Category: stuff

Posted on

The Tennis Channel App on Roku – Crashes and other problems

I signed up for a year of The Tennis Channel on my Roku TV in March. At first, it worked pretty well, though I noticed the audio and video would get out of sync pretty quickly. Restarting the app would fix it until the next commercial break. That was highly annoying, and I learned that many other people were having the same problem with no resolution.

That said, I discovered that pausing and restarting the stream would fix it, so I learned to live with it.

However, a few weeks ago, the whole app started crashing as soon as I selected a stream to watch – either live or pre-recorded.

I tried all the usual troubleshooting steps: rebooting the Roku, updating everything, reinstalling the Tennis Channel app, but nothing worked. This was the case for my TCL Roku TV and two Roku devices connected to other TV’s in my house.

Frustrated, my wife called Tennis Channel Support and the person on the other end of the line said “many other people are having the same problem.”
They said they’d be sending an email to tech support, which we soon got a response from. The email asked us to do all the same troubleshooting steps we’d already done! I did them again just to be sure, but no, nothing worked.
I started asking for a refund for my unused ~8 months of service, but Tennis Channel gave me a dubious denial:

You are requesting a full refund, which we cannot approve at this time. Your subscription was made with your own personal email, indicating that you signed up and agreed to the terms of service.

Alas, I was not requesting a full refund, I was requesting the remainder of the year I paid for, which I am unable to use because their crappy app isn’t working.
So, I filed a complaint with the FTC, who suggested I also file a complaint with my state’s Attorney General.

Done and done. You should do the same if you are having these problems!

Update – The Next Day – August 6

Turns out reporting them to the FTC actually worked. A day later I got a refund for the unused portion of the year I paid for!

Thank you for contacting Tennis Channel Customer Service!
We can confirm that your membership under this email address is now canceled, so you will not be billed in the future. We have also issued a refund for the remaining months of your subscription.

Posted on

Building Fully Remote Team Communication

I lead a team of eleven fully remote people, most of whom have never met in person, so I am always on the lookout for ways to build relationships, strengthen how we communicate with each other, and maintain some of the lost “water cooler chat” you get in an office environment.
I stumbled on this Gitlab Handbook that has some great tips for building what they call Informal Communication.

https://handbook.gitlab.com/handbook/company/culture/all-remote/informal-communication/

I really like the idea of postcard swapping, which uses something tangible you can hold in your hand to build connection across distributed teams.
Another team-building strategy we used when I worked at CNN were weekly co-working sessions, where we’d meet online for an hour while doing our normal work. This would facilitate all types of discussion, learning, and cross-collaboration. Sometimes, when conversation waned, just being quite and listening to the clacking of each others’ mechanical keyboards was enough to create a sense of belonging. Writing this article reminds me that I want to implement that on my current team!

Posted on

The Modlins

I took this old song, recorded on 4-Track cassette in 1997 or so, and gave it some modern treatment. I think it came out pretty good.

The Modlins were a prog-rock force born at Warren Wilson College in the 1990’s. Richard Wallace sang and played guitar, Justin Hallman played bass, and I, Will Chatham, played the drums.

This was one of my favorite songs we ever did.

Posted on

O, Death

As I recently passed the half-century mark in my life, I find myself contemplating some things now, more than I ever did before.

  • How long it takes muscle strains to heal vs how long it did 30 years ago
  • The strange new places hair grows on, and in, my body
  • The annual upkeep of my physical form and how intimately my doctor is getting to know me
  • Does my doctor go home at night and think about these things as he tries to go to sleep, or discuss them with his wife over drinks on the porch?

The strangest contemplation of them all is dying. Death. It gets closer each day, sure, but it’s more of an interesting proposition than something I find myself dreading or fearing. I don’t know for certain what it will bring, if anything. No one does. Many people think they do, but they don’t.

Not that I am eager to find out, but it’s interesting to think about all the ways we humans have created to avoid it, prevent it, reckon with it, and make ourselves think that there we are certain about what happens when it arrives.

