01 David Guetta feat. Kelly Rowland – When Love Takes Over (Electro Extended Mix)
02 Melleefresh, Deadmau5 – Sex Slave (Original Mix)
03 Costello – Girls Speak Louder (Donique Mix)
04 Alexis, Darmon, Eran Hersh, George F – Girls Who Like Girls (Original Living Room Club Mix)
05 Larry Tee Feat. Roxy Cottontail – Lets Make Nasty (Afrojack Remix)
06 Jewlez – Get Down (Original Mix)
07 Pain, Gubellini – Shake It Up feat. Darook Mc (Maurizio Gubellini & Stefano Pain Main Mix)
08 Martin Solveig – Poptimistic (Bingo PLayers Vox)
09 Mowgli – London To Paris (Original Mix)
10 Laidback Luke, Lee Mortimer – Blau! (Original Mix)
11 Funkagenda – H3lix (Original Club Mix)
12 Wolfgang Gartner – Latin Fever (Original Mix)
13 Starkillers – Bitch Ass Trick (Original Version)

Incidentally, this is my first recorded mix on the APC40 with Ableton

                          

Related posts

• My New Toy (APC40) (0)
• Christmas Messin Around 21/12/2009 (0)
• Sunny Side Up 25/01/2010 (0)
• Rolling House Beats – 15/08/2009 (0)
• Electro-Fied – 04/08/2008 (0)

The line between Black and White is often understood to be the law itself, i.e. if you’re a hacker, cracker or even a “skidie”, your hat changes colour the minute you go from having permission to do something to not having permission.  I however wager that if we were to exact that understanding on every security expert in this field of expertise, today, it would be a near 100% perfect sea of Black Hats.

So the question becomes, if that’s the case, are we all really the “bad guys”? I put to you a different concept, I different way of thinking about this that, personally, I think fits much better.

First of all let’s forget about hats and the law and look at a couple of basic concepts. Motivation is the activation or energization of goal-oriented behaviour and  is defined as intrinsic or extrinsic. Intrinsic motivation comes from rewards inherent to a task or activity itself – the enjoyment of a puzzle or the love of playing whereas Extrinsic motivation comes from outside of the performer. Money is the most obvious example, but coercion and threat of punishment are also common extrinsic motivations.

Another point of consideration is Goal orientation, often seen as an aspect of an individual’s motivation. An individual’s goal orientation describes the goals that they choose and the methods used to pursue those goals. One of the most common conceptualizations of goal orientation is the three factor model, that is, individuals can be described in terms of goal orientation based on three factors:

• mastery,
• performance-approach, and
• performance-avoid.

Individuals with a mastery goal orientation seek challenging tasks and value learning. Highly performance-approach oriented individuals seek tasks that allow them to demonstrate the skills they already possess, and highly performance-avoidant tend to avoid tasks where they may fail and thus appear incompetent.

The final aspect to consider in this equation is an agent’s intention in performing an action. In so much as his or her specific purpose in doing so, the end or goal that is aimed at, or intended to accomplish. In recent years, there has been a large amount of work done on the concept of intentional action in experimental philosophy. This work has aimed at illuminating and understanding the factors which influence people’s judgments of whether an action was done intentionally. For instance, research has shown that unintended side-effects are often considered to be done intentionally if the side-effect is considered bad and the person acting knew the side-effect would occur before acting. Yet when the side-effect is considered good, people generally don’t think it was done intentionally, even if the person knew it would occur before acting. The most well-known example involves a chairman who implements a new business program for the sole purpose to make money but ends up affecting the environment in the process. If he implements his business plan and in the process he ends up helping the environment, then people generally say he unintentionally helped the environment; if he implements his business plan and in the process he ends up harming the environment, then people generally say he intentionally harmed the environment. The important point is that in both cases his only goal was to make money. While there have been many explanations proposed for why the “side-effect effect” occurs, researchers on this topic have not yet reached a consensus.

So now we understand a little about motivation, goals & Intentions, what really makes the “bad guy” bad? Well its worth adding into themix that the “good guys” and “bad guys” all have the same level of skill, they all learned it the same way and they all have the same aptitude (loosely speaking of course). In fact during the learning process its probably fair to wager that on occasion everyone ended up, purely through exploration, somewhere they shouldn’t have been.  Does this make us all “bag guys”?

