junk email concepts. go ahead and check it out. it's always nice to have a laugh at the bad guys' expense.

failword

from here

i wonder how the cheezburger folks will feel about me using their comix builder for something that's all text.

the word failword was inspired by nick owen insisting once again that passwords are bad and 2 factor authentication is good

privacy: please think of the children

found on failbook

i think we can all agree that there are some things that just shouldn't be shared online.

the more things change the more they stay the same

from here (source image)

inspired by terry zink's shifting of the dates on the original comic. i realized that the truth that the original comic really expressed was not that the tables had turned, but that the problems of the past always seem minor in comparison to our current problems. it's a kind of relativity that makes us see the past through rose coloured glasses. yes, our problems are increasing but so is our ability to deal with them - that's the only way the past can look so rosy.

hide yo' coat hooks..

from here (image source)

it's not a bad idea, when you're in a bathroom stall, to hang your belongings up rather than leave them on the floor where someone can reach under and take the thing without you ever seeing who it was. however, clearly the thieves have come up with an easy countermeasure.

who says passwords are hard?

from here (source caveman image)

honestly, the password advice people give out is way more complicated than it needs to be. just use a password manager, it's that simple.

password monster

from here (source image)

inspired by

eHarmony, LinkedIn, last.fm ... NEED MOAR BREACHES THIS WEEK

— attrition.org (@attritionorg) June 7, 2012

and of course, if a new password breach really is revealed today, i think we can safely say it was brought to you by the letters F, A, I, and L.

CISPA

found on memebase

don't bother asking who an unaccountable surveillance bill will be used against, eventually it'll be used against you.

i wouldn't stop either

found on the memebase voting page

some things are better left alone / untouched. whether it's a stranger on the side of the road or a strange link or attachment in your email.

i don't always log into linkedin...

from here

inspired by the following tweet

LinkedIn seems to be one of those services where I never go to...except to change my password.

— Mikko Hypponen (@mikko) June 6, 2012

i'm not the only one who thought of something like this, by the way. i almost made a "you're gonna have a bad time" meme instead but, really, who actually uses linkedin enough to have a bad time when it gets breached?

which way would you like to be violated today?

found on very demotivational

wow, don't just stop at the first gag here, this is a picture that keeps on giving.

scumbag hash function

from here

seriously, WTF is MD5 doing being used anywhere today, nearly two decades after it's use in new systems was deprecated? why especially is it still being used by microsoft?

if you're building a system, maintaining an existing system, or just selecting a hash function from a dropdown list in a security program, don't choose this one!

beyond privacy fail

from here (source image)

... and for an added dose of creepy, those two toilets side by side like that look like a pair of eyes.

i see you...

how quickly we adapt

found on the memebase voting page

...because apparently we need to protect ourselves from bath salt zombies now.

with all due respect to this basketball player, though, if he's going to dress like that there's plenty of other choice cuts of meat available to an attacker.

trojan detected

found on memebase

although there are plenty of trojan horses these days, the greeks are not out to get us. only the very first one was theirs.

cry stuxnet and let slip the dogs of cyberwar

from here (source image)

well, if we're going to go over the top with stuxnet drama, lets go old-school. (and yeah, i know i'm not the first to think of the line in the caption - that's what happens with classics)

undetectable

from here (source images one and two)

this is not specifically about the flame worm, even though it came up most recently in a discussion about that worm. while it may be relatively easy to create malware that isn't detected yet, there's actually no such thing as undetectable malware - and even if it did exist, we would never know about.