TGF

What happened to Ben Grubb and Christian Heinrich at Auscert 2011?

2011-05-18T01:00:00.001+10:00

There is lots of buzz about Ben Grubb getting 'arrested' at Auscert yesterday:

I've been arrested by Queensland Police for a story I wrote today. They've also seized my iPad. #AusCERT

So what actually happened?

On Sunday, before the start of Auscert, Security B-Sides was held at Royal Pines resort. The B-Sides were a series of short presentations that weren't part of Auscert, were independently run and were free to attend. Only about 20 people attended these.

Christian Heinrich @cmlh gave a presentation entitled "For God Your Soul... For Me Your Flesh". In the presentation Christian disclosed some vulnerabilities affecting Myspace, Flickr and Facebook. In the case of the Flickr and Facebook vulnerability, Christian was able to demonstrate the accessing of private images. Christian deliberately chose to compromise photos belong to Chris Gatford's wife... photos of Chris. One of the photos Christian accessed had Chris's child in it and Christian had obscured the child. Chritian and Chris aren't on good terms... Christian explained this, he also said that he'd told Chris that he was going to target his account. A number of people (including myself) tweeted the presentation.

As a 'test subject' @cmlh gained access to photos belonging to @ChrisGatford on Flickr and Facebook #bsidesau #auscert

My recollection is that Ben Grubb, a journalist for smh.com.au didn't attend the presentation by Christian, but arrived after it was finished. After the presentations were finished for the day Ben interviewed Christian for an article that would be published on smh.com.au on Tuesday.

That article now has no image associated with it, but when it was initially published it contained the image that Christian had obtained from Chris Gatford wife's Facebook account, the child was obscured in this photo also.

Christian Heinrich left Auscert around lunch time on Tuesday.

Late in the afternoon of Tuesday, after the conference sessions had finished, Queensland Police approached Ben Grubb. I didn't see it. I don't know what was said. I don't know if Ben was arrested, detained, or questioned or for how long.

After Ben sent out the tweet saying he had been arrested the #auscert hashtag went crazy with lots of questions being asked about Ben. As I was still at the auscert conference venue I wandered down to the media room to find out what had happened. Ben wasn't aware of the concerns or the questions on Twitter as his phone, that he'd previously tweeted from, was flat and his iPad had been taken by Queensland Police. Ben was visibly shaken and clearly under the impression that he had been arrested (if only temporarily) and released; he didn't talk about what he had discussed with Queensland Police. From my judgement of Ben and others demeanour it didn't seem that Queensland Police just had some friendly questions for him.

I imagine there is more to happen in this story when police catch up with Christian Heinrich.

Was what Christian did ethical? In my mind, no.
Was it legal? Probably not.
Did QPS intimidate Ben Grubb? It would seem so to me.
Should Ben Grubb have a case to answer to police? To me, it seems like QPS are shooting the messenger.
Can police just sieze someones iPad like that? They seem to think so.

Auto Start Hulu and VPN from Windows 7 Media Center

2010-10-25T18:24:00.002+10:00

The info below will give you the necessary information to add a button to Media Center to start Hulu, but do some other nice stuff along the way (like start a VPN and change the power scheme)

I run Windows 7 Media Center on my primary TV & enjoy using it to watch Hulu, but unfortunately every time I want to start Hulu I've got to reach for the keyboard because I'll typically want to run a VPN connection first, so I created a short batch file to perform the necessary tasks for me. My batch file looks like this:

taskkill /IM "ehshell.exe"

ping 127.0.0.1 -n 20 -w 1000 > nul

powercfg -s 90729505-f061-4a2d-9304-adb0f3b267ab

rasdial "StrongVPN" username password

start /WAIT %LOCALAPPDATA%\HuluDesktop\instances\0.9.14.1\HuluDesktop.exe

rasdial "StrongVPN" /disconnect

powercfg -s 381b4222-f694-41f0-9685-ff5bb260df2e

start C:\Windows\ehome\ehshell.exe

Stepping through the file, this is whats happening:

taskkill /IM "ehshell.exe"

This juts kills Windows 7 Media Center - I don't want it to run in the background or else it will steal focus.

ping 127.0.0.1 -n 20 -w 1000 > nul

This pauses for 20 seconds (maybe there is a better way to add a wait command to a batch file, but this works) while Media Center shuts down.

powercfg -s 90729505-f061-4a2d-9304-adb0f3b267ab

This changes my power saving settings so that my screen doesn't turn off while I'm using Hulu (usually it will turn off after 15 minutes and Hulu doesn't stop it from doing so). To get the guids for your power saving settings for your computer use "powercfg -l" - create a new power saving profile that doesn't turn off the screen or computer first.

rasdial "VPN" username password

This starts the VPN connection.

start /WAIT %LOCALAPPDATA%\HuluDesktop\instances\0.9.14.1\HuluDesktop.exe

This starts Hulu - I have to use the .exe in the instance folder rather than the one in the HuluDesktop folder as all the one in the HuluDesktop folder does is run the one in the instance folder (and then the start /wait part of the command doesn't wait properly). I think I will have to update this location in the batch file whenever Hulu updates. The "start /wait" part of the command means the batch file doesn't continue until Hulu closes.

rasdial "VPN" /disconnect

Disconnects the VPN.

powercfg -s 381b4222-f694-41f0-9685-ff5bb260df2e

Returns the power saving settings to my normal power setting.

start C:\Windows\ehome\ehshell.exe

Start Media Center again now that it's all finished!

All I did then was store that file somewhere and create a shortcut to it in the C:\Users\MY USERNAME\AppData\Roaming\Media Center Programs folder. A crude looking shortcut now appears in the Media Center's Extras folder!

You think you'd get something for $43b

2010-08-19T21:04:00.003+10:00

You'd think if you spent $43,000,000,000 on something you'd actually get something from your money, even if the project delivery wasn't really spot on - but ironically, the $43b the Australian Labour Government is proposing to spend on Australia's Internet will leave all Australian's with lower speed broadband with higher monthly costs.