I certainly do not think so. In my opinion, motivation, goals & intent are what separate the good from the bad, and in this context the “White Hats” from the “Black Hats”. Let’s look at an example. the CERT Coordination Centre came up with an interesting classification matrix, which I have provided below as a diagram:

In the above diagram, we see six types of attacker (as well as a virtual 7th type that could be all 6 in a different context), six types of motivation and four goals.  It is assumed in  this classification, as insinuated by the word “Attacker”, that we are dealing with the “bag guys” or Black Hats here, however, I would argue that the first type, “Hacker” has a motivation and goal that is not negative or in fact malicious in any way, so should they also be considered a “bad guy”?  Its fair to say, someone hell bent on the quest for knowledge in that particular classification may take a devil may care approach that could have a negative impact on the systems they are exploring, but again, is this malicious intent, or just carelessness?

In summary I put it to you that there are no White Hats, or Black hats in the world today, just Shades of Grey, and that only motivation, goals and intent separate those of us trying to help from those who have a more nefarious purpose.

Like

Unlike

                          

Related posts

• PenTest Straw Poll (0)
• The Asymmetry of Security (0)
• Snort Rocks! (2)
• Security as a Career (0)
• Press Coverage – January 2010 (0)

Malware has come along way since its anarchistic pre-pubescent   beginnings, and is now a fully fledged teenager, displaying all the fire, passion and unpredictability you would expect from one. Once upon a time, you could be sure your malware was simple in its intention, written by an unorganised person or persons, with the typical agenda of notoriety or malicious damage. Although bad, quite easy to deal with.

Modern malware however is a whole new ball game. Written to order, with a menu of “features” available from stealing data to placing a sleeper inside the system, all with standard issue mass infection mechanisms anti malware detection programming, the latest in self defence techniques and with the underlying drive of a typically well organised or at least very motivated source.

Yet despite this significant step change in what we are seeing as the attack, as a world of experts I am still not seeing a change in the controls, strategies or defence tactics of many organisations. This I find astounding. How anyone who is considered a responsible person in an organisation can sleep at night thinking that a firewall and a few layers of Anti-Virus is going to cut it as the total form of protection is seriously miss-informed. Equally, those companies out there pedalling the silver bullets of the security world “[insert vendor name here] ultimate anti-malware solution (TM)” are doing nothing but compound a problem that will continue to evolve and get more sophisticated.

The simple fact is that ANY malware solution on the planet today from any vendor works on the same detection methods. They look for something they have seen before or something that looks like something they have seen before and block it, It’s that simple. And for that reason alone, you cannot rely on that control alone as the only form of defence. Equally, the firewall and all that other perimeter based paraphernalia you invested in, don’t get me wrong, all well and good, but its not going to stop this stuff. Why? Web 2.0, Social Networking, Unified Communications, Chat, Mail, you name it. Any medium of communication that can facilitate the transfer of a file, and that includes just good old browsing of the web, will bring malware to your door, invited in so to speak, through all that perimeter protection, and straight to the desktop.

The truth is, the only way to protect yourself against this stuff is to stop thinking it’s “the good old days” and get with the times. The only way you’re going to stand a chance of surviving one of these incidents is by thinking about the entire control landscape and how they interact with each other. A good model for this is Defence in Depth as that provides a very good method of visualising the controls at each layer of your environment and allows you to map attacks through the controls to see if they would be successful or not.

This simple visualisation strategy can bring value beyond your wildest dreams, giving you the opportunity to stop, think and adjust what you’re doing, justify investment, demonstrate control and rationalise spend. All very important concepts for the times. There is a world of products, vendors control choices and equipment with pretty flashing LED’s on it. The only way to figure out which ones will help you is to understand what you have, what you need and why.

Like

Unlike

                          

Related posts

• Chip & Pin Attack (1)

This toy really is the ultimate in Ableton Live control, extending the interface litterally to your fingertips and bringing a whole new world of possibility. You can read all about it on Akai’s site, but if you really want to see the potential, check out these YouTube links that just sum up the potential in full from my perspective:

Ok, so its going to take me a while before I get  this good, but thats what its all about.

