Dominic White - Play

Happy Birthday Dear Blog

nospam@example.com (Dominic White) — Sun, 05 Feb 2012 13:23:00 +0200

Today marks the 8th anniversary of my blog, and my official entry into infosec.

It's been a wild ride, with the move to SensePost the best decision yet. After the blog template got laughed at on the twitters, I decided to give it a new theme. Thanks muchly to confluence from atrum for the CSS n00b help.

This year wasn't quite as eventful as 2010 or "The Year I Got Slashdot'ted", but I think 2011 was the year of my highest quality content, with some long, hard-thought entries. So far the blog has 908 entries, with 872 public and 36 hidden because I got too scared. By comparison, I have vomited 8288 tweets into the ether since 2007.

Thanks to those that read it, and the feedback you give me. Here's to year 9.

Security Vendor Bingo

nospam@example.com (Dominic White) — Sun, 08 May 2011 20:56:08 +0200

Matt Erasmus came up with a great idea for taking the Security Bingo card from RSA, and making our own for the ITWeb Security Summit, and using it to generate some funds for Hackers for Charity. Last year, thanks to companies such as ITWeb, SensePost & Telspace we managed to send R15k over to HFC, and it would be nice to do it (or more) again.

I have a long standing bug-bear over the uselessness that security vendors seem to bring to cons in ZA. They respond to requests for "please don't pitch your product" by talking generically about the "outsourced next generation cloud-based firewall industry" as if that was some sort of legitimate field that didn't constitute only their product. They still send sales/pre-sales/product specialists with their EMEA marketing deck, rather than something of actual value. But as long as they're offering money, people take it, no questions asked. You'd think the empty rooms and people walking out of their presentations would send the message, but instead a local distributor finds a new vendor, or the vendor sends a new person, so the lesson is never learned.

That's not why Matt suggested the bingo, but it's one of the main reason's I helped. I want the vendor telling us that their product will block 100% of APTs to walk away feeling dirty and ashamed, and maybe even realise the error of their ways and turn into the next Charlie Miller. Also, I want to help Johnny, and the great work HFC is doing in Uganda (and Kenya).

So, as Matt already said. Find either he or I at the security summit (we'll be wearing I Hack Charities shirts) and give us R50 (or more, it's for a good cause) and we'll give you a security vendor bingo card (feel free to pre-print yours). Fill it out during the talks or on the con floor, optionally with the name of the vendor so we can tally a highscore list, then either return it to us in person, or mail it to the address printed on it, and we'll give you the results. There'll be some sort of prize if we can muster one, one for the person to complete first with the highest score, and one for the person who comes up with the best "other" phrase. Given that you could just tick them all off and give yourself a first high score, this will be a "Don't be a Douche" style contest.

Fraudsters: AAA Plumbing & Electrical

nospam@example.com (Dominic White) — Mon, 24 Jan 2011 10:05:10 +0200

Last night we lost power to all electrical outlets in our house. On checking the board, I saw that it was the earth leakage, which I was unable to turn back on. This is a story about AAA Electrical (also know as AAA Plumbing, or AAA Electrical or AAA Plumbing & Electrical), and how they tried to defraud me, and appeared to have done it to many others. Don't use them. If you need a reliable & honest electrician use:

Andrew: +27 82 443 7762

It was a Sunday night, the fridge was off, and the prospect of no espresso in the morning was galling. I phoned the first full page ad in the yellow pages mentioning my area and "no callout fees, free quotes", AAA Electrical. The lady who answered, Cynthia, was polite and efficient. However, neither her, not the two other electricians I phones were able to give me even a ballpark figure. 20 years in the business it said, evidently earth leakages are still too tricksy to hypothetical quote on.

An hour later, Kenny and his partner Eziechiele arrived in an Isuzu bakkie (GP plates, started with an S). He unscrewed a bunch of wires in my board, set his ammeter to them, and proclaimed he had found the short; "It was a surge from the grid" he said. That's strange, nothing blew, none of the flats around me were affected. I didn't believe him. He then phoned Cynthia at the "head office" and returned with a quote of just less than R5k! I asked how much it would be to just replace the earth leakage switch, and not "clear the short", just less that R2k! This was clearly outrageous, so I sent him packing, but not after paying their R395 "call out fee", oops, they mean "quotation fee", no wait the ad said they didn't charge that either, ok, it's an "analysis fee". I also asked that he put everything back the way it was...