I’m not afraid of being dead, as I’ve been dead before, and I’ll be dead again. Being dead didn’t seem so bad from what I can recall. No, what I’m afraid of is transitioning back to death in a terrible way, such as in a plane crash or slowly and painfully, from stomach cancer. That kind of fear is more a part of being alive than it is a fear of death.

– Me

I saw something online sometime back, and I saved it. Finding it again led me to write this blog post. I’d like to offer it up here, as it makes a lot of sense to me. It’s a eulogy from a physicist. This resonates because it is the most true and accurate thing we can possibly know about death, without conjecture, superstition, or guessing:

“You want a physicist to speak at your funeral. You want the physicist to talk to your grieving family about the conservation of energy, so they will understand that your energy has not died. You want the physicist to remind your sobbing mother about the first law of thermodynamics; that no energy gets created in the universe, and none is destroyed. You want your mother to know that all your energy, every vibration, every BTU of heat, every wave of every particle that was her beloved child remains with her in this world. You want the physicist to tell your weeping father that amid energies of the cosmos, you gave as good as you got.

And at one point you’d hope that the physicist would step down from the pulpit and walk to your brokenhearted spouse there in the pew and tell her that all the photons that ever bounced off your face, all the particles whose paths were interrupted by your smile, by the touch of your hair, hundreds of trillions of particles, have raced off like children, their ways forever changed by you. And as your widow rocks in the arms of a loving family, may the physicist let her know that all the photons that bounced from you were gathered in the particle detectors that are her eyes, that those photons created within her constellations of electromagnetically charged neurons whose energy will go on forever.

And the physicist will remind the congregation of how much of all our energy is given off as heat. There may be a few fanning themselves with their programs as he says it. And he will tell them that the warmth that flowed through you in life is still here, still part of all that we are, even as we who mourn continue the heat of our own lives.

And you’ll want the physicist to explain to those who loved you that they need not have faith; indeed, they should not have faith. Let them know that they can measure, that scientists have measured precisely the conservation of energy and found it accurate, verifiable and consistent across space and time. You can hope your family will examine the evidence and satisfy themselves that the science is sound and that they’ll be comforted to know your energy’s still around. According to the law of the conservation of energy, not a bit of you is gone; you’re just less orderly. Amen.”

Arron Freeman

If anyone know of any physicists for hire to perform eulogies around the time I die, please hire them! They’d be well worth the money.

In the words of Kilgore Trout, ting-a-ling!

Posted on

Ska City promo reel

Check out this promo we had made. The footage is from our show at Highland Brewing a few weeks ago. Thanks to Bob Peck at Mountainwater Films for putting this together!

Check out the Ska City website for all the latest news and upcoming gigs. I hope to see you soon!

Posted on

We took this guy to Ska City

Ska City

We received a nice write-up about our show on Friday. We played the “Concerts on the Creek” series in Sylva, NC and had a grand old time (similar to last season). This D. Trull feller showed up -clearly a ska fan already- and really seemed to enjoy himself. Then he wrote a review on his blog. Check it out!

I’m Gonna Take You to Ska City, NC

Posted on

OWASP Attack Surface Detector Project

When I did a short work stint at Secure Decisions in 2018, one of the projects I got to work on was helping to create the Attack Surface Detector plugin for ZAP and Burp Suite. I left that position before the project got published, but I am happy to see that it was a success.

Here it is in all its glory.

From the OWASP description:

The Attack Surface Detector tool uncovers the endpoints of a web application, the parameters these endpoints accept, and the data type of those parameters. This includes the unlinked endpoints a spider won’t find in client-side code, or optional parameters totally unused in client-side code. It also has the capability to calculate the changes in attack surface between two versions of an application.

There is a video that demonstrates the plugin, and yes, that is me doing the voice-over.