Don't get me wrong - just like everyone else, I want the fastest Internet I can get & I know that the best way for me to get that is to have a piece of dedicated fiber running into my home serving me, in Stephen Conroy's words, data at the speed of light "and you can't get faster than that".

Two things could happen with NBN: (a) it is fabulously successful, is delivered under budget and achieves everything it sets out to achieve and (b) it stuffs around for several years, provides lightning-fast Internet to a few pockets of people (particularly in the second quarter of 2010 and a similar timeframe in 2013), but eventually dies in a burning heap of flames and is bought up by Telstra for far less than the $50b+ that was spent on it.

I really hope (b) happens and not (a).

You see if (a) happens then it means:

The Government will have paid Telstra $11,000,000,000 to switch off the copper network that practically all Australian's are currently using to access the Internet (yes, even if you're not with Telstra as your ISP) and make their home phone calls. Yes, this network that is serving 20Mbps+ Internet to many Australians, or around 2-5Mbps to a vast majority of Australians, meeting their needs quite adequately, will be turned off. We will not wring every last bit out of this network, we will not transition off of it through a gradual rollout of new technologies - instead we'll pay Telstra, a public company, $11 billion dollars to just turn it off!
You will have NBN fiber connected to your house. The Government will have legislated to require you to allow them to enter and install it. You see, they can't afford to roll it out according to demand - instead, they'll need to install it in each and every house as they make their way down your street, they can't come back and do your house next month or next year, it's too expensive to do that.
You'll be paying about $100/month for your Internet access, which you'll get from someone like iiNet or Internode. The price will be so high because they're paying NBN Co not much less than that for the wholesale service. This will be the base service available.
You won't be able to get Internet from anyone other than NBN Co because the copper network you used to get your modest Internet from will have been shut down.
Pensioners and other welfare recipients will get a subsidy as otherwise they won't be able to afford to have the Internet which is, of course, a basic entitlement just like electricity or a phone line.
You'll be stuck with this model for a long, long, long time. With a Government owned Monopoly delivering your Internet, any competitor who actually tries to innovate and deliver new, cost-effective services in medium and high-density city and suburban areas will be actively discouraged by the Government - after all, a return is required on those Infrastructure Bonds that were issued to pay for half of it! NO NEW SERVICES WILL BE ABLE TO COMPETE.
NEW SERVICES WILL COMPETE. Inevitably, new services will compete in this uncompetitive market. They will be wireless, they won't make use of fiber, as there's not enough subscribers left to warrant rolling it out, and they won't be on copper as they aren't allowed to use that, even though it's still in the ground. The wireless will be faster than we have now, not as fast as the NBN network, but it will be sufficient. Most importantly, this new, cost effective Internet will be WELL BELOW THE CURVE - much slower than users in other countries get on their commercially-delivered & demand-driven fiber networks & much slower than we could have had under a similar model. USERS IN REGIONAL AREAS WILL HAVE NO OPTIONS - just like in the days of Telecom, they'll get the expensive Government service.

Of course, eventually the NBN mess will be mopped up. The Liberal party will be running the country, they'll blame it on Labour, sell the NBN off to Telstra and we'll start building our real Internet.

So I guess we'll get the mess of (b) after all... I just wish we could have had it sooner.

Why paywalls makes free news better

2010-06-14T20:01:00.002+10:00

Almost a year ago Rupert Murdoch started talking about how News Limited would start charging for news content online. It's interesting that he started doing this, not in a time of record profits for News Limited, but at a time when they were suffering record losses - this is the first hint that his idea may not be a good strategy, i.e. that it didn't come out of some noble concept of how to make news better, but rather out of a desperation in trying to turn a buck.

But the trouble with Murdoch's idea of paid news is that in simply setting up your business model, you help your competitors.

You see, at the moment, there are lots of free news services - and they're all competing for advertising dollars, which comes from eyeballs on websites. If Murdoch puts his quality content behind a paywall then that means more eyeballs for his competitors, who will then be able to offer better quality news.

Traditional media is struggling to turn a dollar in the online world, yet strangely enough new media companies seem to be quite comfortable with their online ventures - maybe the problem is not with the ability to turn a dollar in online news, but simply the expectations and preconceptions from old media moguls as to how online works.

Dropbox Security Problem - Data Leakage

2010-06-09T23:34:00.024+10:00

Dropbox has an issue with the way it handles link sharing that could potentially lead to data leakage.

The problem is fourfold:

Files outside of the Public folder can be shared
Shared files leak data about the file structure
Deleting and replacing the shared file with another allows the new file to be leaked
Shared files can’t be revoked

This security problem is demonstrated below.

First of all I start by creating a file called ‘PrivateFiles’ in the ‘My Dropbox’ folder. I’m going to use this to store my most private of data.

Inside that folder I’ll store ‘MyPrivateFile.txt’:

As you can see, it has some very personal data in it:

I’ve got to use my iPad for the next step, because the PC or Mac client won’t let me share a file from anything other than the Public folder (in fact I’m not sure if allowing sharing from other than the Public folder on the iPad is an oversight or not – regardless, this is the first security concern – the sharing of files from outside of the Public folder on the iPad when other clients won’t let you).

So when I look at my iPad I see the PrivateFiles folder:

And inside that I can see MyPrivateFile.txt, including the correct contents of that file:

Next, I’ll share the file by emailing a link of it:

The link that is sent is actually a short link – in this case http://db.tt/GdBSei, which redirects to http://dl.dropbox.com/0/view/1xldjhg9mbrt95s/PrivateFiles/MyPrivateFile.txt

This demonstrates the next data leakage problem – i.e. that I can see the path ‘PrivateFiles’ – I didn’t choose to share this, I only chose to share the file – this path may not be something you wish to reveal.'

The major problem happens for me after I create new file in the same directory, in this case ‘AnotherFile.txt’…

Then delete the original file…

And now rename the second file to have the same name as the original.