I then phoned the next electrician, Willem, who balked as I did at the outrageous quote, and said he could do it for half i.e. R2.5k. Wow.

Finally, I remembered that a good friend used to manage several electrical contractors and I phoned him for advice. He gave me the number of Andrew, listed above, and said he'd trust him with his kids. Much better. I phoned Andrew at 8am the next day, and by 9:30 he'd been round, performed the trivial task of resetting the earth leakage (you have to push it down hard, my bad) and agreed to charge me nothing more than his basic call out fee. What he did point out, is that Kenny had left several wires improperly screwed, and the neutral wires completely unscrewed. The only thing he attempted to screw right, was me.

It's sad that these guys can't operate an honest business, and feel they need to make their money through quoting for radically unnecessary work and attempting to damage your electrics further. This is the definition of fraud I am using. It appears I'm not the only one who's had a run in with them, several, others got screwed much worse.

Upcoming Talks, Workshops & Training - ZA / US / Emirates

nospam@example.com (Dominic White) — Wed, 22 Sep 2010 10:00:58 +0200

It seems my work on privacy has garnered some attention of late. Whether earned or not, I will be presenting at the Computer Security Institute's Virtual Conference CSIVX on the 28th of September. I will be on hand to answer questions, even though it will be some silly hour ZA time. This is technically the first "international" event I've ever "presented (see pre-recorded video for)" at, and it includes the likes of Ira Winkler, Amit Klein and Jeff Williams.

I'll also be presenting on privacy at IS' Internetix2010 conference in both Jozi & Cape Town. Internetix is a rocking conference organised by IS, and I'm chuffed to have been invited. It will be a nice chance to test the privacy stuff with a large non-sec crowd.

Next up, I'll also be presenting a workshop on Threat Modelling off the back of quite a lot of work we (my employer SensePost, and I) have done on it recently. If you want to get an idea of the content, have a look at the last set of slides. It's hosted by the ISF and will be held in Jozi on the 28th.

Finally, I'll most likely be giving the SensePost training at BlackHat Abu Dhabi in Nov. If we get over around 15 people I can justify someone smarter than me from SensePost joining us, so if you're keen for some training, please sign-up :)

On Year Six

nospam@example.com (Dominic White) — Fri, 05 Feb 2010 05:31:00 +0200

Today my blog turned six, and I tweeted that fact with the following:

My blog http://singe.za.net/ turned 6 today. The fact that I'm tweeting this rather than blogging it is probably significant.

While blogging remains more a more satisfying and useful means of exploring a thought, twitter let's you skip the work and move onto the conversation (sometimes) a bit sooner, but without any decent record of that conversation occurring (twitter's searchable memory is too short). I'm certainly going to continue blogging, but I don't see my throughput increasing much. Luckily, subscribing to an RSS feed is only a cost if there are too many updates ;).

That being said, I think there's been some fun stuff on the blog in the last year, my favourite posts have been:

Using Maltego to Data Mine Twitter
Conficker Claims it's first Human Life
My first guest post - Efficient extraction of data using binary search and ordering information
Deloitte -> SensePost for a personal milestone (there was another personal milestone, my marriage, but that wasn't much of a blog entry).

First Week at SensePost

nospam@example.com (Dominic White) — Fri, 08 Jan 2010 15:49:28 +0200

Today is the last day of my first week at SensePost, so far the number of:

Shiny new Macbook Pro's received: 1
Distrowars: 4
Foozball games played: 8
Collared shirts worn: 3 (what do I do with them all now?)
Black t-shirts worn: 2
Disco balls in meeting rooms: 1
Coffee machines per capita: 0.14
Timesheets completed: 0
HR forms to complete: 0
Kilometers traveled: 600 (the only downside)
Attempts colleagues have made to scan entire Internet: 1
Finally working at a company 5 years after first applying for a job there: Priceless

In short, it's been awesome. I haven't done much real work as yet, but that will start soon. The people are smart and easy to get along with, and they're all geeks, a nice change (on the geeks bit, my old colleagues are smart too :) ). I'm also enjoying getting to know "how they roll" and recon living up to it will make me a better security person.