……watch this space

Like

Unlike

                          

Related posts

• Dirty Friday – 05032010 (0)
• Sunny Side Up 25/01/2010 (0)
• Christmas Messin Around 21/12/2009 (0)
• A simple truth (0)
• A new solution (0)

Jay Abbott, director in charge of Threat & Vulnerability Management, PricewaterhouseCoopers LLP (PwC), said:“Essentially, what the scientists have come up with is a very effective and simple way of exploiting weaknesses in the system.

However, it is important to bear in mind that the fraud requires a very specific scenario to become effective.

“A simple process change by the retailer of asking for the card holder to hand over the card would break the circuit, although this isn’t always possible as sometimes the card reader is fixed to a point on the other side of the counter.

“At present, the customer is accountable for the fraud as banks argue that PIN verified transactions are secure. Given this attack demonstrates a clear method of bypassing the PIN system, this assertion by the banks stands on shakier ground.”

With the original comment came a caveat, which as you would normally expect, was not quoted by the media, this caveat was that the process change suggested brought with it the opportunity for cards to be skimmed, which was in fact one of the original reasons behind the Chip & Pin changes. In fact, the change works in the favour of the retailer rather than the consumer, however, before you hang me, allow me to demonstrate the rationale behind this.

Consider first that Chip & Pin is in fact “two factor” authentication, which anyone in the security business will explain is more secure than “one factor” authentication. The first factor is the card itself or the “chip” in this instance, the second factor is the “Pin” which in this context operates as a pass code. Given both elements are authenticators in their own right, both are required, and as such any attack must include them both. The attack designed by Prof Ross Anderson targets the Pin aspect of the authentication, and relies on the original card accessed through a series of technology components that have to be connected together in some way. The method shown in this attack makes use of concealment to hide these components on the person of the attacker, and relies on a custom built “attack” card with wires hidden up the sleeve of the attacker, back to the other components involved. The obvious way to therefore detect and prevent this attack at the retailer is by separating the card from the attacker, thus showing the wires and revealing the ruse.

The cloning of cards must be treated separately as the current methods of cloning (that I am aware of at this point in time) only create “yes cards” which would not work in this attack scenario as they are not true copies and would be detected by the PoS equipment as fraudulent. As I understand it, there is no economically viable way of cloning Chip & PIN Cards effectively at this time. Any cloning would still focus on the magnetic stripe data, which can be easily cloned, but is not accepted by the retailers (usually) when a Chip & PIN card is presented. This of course is at the discretion of the retailer and out of the control of the consumer or the banks.

This brings us to the counter argument, specifically in relation to the increased risk of your card getting skimmed/cloned by the retailer when you hand it over. Een if it were viable to clone the chip cards, given that a card skimmed by a retailer would typically not get the pin as well (this of course is not always the case), using the now cloned card would have to make use of Prof Ross Anderson’s attack method, which if the aforementioned process change was implemented, would not work, so in effect increasing the risk of cloning, but decreasing the risk of a successful attack using the cloned card and “breaking the circuit”.

This of course relies on the premise that the use of the cards magnetic strip is in fact not viable, and therefore if anything, reinforces the use of Chip & PIN ironically. Of course in real life the Magstrip is regularly used, but that, again is outside the scope of this discussion and considered irrelevant in the face of the specific discussion around Prof Andersons attack.

There is always of course the argument for using a small form factor wireless transmission device to remove the need for wires, but given the form factor of a credit card and the inability to alter this form factor without raising suspicion, I am personally unsure that significant enough range for a TX/RX comms loop could be achieved given the power that could be implemented into a credit card sized device.

Again, in my original comments to the press I clearly stated that the system needed to be fixed, and that the attack was effective, so this is not me suggesting that we should brush this under the carpet, in fact it is simply looking at what we can potentially do NOW to protect the system, while its eventual upgrade is debated and planned.

Don’t forget, in this context I am just as much of a concerned consumer as you.