Note that copying a replacement file into the directory will also work, all that matters is there be a file there with the same name as the original. Now when I open the file using the link I was emailed before I get:

I get the replacement file!! Is that what anyone expects to happen? I guess I did share a link to the file, not a copy of the file, but it still doesn’t feel right – it’s not the original file!!

What makes this problem worse is that Dropbox won’t allow me to revoke shared links. That means that I’ve now published a permanent copy of whatever file ends up sitting in that folder with that name. What if it is something like resume.doc where I don’t want people to see me editing the file? Or what if it is temp.zip? Whatever it is – it is now permanently out there, permanently shared for anyone to access – no dropbox account required to access it!

Anyone want to try running through filename combinations for that db.tt domain? You don’t need to have had it shared with you as no authentication is required, you just need to hit the right URL!

Australian Internet Filtering - what we should be doing

2010-05-28T13:13:00.005+10:00

There's so much spin and mis-information about the Internet Filtering debate in Australia, and unfortunately many of those debating the current issues don't understand what is being proposed and why it won't work.

Unfortunately one-size never fits all and even more so when it comes to Internet Filtering. The Internet presents us with many content and law-enforcement challenges, that require different solutions to solve - this is a fact that seems to escape the current Australian Government, with Stephen Conroy and Kevin Rudd wanting to plow ahead with a single, mandatory, ISP-based Internet filter.

What I've identified below are the problems that (some people think) we need to solve, why the currently proposed Conroy solution won't work, and what will work.

Problem	Why Conroy’s Solution Won’t Work	What Will Work
Children accidentally finding inappropriate content (porn)	Only the worst-of-the-worst pornography sites will be blocked by the filter	PC-based filtering. Government should pay the ISP $x per month, per client that has it installed – let the ISPs profit from it & it will get rolled out
Children deliberately finding inappropriate content (porn)	See above – under Conroy’s solution, children will still be able to browse porn sites	Voluntary ISP-based filtering that all ISPs must offer to their users. Funded by the Government, parents will be able to opt-in at no cost. Note: A determined, Internet-savy child, will still be able to bypass this, so an education campaign (for parents) is vital as well.
Child pornographers accessing child pornography	Child pornographers don’t visit normal websites to access and share material; they get it from peer-to-peer networks, private networks, or hacked websites. This material will not be able to be found or blocked by the Conroy filter.	Law enforcement. Undercover agents. Raids in the middle of the night. People smashing down doors.
People accessing refused-classification (RC) material	First of all – it isn’t illegal to create or to view RC material, you’ll only get in trouble from distributing it. But this material will only get classified as RC once its submitted to the classification board. The classification board doesn’t have enough reviewers to review the entire, dynamically changing Internet. But the stuff they review and classify as RC will be blocked. But bypassing the block will be as easy as buying a $50/year VPN connection to the United States, or visiting an anonymising site before you look at the RC material.	Nothing will work will well. The Conroy filter will be able to block RC material, but then all the provider of that material needs to do is change the content to website.com/rcmaterial to website.com/rcmaterial2 and the entire 3-month review cycle with the classification board will start again. Of course, in the real world, RC material continues to get distributed anyway from friend-friend (i.e. peer-to-peer)

So my 3-step plan for cleaning-up the Internet in Australia is:

1. Net Alert: Continue to provide filtering software for people’s PCs. The Government pays the ISP enough to allow the ISP to make a profit & the ISP will then be incentivized to make people know about it.

2. Government funded ISP filters: ISPs will be required to implement them, but users can opt-in or opt-out to particular content.

3. Law enforcement: We’ll always need the police to bash down bad guy's doors

Auscert 2010 IBM USB Key Malware email message headers

2010-05-21T17:44:00.000+10:00

Microsoft Mail Internet Headers Version 2.0

Received: from xxxxx ([xxxxx]) by xxxxx with Microsoft SMTPSVC(6.0.3790.4675);

Fri, 21 May 2010 16:31:28 +1000

Received: from xxxxx ([xxxxx]) by xxxxx with Microsoft SMTPSVC(6.0.3790.4675);

Fri, 21 May 2010 16:31:15 +1000

Received: from xxxxx (xxxxx [xxxxx])

by xxxxx (Postfix) with ESMTP id 9858F2120B2

for ; Fri, 21 May 2010 16:31:32 +1000 (EST)

Received: from emx02.extremedns.net ([203.62.184.74])

by xxxxx with ESMTP; 21 May 2010 16:31:11 +1000

Received: from EXC04.extremedns.net (180.189.153.2) by emx02.extremedns.net

(203.62.184.74) with Microsoft SMTP Server (TLS) id 14.0.694.0; Fri, 21 May

2010 16:31:04 +1000

Received: from EXC04.extremedns.net ([fe80::755b:17ce:21aa:a1e7]) by

exc04.extremedns.net ([fe80::755b:17ce:21aa:a1e7%14]) with mapi; Fri, 21 May

2010 16:31:56 +1000

From: AusCERT

To: AusCERT

Subject: AusCERT Important Information - Malware on IBM USB

Thread-Topic: AusCERT Important Information - Malware on IBM USB

Thread-Index: Acr4rxjUKocJyYVwR1+gPZTcHpAWOg==

Importance: high

X-Priority: 1

Date: Fri, 21 May 2010 06:30:25 +0000

Message-ID:

Accept-Language: en-AU, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

Content-Type: multipart/alternative;

boundary="_000_DD6937D5F83D404E8B4851E00EEC6F8004A04950exc04extremedns_"

MIME-Version: 1.0

Return-Path: auscert2010@conferenceit.com.au

X-OriginalArrivalTime: 21 May 2010 06:31:15.0495 (UTC) FILETIME=[36BF4370:01CAF8AF]

--_000_DD6937D5F83D404E8B4851E00EEC6F8004A04950exc04extremedns_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

--_000_DD6937D5F83D404E8B4851E00EEC6F8004A04950exc04extremedns_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

--_000_DD6937D5F83D404E8B4851E00EEC6F8004A04950exc04extremedns_--

Auscert 2010 IBM USB Key Malware letter

2010-05-21T16:43:00.001+10:00

Dear AusCERT Delegate

At the AusCERT conference this week, you may have collected a complimentary USB key from the IBM booth. Unfortunately we have discovered that some of these USB keys contained malware and we suspect that all USB keys may be affected.