Posted on

Date Night Appetite, Because Writing & Eating are Fun

Just over a year ago, Rachael and I decided that we’d like to combine our love of escaping the house sans-children with our love of writing. Being fans of fine food and environments that enable us to focus on each other during rare, precious date nights, we thought it might be fun to share our experiences in Asheville with other couples who might be looking for a great spot to escape to, if only for an hour, or if for a whole evening. Plus, it would be a team effort that would allow us to collaborate on something we both love: writing and geeking out.

Thus, Date Night Appetite was born and officially launched back in September. To date, we’ve reviewed four local spots, but we also have some Instagram and Facebook posts to help share smaller delights that we find between date nights.

Check it out, and help add your ratings to what we have posted. And let us know if you have any questions or suggestions!

Posted on

Moria: A Boot2Root VM Walkthrough

Moria is a relatively new boot2root VM created by Abatchy, and is considered an “intermediate to hard” level challenge. I wasn’t sure I was up for it since I’ve only been doing this for a few months, but much to my delight I conquered this VM and learned a lot in the process. This experience will certainly help as I prepare for the OSCP certification.

While Abatchy says, “No LOTR knowledge is required ;),” I found that my LOTR knowledge came in quite handy.

Getting Started

My setup:

  • MacBook running MacOS (Sierra)
  • VMWare Fusion running:
  • Kali Linux (latest)
  • Moria VM

Once the VM was downloaded and running in VMWare, I started through various enumeration techniques that I typically go through when starting to penetration test a box. I’ll omit the irrelevant ones in this write-up.

Enumeration

Netdiscover

This tool revealed the IP of this machine on my network:

192.168.0.131

nmap

I used nmap -v -sS -A -T4 192.168.0.131
and nmap –sS –sV -O 192.168.0.131

PORT STATE SERVICE
21/tcp open ftp vsftpd 2.0.8 or later
22/tcp open ssh OpenSSH 6.6.1 (protocol 2.0)
80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
MAC Address: 00:0C:29:E8:75:4F (VMware)
Device type: general purpose
Running: Linux 3.X|4.X

So HTTP, FTP, and SSH were running. I started by checking out HTTP and visiting http://192.168.0.131 in a web browser. Here’s what I got:

The image of the West Door of Moria is from LOTR. This door was a trick door in the book and movies, and it required some “outside the box” thinking in order to gain entry. I remembered this from the books, and re-familiarized myself with the details via a Google search:

From http://tolkiengateway.net/wiki/Doors_of_Durin:

“On 13 January 3019 the Fellowship of the Ring entered Moria through the Doors,[5] but initially Gandalf could not find out the password to open them. Merry Brandybuck unknowingly gave Gandalf the answer by asking, “What does it mean by speak, friend, and enter?” When Gandalf realized that the correct translation was “Say friend and enter” he sprang up, laughed, and said “Mellon”, which means “friend” in Sindarin, and the Doors opened. Shortly thereafter, the Watcher in the Water attacked the Fellowship and shut the Doors behind them.[1]”

Good info that might come in handy later 😉

dirb

Running dirb led to the discovery of a directory at http://192.168.0.131/w/. It contained a link to /h/, and so on. Traversing down the links led to:

http://192.168.0.131/w/h/i/s/p/e/r/the_abyss/


The page said “Knock knock”
Was this a reference to port knocking? I thought that might be worth checking out later if I could find more info about a sequence.

At this time I was unable to find much more to work with related to the website and HTTP. The usual nikto and other apache/web-related stuff didn’t turn much up. I turned to FTP.

ftp

Trying to connect via FTP turned up some interesting info:

220 Welcome Balrog!

Clearly, the Lord of the Rings theme was running deep. I wondered if the password would be “mellon,” since that was what got the LOTR party into the gates of Moria. I couldn’t get that to work, and I wasn’t sure about a username.