Like

Unlike

                          

Related posts

• Press Coverage – March 2009 (0)
• Press Coverage – July 2009 (0)
• Press Coverage – January 2010 (0)
• Press Coverage – February 2009 (0)
• Press Coverage – August 2009 (0)

Like

Unlike

                          

Related posts

• No related posts.

Track List:

                          

Related posts

• My New Toy (APC40) (0)
• Dirty Friday – 05032010 (0)
• Christmas Messin Around 21/12/2009 (0)
• Rolling House Beats – 15/08/2009 (0)
• Investment Complete! (0)

Like

Unlike

                          

Related posts

• Dirty Friday – 05032010 (0)
• Sunny Side Up 25/01/2010 (0)
• Rolling House Beats – 15/08/2009 (0)
• My New Toy (APC40) (0)
• Electro-Fied – 04/08/2008 (0)

Like

Unlike

                          

Related posts

• The Asymmetry of Security (0)
• Snort Rocks! (2)
• Security as a Career (0)
• Press Coverage – March 2009 (0)
• Press Coverage – July 2009 (0)

First of all, lets define what we are talking about. There is a simple definition for Cloud Computing, and three models of operation as held by NIST, these are:

Definition:

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models.

Models of Operation:

Cloud Software as a Service (SaaS). The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

Cloud Platform as a Service (PaaS). The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.

Cloud Infrastructure as a Service (IaaS). The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).

Now, I am pretty sure that during my long career, I have seen a lot of companies doing IaaS and PaaS as a “Business as Usual” activity, haven’t you? In my experience, IaaS is nothing more than a traditional infrastructure outsourcing arrangement, as undertaken with IBM, HP/EDS or BT, while PaaS is just a simple hosting service offered by most ISP’s (I accept I am simplifying here). So what are we really talking about when the press pickup and pedal the term “cloud computing”. Looks to me like they are talking about SaaS, which again, has been around for a while, Hotmail anyone?, but not really taken off in the enterprise until it became “cloud computing”. So is this just a media spin to pedal Hotmail to the enterprise or just a natural progression from outsourcing boxes to apps? What is revolutionary here, I am yet to see.

                          

Related posts

• The Asymmetry of Security (0)
• Snort Rocks! (2)
• Security as a Career (0)
• Press Coverage – January 2010 (0)
• PenTest Straw Poll (0)

The Xponent is an awesome tool, it is the perfect transition medium for anyone thinking of moving into digital and is very well featured. Its a little on the plastic side, and the faders feel like they are fisher price, but it works like a dream and is portable enough to follow me around the country!

I now have two primary setups, home & away.

Home is the Xponent, married to my main desktop feeding a pair of KRK RP6G2 Active Studio Monitors, and it sounds awesome!

Away is the Xponent. married to my X200s Laptop & feeding a pair of M-Audio AV20 portable studio monitors, although it lacks base, it has punch, power and clarity and lets face it, we don’t want to piss off the neighbours in the hotel now do we

I still suffer from the age old problem of not actually having time to use this lot, but the away kit helps with that problem a fair bit, so once I get fully transitioned, expect a flurry of new mixes on the way!

                          

Related posts

• Which MP3 Solution? (0)
• The next big thing (0)
• Sunny Side Up 25/01/2010 (0)
• My New Toy (APC40) (0)
• Electrix EQKiller’s (0)

Accountancy Age – August 2009 – Dark Pools of Talent

Like

Unlike

                          

Related posts

• Press Coverage – March 2009 (0)
• Press Coverage – July 2009 (0)
• Press Coverage – January 2010 (0)
• Press Coverage – February 2009 (0)
• Press Coverage – April 2009 (0)

Sheffield Star Business Monthly – July 2009 – Hacking

Like

Unlike

                          

Related posts

• Press Coverage – March 2009 (0)
• Press Coverage – January 2010 (0)
• Press Coverage – February 2009 (0)
• Press Coverage – August 2009 (0)
• Press Coverage – April 2009 (0)

computing.co.uk – April 2009 – Malware
computing.co.uk – April 2009 – Risk in the recession
pcauthority.com.au – April 2009 – Microsoft
computing.co.uk – April 2009 – Microsoft
crn.com.au – April 2009 – Risk in the recession
whatpc.co.uk – April 2009 – Security
computing.co.uk – April 2009 – Malware
Searchsecurity.co.uk – April 2009 – Conficker & Patching