The malware is detected by the majority of current Anti Virus products [as at 20/05/2010] and been known since 2008.

The malware is known by a number of names and is contained in the setup.exe and autorun.ini files. It is spread when the infected USB device is inserted into a Microsoft Windows workstation or server whereby the setup.exe and autorun.ini files run automatically.

Please do not use the USB key, and we ask that you return it to IBM at Reply Paid 120, PO Box 400, West Pennant Hills 2120.

If you have inserted the USB device into your Microsoft Windows machine, we suggest that you contact your IT administrator for assessment, remediation and removal, or you may want to take the precaution of performing the steps below.

Steps to remove the malware:

1. Turn off System Restore

[StartProgramsAccessoriesSystem toolsSystem Restore]

Turning off System Restore will enable your anti virus software to clean the virus from both your current system and any restore points that may have become infected.

2. Update your antivirus tool with the latest antivirus definitions

[available from your anti virus vendor of choice].

3. Perform a full system scan with your AV tool to confirm the existence of the infection. If malware is detected allow your AV to complete a clean.

4. On completion of this process, complete a second scan using a different anti virus product. Free anti virus products are available from known companies such as AVG, Avira, Panda Software, or Trend Micro.

5. Once a second scan has been performed and it is determined that your workstation is free of any known malware, as a precautionary measure we recommended that you perform a back up of all vital files on your workstation and perform a full re-installation of the operating system. This process will remove the risk of other unknown or undetected malware that may be present on your machine.

If you experience difficulties with the above steps, please contact the IBM Security Operations Team at secops@au1.ibm.com. An IBM technical support person will contact you by phone to assist you.

We regret any inconvenience that may have been caused.

Glenn Wightwick

Chief Technologist

IBM Australia

No more twitter SMS love

2008-08-14T18:20:00.002+10:00

Twitter have announced that they will no longer be sending SMS updates through their European server, which means no SMS love for many including those of us in Australia.

Twitter without SMS updates is pretty much useless as the whole point of it is as a fast micro-messaging platform.

I'm currently trying to hack something through Yahoo Pipes and an RSS to Email gateway so that I can at least get updates on a few of the people I follow sent to email, but even if I get that to work its still doubtful if it will be a workable solution.

I only hope that they can negotiate a deal with a phone company in Australia to enable the sending of SMSs and doubly hope that that deal will mean those on Optus can get messages.

Apple iPod Touch 2.0 firmware

2008-07-13T09:05:00.002+10:00

The 2.0 firmware for the Apple iPod Touch is now installed on my device - this is the same firmware that is installed on the new Iphone 3G. After initial problems with downloading through the first 24 hours of release (Apple didn't seem to have the infrastructure to keep up with the load from the new release of the iPhone 3G) I finally managed to get it installed.

The installation required the device to be completely wiped, i.e. music/videos and all. The update process took care of doing a full backup and starting the restore of all my data afterwards. Given that I had around 16Gbytes of data, the whole process took close to an hour.

So now that I've been playing with the new firmware a bit, this is how I feel about it:

The ability to install applications is a killer feature, there are some great applications out there, but many of the free games are quite ordinary & many of the really good applications will require at least a data connection - but this can be taken care of if you're in a wifi area or have some other method of getting your iPod Internet connected (I use JoikuSpot).
So apparently the iPod touch has had an external speaker all along - previously the only out-loud message it would make is the 'click' when you typed, but now it plays a little tune when you receive new email - I wonder what else this little speaker can do.
(Not really a 2.0 firmware update but actually an iTunes 7.7 update) I can now synchronise by GMail contacts with the device rather than just Outlook contacts.
On the downside, the method of fast-forwarding through videos has changed. The old method was better whereby the first 10 seconds of fast forwarding were just sped-up audio, but now they skip through the audio meaning that you can't even fast forward for short pieces without missing out on what is being said. Also, the fast-forwarding now takes much longer to kick into a higher-speed fast forward. Maybe I'll get used to this but for now its just an annoyance.
My Wifi connection now seems to be much more stable - I have always had problems with my iPod connecting to my home wifi, particularly since I juiced up the output power of my wireless access point for another purpose - my use of the iPod since the 2.0 update has shown a much faster & more reliable wifi connection.
Lastly, the email application on the device is a little bit more usable with only a slight change to the interface.

Overall I love the update, but will be looking forward to being able to jailbreak it again as there are some apps for the device that aren't in the iTunes store that I'd really like to use again.

Media Centre Bandwidth

2008-06-30T21:29:00.003+10:00

I was having trouble with my wireless connection to my Vista Media Centre- I just couldn't get a good enough signal, to get good enough bandwidth to stream DVD rips from my NAS to VMC (it would jitter and pause). After a bit of fiddling I managed to get it to work and have since taken note of the bandwidth requirements. It seems to peak at around 20Mbps, but is certainly not a continuous stream. Here is the bandwidth chart:

Apple iTunes profiteering

2008-06-29T17:16:00.002+10:00

I applaud Apple for now making TV shows available through iTunes Australia. You've got to question the ethics of their business model though when they are selling programs that have previously been available as free podcasts. (Of course the old archived episodes aren't available through iTunes)

Sleek Geeks: $15.99 or free
Summer Heights High: $21.99 or free

So now that the ABC have a channel for selling these programs will they continue to publish subsequent series of these shows for free?

Old etax versions

2008-06-29T17:03:00.002+10:00

In case anyone has ever had the same problem as me and needed those old versions of etax software that the ATO issue, I've gathered them and made them available for download from here.

Gateway 2 Flash Game

2008-06-26T19:18:00.002+10:00

I previously blogged about the Gateway flash game that I enjoyed.