Revisiting the website

Poking around the website some more, I DISCOVERED SOMETHING IMPORTANT!!!
When I browsed to http://192.168.0.131/w/h/i/s/p/e/r/the_abyss/
It gave me something different the next time. I found that a different quote would appear with each page load. I kept refreshing and collected all of the following:

Knock Knock
Is this the end?
Too loud!
Dain:”Is that human deaf? Why is it not listening?”
Nain:”Will the human get the message?”
Is this the end?
“We will die here..”
Ori:”Will anyone hear us?”
Nain:”Will the human get the message?”
Telchar to Thrain:”That human is slow, don’t give up yet”
Maeglin:”The Balrog is not around, hurry!”
Balin: “Be quiet, the Balrog will hear you!”
Oin:”Stop knocking!”
“Eru! Save us!”

A couple of weeks passed at this point, as I went out of town and had other things going on, but it gave me an opportunity to think about Moria and to come back with a fresh perspective.

ssh

Tried a bunch of other things, but finally tried doing SSH to the server and was prompted for a login.
Based on the FTP connection saying “Welcome Balrog!” I assumed that Balrog was a username. I also assumed that Mellon was the password knowing what I know about the LOTR story. Lastly, I realized I probably needed to try various capitalizations.

Using the login combo of Balrog / Mellon I got this:

 

Wrong gate? OK. I went back to try FTP with the Balrog/Mellon auth combo and got in:

Silly me. The username was right there in front of me when I had been trying FTP before. Nothing in the directory I logged into turned up, but I was able to cd .. up to /

I could go many places with basic dir navigation, but much was not allowed. For example, could get into /etc but not look at passwd. I couldn’t find anywhere that I could upload anything, and none of the important system files you’d typically check were allowed to be viewed.

I went to /var/www/html and found a directory that dirb would never have discovered:

Viewing that page in my web browser showed a handy table of what appeared to be hashes:

Hashes

I set off to see what those passkeys could do. They did’t seem to work as-is for SSH or FTP, so I knew they’d need to be operated on somehow.

hash-identifier said they were likely MD5 hashes:

Without a salt I wasn’t sure how I’d use that information.

I tried various things with Hashcat and John the Ripper, but had no luck. I was stumped for a while until I looked under the hood at the source code of that page at http://192.168.0.131/QlVraKW4fbIkXau9zkAPNGzviT3UKntl/

Note: Looking at the HTML source code is something I always forget to do, and it has bitten me more than once!

At the bottom of the source code I found what appeared to be the salts:

 

So I had the salts for those MD5 hashes, and I had what looked like the format for using them:

MD5(MD5(Password).Salt)

Cracking

This next part took me a lot of reading and learning, as I’d never really run into this before in my rather limited experience, and I had only a basic knowledge of Hashcat and John the Ripper. While it took some time, it turned out to be a great opportunity to learn.

Ultimately, based on what I had read in various seedy places of the Internet’s underbelly, I created a file called hashes.txt with these contents, based on the HTML chart found above, and added the salts to each line (after the $) respectively:

Balin:c2d8960157fc8540f6d5d66594e165e0$6MAp84
Oin:727a279d913fba677c490102b135e51e$bQkChe
Ori:8c3c3152a5c64ffb683d78efc3520114$HnqeN4
Maeglin:6ba94d6322f53f30aca4f34960203703$e5ad5s
Fundin:c789ec9fae1cd07adfc02930a39486a1$g9Wxv7
Nain:fec21f5c7dcf8e5e54537cfda92df5fe$HCCsxP$HCCsxP
Dain:6a113db1fd25c5501ec3a5936d817c29$cC5nTr
Thrain:7db5040c351237e8332bfbba757a1019$h8spZR
Telchar:dd272382909a4f51163c77da6356cc6f$tb9AWe

I still needed to figure out the right format for running through John the Ripper though, so more research was needed. I turned to these places:

http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats – not much help here.
https://github.com/piyushcse29/john-the-ripper/blob/master/doc/DYNAMIC – found the solution here.