Like

Unlike

                          

Related posts

• Press Coverage – March 2009 (0)
• Press Coverage – July 2009 (0)
• Press Coverage – January 2010 (0)
• Press Coverage – February 2009 (0)
• Press Coverage – August 2009 (0)

Insurance Times – March 2009 – Data Loss Issues

Like

Unlike

                          

Related posts

• Press Coverage – July 2009 (0)
• Press Coverage – January 2010 (0)
• Press Coverage – February 2009 (0)
• Press Coverage – August 2009 (0)
• Press Coverage – April 2009 (0)

Computer Fraud and Security – February 2009 – Ethics & Hacking

Like

Unlike

                          

Related posts

• Press Coverage – March 2009 (0)
• Press Coverage – July 2009 (0)
• Press Coverage – January 2010 (0)
• Press Coverage – August 2009 (0)
• Press Coverage – April 2009 (0)

North West Insider – August 2007 – IT Security
North West Insider – August 2008 – BERR Survey

Like

Unlike

                          

Related posts

• Press Coverage – March 2009 (0)
• Press Coverage – July 2009 (0)
• Press Coverage – January 2010 (0)
• Press Coverage – February 2009 (0)
• Press Coverage – August 2009 (0)

                          

Related posts

• Electro-Fied – 04/08/2008 (0)
• Dirty House (16/07/2008) (0)
• Dirty Friday – 05032010 (0)
• Christmas Messin Around 21/12/2009 (0)
• Sunny Side Up 25/01/2010 (0)

What I have at this stage is a premise and an outline set of requirements. The premise is simple, go fully digital, but retain analogue controls. The outline components are as follows:

• A powerful PC/MAC + Essential Apps such as Ableton Live
• A High Quality Multi-channel sound card
• A midi trigger device
• A Good quality Mixer
• A Sampler/Effects Unit

Now, its actually possible to have all of the above in a single box, and in fact, many solutions exist for sub £250, but to be honest, its just not going to give me the flexibility and expandability that I desire. What I want is complete fluidity in the solution so that I can expand upon for many years, giving me not only multi-channel mixing, but the real-time remix capability that I desire

So where next?

Well, I already have a decent mixer (DJM600), a powerful PC (Multi-Xeon Monster) and Ableton, so the most important piece and crux of the system is what I need to acquire first. This would be the multi-channel sound card! I have had a look around and found many options, but this one seems to be the best by a mile:

Motu Ultralite MK3

This unit has all the features I could need, from 192Khz sample rates, through to 6 channels of input and 10 channels of output to give me as many feeds as I could possibly deal with! The spec list goes on forever on this thing, which is why it can command a £500+ price tag. But if I am going to invest, this is the way forward.

Like

Unlike

                          

Related posts

• My New Toy (APC40) (0)
• Investment Complete! (0)
• Dirty Friday – 05032010 (0)
• A simple truth (0)
• Why upgrade your iphone? (0)

The fact of the matter is, I am bored with mixing! What I mean is, simply firing up the 1210’s and spinning a few tracks just doesnt do it for me anymore. I think this is a trend that is also reflected in the current dance music scene. Consider a true talent in the scene today, such as Deadmou5, vs an old skool DJ like Dougal or Vibes? The once,  “studio only” production techniques are being utilised on the fly to bring dynamic, real time remixes to the clubs. This is something that really interests me, something I want to pursue further. MP3’s are part of the equation, but so are real-time sequencers like Ableton Live, sample pads, real-time effects processors and a lot of time spent creating, dissecting and amassing lots of custom loops. Put all this together, and you have what the scene now desires, and what I personally want to give.

Watch this space….

Like

Unlike

                          

Related posts

• My New Toy (APC40) (0)
• Dirty Friday – 05032010 (0)
• Sunny Side Up 25/01/2010 (0)
• Investment Complete! (0)
• Christmas Messin Around 21/12/2009 (0)