Well there is now a Gateway 2, which is just as much fun.

And here is the solution:

Tutorial (rooms 1,2 and 3)
Room 1
Press the button

Room 2
Pick up the stairs
Place the stairs on the indicated spot
Press the button

Room 3
Pick up the remote
Pick up the batteries
Put the batteries in the remote
Use the remote on the sensor

The First Tape
The Main Room
Enter the open gateway to the left

Room 5 (Hallway)
Push the button
Enter the newly opened gateway

Room 6 (Bathroom)
Use Sink
Open warm water tap
You get the code 7997
Use the keypad and enter 7997
Pick up the video tape
Pick up the bathroom mirror

Return to the hallway
A lady will leave the hallway, the door will close, an eye will appear
Use the mirror on the eye when you're standing under the lamp

Main room
Put the video tape into the TV
Push the transfer button
Watch the videos if you wish (push the numbers and play)
Eject the tape
Enter the gateway to the right

The second tape
The hallway
Stepping on floor panels changes their state
You need to turn them all off
1 changes 1 and 5
2 changes 2 and 4
3 changes 3 and 6
4 changes 4 and 6
5 changes 2 and 5
6 changes 5 and 6
Its not too difficult, just keep trying

The room with the couch
Get the newspaper
Get the lighter
Open the drawer & get the screwdriver
Look at the picture and note 786
Look at the lock and notice the key is in it
Put the newspaper under the door
Use the key on the lock
Pick up the newspaper to get the key
Use the key on the lock
Enter the door

The black room
Cross the room quickly
Get the tape
Go back to the main room and watch the tape
Enter the newly opened door

The third tape
The hallway with the phone
Read the note on the table
Scribble on the bottom of the paper to get the number 86763454
Turn the lamp on and off 3 times
Pick up the handset and dial the number indicated
The door opens, go through it

The hallway with the sprinkler
Use the lighter on the sprinkler
Go through the door

The kitchen
Get the video tape
Open the fridge door and hide behind it
Return to the hallway

The hallway with the sprinkler (again)
Stand under the light and use the mirror on the water
You'll see Blue, Purple, Yellow, Green, Red, Orange
Set this pattern on the alarm override
Return to the main room and watch the video tape
Enter the new door

The fourth tape
The hallway with the window
Look at the numbers 24, 79 and 163
Look in the window
Force the student to do some sums that equal 24, then 79 then 163
Enter the newly opened door

The room with the telescope
Look through the telescope and wait for her to signal with the lamp
Turn your lamp on and off three times and look back through the telescope
Afer the phone rings pick it up
Dial the code 11223311 (from the note on the paper)
Enter the newly opened door

The room with the other tv
Note the painting on the wall is the same as in the previous room
Look at the tv and switch to channel 7, then 8, then 6 (from the previous wall painting
Get the video tape
Return to the original room and watch the tapes

The dates on the tapes are:
1: 01/11
2: 06/12
3: 01/04
4: 24/03
5: 03/06
6: 04/01
7: 28/05
8: 03/06
9: 03/06

So the chronological order of the tapes is: 264379851 (note that 1 happens way after everything else)

The end
Pick up the wire
Examine the girl and put the wire in her neck
Enter the code that we derived from the chronological order above
Leave the room to get the credits!

Behind the Scenes with "Where the Hell is Matt?"

2008-06-24T20:21:00.002+10:00

"Where the Hell is Matt?", created by Matt Harding, is a great serious of videos of him dancing around the world - sounds lame, but there is something extra special that he captures in his videos.

When he came to Brisbane to film his latest video, I had the opportunity to join him in filming a segment for his latest video. Lamentably I didn't dance with him, but I did film the occasion so you can see what goes on behind the scenes to create about 2 seconds of video that made it into his latest effort.

Escape the Future

2008-06-21T13:52:00.001+10:00

A nice fun puzzle called Escape the Future... might take an hour or so of your time. Solution available here.

224 is a unique number

2008-06-10T22:34:00.002+10:00

Every number up to and including 223 has its own page on wikipedia. So why not 224? After all, it is unique in that it is the lowest number without its own wikipedia page!

I don't want Safari

2008-04-17T19:45:00.001+10:00

No Apple, I do not want to install Safari on my computer - would you please stop trying to push it on me through your software updates. Just because I use iTunes doesn't mean I want to have to continually tell you every month that I don't want you to install Safari for me!

Google Reader Shared Items

2007-12-29T13:32:00.001+10:00

Google Reader nows allow you to share your items inside your friends Google Reader windows... a very nice feature (you can view my shared items here).

One additional feature I'd like is to be able to comment on the shared items so that when my friends view the item, they view my comments as well.

qik.com

2007-12-18T22:25:00.001+10:00

qik.com - Wow!

"US Cache" replacement - the video

2007-09-16T20:02:00.000+10:00

We replaced a cache the other day for "howaussie and son" who own a cache here in Brisbane called "US Cache", but they are in the U.S. so are unable to maintain it. As we hadn't been caching for a while we did a quick video of out casual stroll out there - Chermside Hills is a lovely bit of bushland!

No smoking... maybe

2007-09-04T23:54:00.000+10:00

Whats wrong with this picture?

Charity telemarketers

2007-08-15T13:58:00.000+10:00

I'm on the Do Not Call register but that doesn't stop charities from calling me (who are exempt from my request to not be bothered).

I got a call from a particular charity today who opened with "Hello we're from suchandsuch charity and we're calling to ask people to give sizeable donations".

I said "Thank you I'm not interested".

"A couple hundred dollars maybe?" he asked.

"No, thank you".

"Maybe five hundred?" he countered.

"No, good-bye", at which I hung up.

I mean, seriously, after less than 20 seconds on the phone do they really expect anyone to just fork over $500... I find it hard to believe that anyone would do that. (Not that I don't give, just that I don't do it over the phone like that).