As an aside, my new work e-mail address is available here (or sans popup).

What a Wedding!

nospam@example.com (Dominic White) — Mon, 04 May 2009 16:35:31 +0200

We loved every moment, if only there was more time. Some photos are up courtesy of our photographers. Our informal engagement shoot, and photos from the wedding.

In the meantime, we're off on honeymoon!

I'm getting married!

nospam@example.com (Dominic White) — Fri, 01 May 2009 21:57:12 +0200

In 17 hours. Finally, I can't wait.

Brand Plagiarism?

nospam@example.com (Dominic White) — Mon, 29 Dec 2008 02:21:16 +0200

While taking my drugs this evening I noticed something interesting; vs. . Is this rampant plagiarism? If so, somebody at SensePost better sue the arse off those Schering guys ;)

The Evidence

Update

mh has responded, and it seems these insidious brand copycat'ters have been plotting their attack from as early as 2000, from the response:

We opened doors in 2000, and i was hoping to find proof of these copycats having started like 2 weeks after us.. hmmm..

[snip ...]

Archive.org shows the logo in use at least back in 2000

This is obviously a targeted attack by an extremely capable hacker group. The careful placement of 'evidence' of SP (Schering Plough) existence way back into 1851 indicates infiltration of most of our public institutions and records. This could even be, the Illuminati.

On a different note, one of the army of analysts currenty tracking this attack has suggested that things could be even more nefarious; Sensepost could be a roach baiting front of Schering's designed to sell unsuspecting hackers 'lifestyle' drugs. When was the last time they offered you a drink?

P.S. And just because sometimes there are people out there who really don't get it. This is a joke, the logo's coincidentally similar, and the two companies not in competition in any minor or significant way.

Merry Christmas 2008

nospam@example.com (Dominic White) — Thu, 25 Dec 2008 01:17:06 +0200

It's Christmas 2008 here in Africa. Hope you all have a blessed Christmas with some quality time with your families. As for the security geeks, I hope the break gives you time to think, and we come back with new ways to combat crime and defend data ala the spaf.

"You've won a car" Scam - Carlswald / Design Quarter

nospam@example.com (Dominic White) — Wed, 01 Oct 2008 16:15:57 +0200

Update II: It appears these guys get your number after applying for insurance quotes. If you comment, please indicate if you have recently applied for insurance and through whom you applied.

Update: This page originally documented my experiences, but given the number of commentators and changing tactics, it is regularly updated. I can't vouch for the accuracy of, nor take responsibility for, the commentators information, or that of HeloPeter's. Also, while this fits my personal definition of a scam, until that is tested in a court, they are at most using disingenuous marketing tactics. Either way, don't waste your time.

I got a phone call from 'Divine' today telling me I was one of 15 lucky people who had made it to the final draw for a Cheverolet Spark. This appears to be part of a possible ongoing scam (or network marketing) run by a company that keeps changing it's name. They are currently EcoWorld and appear to have been previously Prestige Business Solutions, which others claim use the trickery to try and get you to buy a time share at the Quality Vacation Club.

Divine told me that Anna, the "events coordinator" would be phoning me tomorrow morning to give me the address. She did phone, but I declined to go, and I advise you do the same.

Several other's have blogged about it:

Jo'blog - Scammed?
Insights and Rants - Prestige Business Solutions QVC Scam Alert
SundayWorld - It's a trap! No bakkie, no trip to Mecca
Numerous complaints on HelloPeter at:

They pointed me to the Our Winners scam site, which is part of the apparent Quality Vacation Club scam (qvc.co.za and. A quick WHOIS shows the following registration which matches the address I am supposed to go to to collect my prize:

registrant: Shackel Validations
registrantpostaladdress: 28 Guildford rd, Carswald Midrand

NB They have since opened a new office at the Design Quarter, don't be fooled it is the same group.