Based on the chart on the documentation page for DYNAMIC, the format mentioned in the source code would work with this:

dynamic_6 | md5(md5($p).$s)

I next tried that on the hashes.txt file:

root@kali:~/moria# john –format=dynamic_6 hashes.txt
Using default input encoding: UTF-8
Loaded 9 password hashes with 9 different salts (dynamic_6 [md5(md5($p).$s) 128/128 AVX 4×3])
Press ‘q’ or Ctrl-C to abort, almost any other key for status
magic (Telchar)
abcdef (Dain)
spanky (Ori)
fuckoff (Maeglin)
flower (Balin)
rainbow (Oin)
darkness (Thrain)
hunter2 (Fundin)

SUCCESS!

I had a list of passwords for each user. Only one of these worked for logging in via SSH, and that was Ori’s account.

Bash Shell Obtained

Got a Bash shell with Ori’s login via SSH:

-bash-4.2$

-bash-4.2$ ls -al
total 8
drwx—— 3 Ori notBalrog 55 Mar 12 22:57 .
drwxr-x—. 4 root notBalrog 32 Mar 14 00:36 ..
-rw——- 1 Ori notBalrog 1 Mar 14 00:12 .bash_history
-rw-r–r– 1 root root 225 Mar 13 23:53 poem.txt
drwx—— 2 Ori notBalrog 57 Mar 12 22:57 .ssh

Starting in Ori’s home directory, I checked out the .ssh directory to see what might be relevant.

It looked like Ori had logged into localhost before, since it showed up as a known_host. Why would he be doing that unless he needed to log in as someone else? Perhaps as root?

root Obtained – All That is Gold Does Not Glitter

Huh…well that last part was easier than I thought it might be. Thanks to Abatchy for providing this challenge. I learned a lot!

 

Posted on

Biggest Online Security Breaches in 2017 So Far

Worryingly, we hear about data breaches so much nowadays that we have gotten used to them. From the infamous Ashley Madison breach, where thousands of cheating partners were exposed to the TalkTalk breach, which led to youngsters being arrested, the scandals seem to get worse and worse, as cyber criminals become more sophisticated. In this post, we are going to take a look at some of the biggest data breaches to occur so far in 2017.

Debenhams Flowers – Let’s begin with a data breach that his hit the news very recently. 26,000 customers had their personal data compromised as a consequence of a cyber attack on Debenhams Flowers website. Names, addresses and payment details were taken during the incident, which targeted a third party e-commerce company, Ecomnova. At present, the Debenhams Flowers website is currently offline, as they discover more about the attack, which is believed to have taken place between February and April of this year.

Gmail – Most people reading this post will have a Gmail account, and so the phishing scam that occurred in March was a pretty big deal to say the least. Gmail users were targeted in a sophisticated scam, which saw them receive an email that appeared to come from one of the user’s trusted contacts, such as a friend or a work colleague. The email had a Google Doc attached to it, and encouraged the user to open it. However, once clicked, the link actually lead to a security page, whereby the hacker would gain control of the user’s email account. Despite the fact that Google reacted quickly and was able to stop the attack within an hour, one million users were impacted.

InterContinental Hotels Group – While email platforms and ecommerce websites only have online threats to deal with, the hospitality industry has both physical and cyber security to bear in mind. If you would like some information on the former, take a look at information provided by HS Tech Group.  The InterContinental Hotels Group (IHG) breach is important because it occurred due to malware, which is running rife at the moment. In the beginning, IHG believed that 12 of its properties were impacted by the breach, which saw malware on the servers used to process payments made at on-site bars and restaurants. This meant that stolen data included internal verification codes, card numbers, expiration dates, and card numbers. However, IHG later revealed that 1,200 of their properties had been impacted by the malware attack.

E-Sports Entertainment Association (ESEA) – Last but not least, we have a breach that was announced at the very start of 2017. ESEA, which is one of the biggest video gaming communities in the world, issued a warning to all players after discovering a security incident. It was later revealed that more than 1,500,000 ESEA records were impacted by the breach, and a lot of private data was compromised in the process, including website URLs, phone numbers, birthdates, email addresses, first and last names, usernames, registration date, last login, and much more.

For more information on how you can stay safe while using the Internet, take a look at this blog post.

clicky