Skype uninstallation

2007-08-10T18:42:00.000+10:00

I had to laugh at this message that Skype gave me when uninstalling. Can you see whats wrong with this picture?

Rant about QPS

2007-07-31T11:43:00.000+10:00

I had to complete a statutory declaration for the Queensland Police (speeding ticket) and they required it to be witnessed by "a Justice of the Peace, Commissioner for Declarations, notary public, a lawyer or another person authorised to administer an oath under the law of the State, the Commonwealth or another state." [emphasis mine] I had mine witnessed by a Justice of the Peace from NSW.

After sending it in they rejected it with the following explanation: "It is not permissible for Justice of the Peace; Commissioner for Declarations; notary pulic under the law of the State, the Commonwealth or another State; or a lawyer; or a conveyancer; or another person authorised to administer an oath from another state to witness a statutory declaration in Queensland."

Huh!?!? This just don't make no sense at all.

Windows Live OneCare Beta

2007-07-26T09:08:00.000+10:00

Microsoft are encouraging people to get on board with the Windows Live OneCare Beta. Looks to be good to me (been running for a few days now) & it meant that I didn't have to plug in that activation key that I bought yet! More info here: http://get.live.com/betas/onecare_betas

This is my friend Mal

2007-07-04T19:23:00.000+10:00

He is a missionary in training staying with up at the moment.

Nokia N95 and a 4GByte Micro SD Card

2007-07-03T18:43:00.000+10:00

There's been some speculation as to whether or not a 4Gbyte (or larger) Micro SD card will work with in a Nokia N95. The confusion is because Nokia state in their specs that it only supports up to 2GB.

I'm not the first person to test this nor the first one to confirm it, but I thought I would re-confirm it.

See pictures here which show the card, the camera (with a 1GByte card), the camera (with a new 4Gbyte card), and then the camera (with more than 2Gbytes on the card).

Suffice to say - it works.

And if it works with a 4Gbyte SDHC card then this means that the N95 supports SDHC, so even larger cards will work (when they are released).

With mobile pictures too!

2007-06-30T19:10:00.000+10:00

Looks like i can send pictures this easily too!

this will be my first real mobile blog entry

2007-06-30T18:58:00.000+10:00

I've finally got it sorted - blogging from my mobile!

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

2007-05-02T12:07:00.000+10:00

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 is a nice number.

KGC 2007

2007-04-01T23:45:00.000+10:00

We've been away this weekend at KGC 2007 (Kefford Golf Classic). Thanks to Karen and Kingsley for organising it this year. It was a real blast & I took some video to put together which I've uploaded below.

If you've got a slow Internet connection & the video is stopping and starting... just hit pause & go and make a cup of coffee (or go to work if your connection is really slow) and hit play when you come back.

BBC on youtube

2007-03-23T20:08:00.000+10:00

I only just noticed that BBC have a Youtube account. Kudos to them.

Free movie tickets

2007-03-21T16:53:00.000+10:00

ANZ is having a promotion where they are giving away free Hoyts double movie tickets.

Call 1800 852 299 and leave your name, contact and address. Its as easy as that.

2007-03-02T15:05:00.000+10:00

The PCI DSS (Payment Card Industry - Data Security Standard) defines who wears the loss when someone misuses your credit card. Essentially the blame rests with the merchant who will bear the cost of a fraudulent transaction.

Some bloggers have suggested that this is the appropriate spot to place the blame, suggesting that as the merchants are on the pointy of maintaining the security of the card information that they should be responsible for the breach - however this is entirely the wrong approach to take.

There is nothing that merchants can do to stop themselves from being defrauded & this is due to the fundamentally insecure way in which the transaction occurs. There are few, if any, solutions in place that would allow a merchant to validate whether or not the credit card number they've been provided actually belongs to the customer - all they can do is accept the risk of fraud & pass the costs of this on to the consumer. So under this model, no processes are improved & ultimately the consumer ends up paying for the cost of fraud anyway through increased prices.

The credit card companies, who are the only ones who can actually change the system, are left with no responsibility or financial penalties at all - and if they don't suffer then they won't change anything. If they were responsible to make good fraudulent transactions, you'd be sure that we'd have a more secure payment system in a short time.

You see while a particular merchant may be responsible for the leak of the credit card data - it likely will not be the merchant, or at least not alone, who will feel the pain of that leak. The stolen credit card data will be used to defraud other merchants, who may have protected their data quite well. So what incentive is there for a merchant to tightly protect the data when they'll still be impacted no matter how much they spend.

Consumers and merchants are both users of the credit card system - it is the credit card companies who are selling a service to these users & they alone are the ones responsible for fixing the insecurities in it.

Google TV - NOT!

2007-03-01T22:40:00.000+10:00

This video is an interesting one.

A guy by the name of Mark Erickson shows you how to sign up for Google TV - a service, he claims, that is in Beta release from Google that lets you watch television shows from major studios.

The video is a fake - Google TV doesn't exist, however Erickson does a good job of faking it.

While its fake, theres something about it that captures your attention. It'd be nice to be able to stream our favourite TV shows as easily as this. Ironically, within a few years this sort of service will likely be available & if I was in Google's shoes I'd be asking myself "Why not?".

TV studios make series to make money, they make this off of the distributors, who in turn make money off of the advertising. Now although the traditional method is to get advertising from broadcasting it over the air waves - whats wrong with broadcasting it over the Internet instead. YouTube has already proven that they're capable of streaming massive amounts of video simultaneously - so its not an infrastructure issue.

If the studios don't quickly adapt to what consumers want, a new breed of content producers will spring up that will deliver what is wanted... in fact, if they aren't there already then they're very close.

Google Maps gets fair dinkum'

2007-02-06T19:17:00.000+10:00

Google Maps is now a full-cream service for Australians too.

For ages you've not been able to do routing on the Australian maps. Nor have you been able to search for businesses and types of businesses in Australia. This has severely limited the usefulness of google maps for Australia. For example, you'd try to find how far it was from one side of town to the other - but it wouldn't tell you the roads to travel - so this meant that it was great for looking at maps, but not for working with them.