Warlynx points out that:

It looks like it is registered under

Flink Warm Handel 101 T/A Prime Visions,
registration number 2008/022354/23

The physical address is:

VIP Building, Guildford Road, Carlswald, Midrand

So, even though the company changes, the address doesn't. If you blog about it please include the address to track their activity across company name changes.

Their phone numbers were, and still seem to be the following, although the names used change:

Divine/Jackie - 0878052380 ( 087 805 2380 )
Anna - 0763758026 ( 076 375 8026 )
Tracy - 0878052365 ( 087 805 2365 ) - Thanks to Christo for this

They also appear to own the domains:

qv.co.za
qvc.co.za
qvcweb.co.za

When they phoned, I quickly worked out it was a scam, but decided to go along with it. Two funny bits were when he asked that I come with my wife or partner for the photos. In response, I suggested that I was single but had a boyfriend. He then uncomfortably asked that I try and find a woman. We left it at him "getting back to me" about supplying a model for the photo instead.

The other bit which tipped me off it was a potential scam was when he asked me to pronounce my surname, given that I have a very pronounceable surname, I asked what he had written down. He then admitted he didn't have my surname, just my firstname, so I lied and gave him a false surname. In retrospect I should have said my surname was "Robert'); DROP TABLE Students;--".

Update: From my other entry on the subject, some aliases used by these guys are:

Quality Vacation Club
Prestige Business Solutions
Unique Connections
World Connect / VIP / VIP World Connect
Prime Vision
Media Magic
Mega Communications
Ezweni Communications
Dynamic Communication
Real Communications / Real Communication
Ecoworld
Market Matrix
Terrafirma (according to one of our commenters)

InfoSec Professionals are the Hottest according to Forrester

nospam@example.com (Dominic White) — Mon, 08 Sep 2008 11:48:44 +0200

Apparently Forrester reckons Information/Data Architects and Information Security Experts are the Hottest roles in IT (note 'Hottest' is hotter than 'Extremely Hot').

I haven't read the full PDF, but the below diagram gives a breakdown, and since it is a diagram from Forrester, it is now also a fact:

I've always thought infosec people had the nicest bums. Especially if you compare them to network monkey or coder bums, which are usually flabby. Now we have proof!

I did think Yusuf's take via IRC was rather funny:

<cynic> I get the feeling that Forrester, Gartner et al are making it up sometimes.
<cynic> "Heat level" for roles in IT? What is this, TheStyleNetwork? Next we'll be seeing a report that ranks "Most Bodacious Management Skillz" ... sheesh!
<cynic> Moral Of The Story: It doesn't become less stupid if you attach a graph to it.

they are such a bunch of monkeys!

nospam@example.com (Dominic White) — Mon, 01 Sep 2008 20:01:03 +0200

You know who you are :)

Make Better Coffee

nospam@example.com (Dominic White) — Mon, 14 Jul 2008 19:17:42 +0200

If you've decided you want to make better coffee, here are my tips for the changes that will yield the biggest results. These aren't comprehensive, just some quick tips for quickly making better coffee.

Don't use instant, use proper Arabica grounds.
Espresso is the best, then French press, then percolator. A Moka Express or Brikka are quick ways to get into espresso.
Use hot milk. This makes a big difference in taste, 30-40s in the microwave should do it. A French Press can be used with hot milk to make decent froth for cappuccino too.
Grind your own beans. A grinder is cheap, and freshly grinding your own beans just before you make a cup makes a subtle increase in flavour. Remember to store your beans in an airtight container in a cool dry place (not the fridge).

Blog Updates

nospam@example.com (Dominic White) — Mon, 14 Jul 2008 18:29:00 +0200

After 4 years I have finally decided to change my theme. It is very Mac OSX oriented, but I just like it so much. I've also removed a Gig of spam block logs from the DB, so it should be a bit snappier. Finally, I figured out why Google hates me, I somehow didn't run a DB upgrade script on the last blog upgrade, and a ton of links weren't working. They are now.