But now you can find out how far it is from the "the gabba, brisbane" to "the melbourne cricket ground, melbourne" by using those exact terms... and instantly you'll learn that its a 21 hour 21 minute drive.

It's also nice to see that Google recognise they have a customer base in Australia and continue to deliver us the same services they get in the US, even if they are a bit delayed.

Verified by Visa is just plain dumb

2007-01-27T22:37:00.000+10:00

I hate the "Verified by Visa" program - it doesn't provide extra security... in fact it takes some away.

The whole concept of the verified by visa program is that when I pay online using my Visa card I get prompted to enter a password for my Visa card before the transaction can continue. This program is just dumb because using the VbV program is optional to merchants. This means that sometimes I get prompted to login to the program when using the card but, more often than not, I don't. So how does this protect me, the consumer? It doesn't... fake vendors will still attempt to steal credit cards from suckers and the suckers will keep giving it to them - outside of the VbV program.

But ahhh... I hear you say... the program isn't for the consumers... it's for the merchants, it verifies to them that the credit card is really being used by the owner of the card. No it doesn't! Because if I setup a fake merchant website to steal credit card details, all I need to do is add a popup at the end asking for the users VbV password... the user will happily give it to me because they've been trained to do this by Visa. You see when a merchant uses VbV I, as a consumer, get redirected from the merchants website to a supposedly Visa website (although it's not even on a visa.com URL) and asked to provide my password. This teaches users to give up their passwords to anyone who asks - bad Visa!

Similary, if someone had already stolen my credit card through some other means (and didn't have my VbV login) and they wanted to run up a bill on it or to extract money from it - they'd just choose a merchant who isn't using the VbV program - they're not prevented from using the credit card number in any real way.

If VISA really wanted a secure program then they would require you to log into your Visa account (or your bank account) and authorise the transaction apart from the merchants website... but they've skipped this step, no doubt, to make the transaction 'smoother'. The end result being that neither the customer nor the merchant are any more protected than they were before.

C'mon VISA - you should be doing more than training users to act in this way in the name of security theater.

Australia Day Caching

2007-01-27T00:18:00.000+10:00

We had a great family day out geocaching for Australia Day. We all came home pretty tired, but its always nice to spend time together.

And here's the video!!!

Dell coupon code

2007-01-17T19:22:00.000+10:00

I recently purchased a new Dell computer. They've sent me a coupon code which is valid for a 5% discount on any Dell purchase until 1st February 2007 & it says to pass it on to family and friends, so here it is: 391504BDE29

MS Office 2007 - on 3 computers for $168!!!

2007-01-10T13:46:00.000+10:00

OK here's the deal... but you'll need to be quick.

Currently Dick Smith have MS Office 2003 Student and Teacher Edition on special for $168. This price is until 28 January 2007. This version of office is licensed to be used on up to 3 computers!

Also at Dick Smith, if you buy the above you will get a $27 WISH voucher that you can use at a number of stores in the Woolworths chain including Woolworths and Big W (so you shouldn't have any trouble speding it). I don't know how long this offer is available.

Then... Microsoft currently have an upgrade guarantee program on where you can get an upgrade from your newly purchsed version of Office 2003 to the equivalent version of Office 2007 for only $27.00. You need to visit their website to get the full details, but its just a matter of filling in forms and mailing something off.

If you'd prefer to get the Professional Version of Office (Academic version) then the price is $60 more going through the same process... the Professional version will include MS Access and MS Publisher, but it is only licensed for 1 computer, not 3.

So what are you waiting for?

ouverture-facile game and solution

2007-01-07T07:47:00.000+10:00

ouverture-facile.com provides a logic game for you to solve. Each level of the game could require you to do underthing from mathematics, image manipulation, audio editting, hex editting... in fact anything could be required to solve it.

I've provided full and complete spoilers as a walkthrough of the game. I haven't finished it, but I've included information on the level that I'm up to. I will update this over time & contributions are welcome as comments to my blog.

You may be disappointed if you look at this, but here are the spoilers.

Palm Gully Geocache trip

2007-01-06T20:06:00.000+10:00

Rogainer, Hawmorfords Pirate63, Wingaap and myself today hiked out and did IF's new cache Palm Gully.

It is a great walk in a beautiful spot. The weather was perfect for it.

Watch the video below. A high(er)-res version of it is available from here.

Security in shopping

2007-01-04T10:37:00.000+10:00

I've just been shopping and had two things happen that made me question the security of the whole process.

The first one has bugged me for a while and its about credit card security. It seems a little bit archaic that in this day and age we are required to enter a PIN when using EFTPOS for our savings accounts, but no PIN is required for a credit account. So you'd think it would be easy enough to just forge the signature right? Well, you don't even need to go to the trouble of doing that.

Many checkouts now allow you to swipe your card yourself. You swipe, you sign, and then they check your signature - but how easy would it be for someone to swap the card that they swiped for a different one when checking the signature. i.e. Someone swipes a stolen card then puts down a card of there own for signature verification - the switch could be easily done. I know that they could just check the number on the card, but the operators barely seem to have enough time to check the signature, let alone the card number.

The second thing that concerned me was that as I left the store I had to pass through those little posts that bleep at you if you're carrying stolen goods out. They bleeped at me because I'd bought and paid for my stuff in the electrical section & they hadn't properly de-cleansed it (or whatever they do). The lady came over and said "Oh, didn't they scan your things correctly, let me fix that for you"; she took me over to a desk and spent about 60 seconds swiping my 3 items over some sort of invisible force-field and then proceeded to carry them back through the posts again. "Good", she said, "all fixed". I wondered what the point of this whole charade was when I'd already passed through the only set of posts I had to when leaving the store & they didn't even bother asking to look in the backpack that I was carrying over my shoulder!!!! Pointless!

List of free Microsoft Software

2007-01-03T11:08:00.000+10:00

This is a great list of free Microsoft software... some of it I've never heard of and already can't do without!

Gateway Flash Game

2007-01-01T20:50:00.001+10:00

A cool game called Gateway located here.

(My comments about and walkthrough of Gateway 2 are here)

If you get stuck, here is the solution:

Room 1
Press the button

Room 2
Pick up the stairs
Place the stairs on the indicated spot
Press the button

Room 3
Pick up the remote
Pick up the batteries
Put the batteries in the remote
Use the remote on the sensor

Room 4
Press the first and then the forth button
If you’ve pressed others then you’ll need to tidy them up. Button 1 alters panels 1 and 2; button 2 alters panels 1, 2 and 3; button 3 alters panels 2, 3 and 4; button 4 alters panels 3 and 4

Room 5
You need to create the same pattern on the floor that is printed above the gateway.
Starting from the beginning colour you need to step on the outer twice, the middle 4 times and the inner 6 times to get the right colours.

Room 6
(Optional) Look through the telescope; look at the right window 3 times.
The code is written on the window (backwards) it is 739339.
Use the keypad, enter the code.

Room 7
Push down the left plank.
Walk over the centre, activating the panels, setting them to the same colour.
Walk back through the gateway you entered, you will emerge on the right.
Push down the right plank.
Walk over the right panel a number of times, changing it back to its original, floor, colour.
Exit through the gateway.

Room 8
Pick up all 6 balls.
Place them in this order (from the left): large, medium, huge, tiny, big, small.
Push the button.

Room 9
Get the screwdriver from on top of the tv.
Unscrew the access panel.
Open the access panel.
Get the extension cord.
Get the power cord.
Plug the extension and power cord together.
Watch the TV.
Note the order of the rooms that the person is in… including ‘9’ that they start in.
The code is 954271

Room 10
Note the number of flashes of the lightbulbs… you need to press the floorswitches below the light bulbs this many times.
The numbers, in anticlockwise order from where you enter, are 135264.
Then stand on the elevator

Under the Cloak of Darkness - West Ashgrove

2006-12-26T10:35:00.000+10:00

I went out at around 10pm last night to attempt a new geocache called Under the Cloak of Darkness - West Ashgrove. I really wonder why people bother placing caches like this... its located in a garden bed beside a take away store/corner store/etc. The garden bed is waist-height and is about 30cm wide by maybe about 6m long. You can't access most of the garden because of bush that is growing in it... in the areas you can push the bush aside you can see that it is full of condom wrappers, bottles, other discarded rubbish, cockroaches and ants. I didn't manage to find the cache but even if I did I suspect I wouldn't be any more impressed with the hide... I mean... why was I bought here? Isn't there a million other places around that would be nicer to place a cache than in this garden bed?

Christmas day

2006-12-26T10:30:00.000+10:00

Christmas day was a big event with the whole family gathering together at our house. We had a big lunch and snacks all day with tonnes of leftovers - just how Christmas should be :-)

None Riding on This etc

2006-12-23T22:23:00.000+10:00

We had a fun day out geocaching today. Caroline decided to brave the shops to finish off the Christmas shopping so the rest of us took a trip up Caboolture way to do a few caches. We started off with None Riding on This which was a decent walk - about 600m as the crow flies which probably turned into 800m-900m each way the way we tackled it. It was the perfect day for this sort of walk & while the kids complained a bit at times they really did enjoy it - oddly enough they used to do much longer walks than this for caches in the past without complaining, maybe its summer or maybe they're just used to all the urban micros :-)

After successfully finding that one we headed up to Jacrel's Bridge which looked like it had some DNFs, although I suspect now that most of them were from when the co-ordinates were wrong. The kids didn't help search at all at this cache, but its probably for the best as there were a tonne of spiders and wasps around under the bridge.

Then we headed on up to Good Old Days which was just a drive by - you couldn't miss this one, but its in a nice spot. I hope some people visit the historical village because of it. We then continued on to Ducks on the Mor's and there certainly were plenty of ducks there too! This proved to be an easy find and gave the kids a playground to play on which they deserved.

By the time we'd done all of that we were ready for lunch and Caroline was finished at the shops so we came back into town.

It's always tempting when a new cache comes out to go and grab it and On the edge of the Enchanted forest..... came out this afternoon and looked like the sort of cache that may be difficult to find in the daytime so I raced out and grabbed it just on dusk.

Speaking of temptations, Phone a Friend just got published - I really want to grab it tonight but think I'll do the right thing and go to bed instead.

MS Showtime Security Presentations

2006-12-22T14:14:00.000+10:00

I've been watching some MS Showtime Security Presentations from TechED IT Forum, they are these below. I'm only part way through at the moment, but so far they are good.

Knowing the Enemy - A lightning demonstration on how hackers attack networks
Marcus Murray, Senior Security Architect, Truesec

Advanced Malware Cleaning
Mark Russinovich, Technical Fellow, Platform and Services Division, Microsoft

Windows Vista User Account Control Internals
Mark Russinovich, Technical Fellow, Platform and Services Division, Microsoft

Defending Layer 8: How to recognize and combat social engineering
Steve Riley, Senior Program Manager, Security Business and Technology, Microsoft Corporation

Windows Vista Kernel Changes
Mark Russinovich, Technical Fellow, Platform and Services Division, Microsoft

Windows Vista Firewall and IPSec Enhancements
Steve Riley, Senior Program Manager, Security Business and Technology Unit, Microsoft Corporation

Crazy security

2006-12-21T15:03:00.000+10:00

You've got to love some peoples idea of security. In my building security is a fairly serious matter and they've always had a policy of not being able to drop off parcels at the front security desk... of course you can't leave something there for someone to pick up either - while this may be done so as not to burden the security staff with parcels the main reason behind it (I suspect) is that they don't want you dropping off bombs or other harmful packages that would disable the guards.

But hey... its Christmas - so don't worry about dropping off your bomb with the guard... just bring it in the door wrapped in Christmas paper and leave it beside the tree (that is right next to the guards desk) where they are collecting children's gifts for charity!