R.I.P. Pimp C

Chad Butler (December 29, 1973 – December 4, 2007)

How RSA tokens work

First post in a series (hopefully) related to general computer security.

When I first started my current many years ago I was issued of these keyfob thingies which displayed a 6 digit number that changed every minute. I just blindly accepted that it did some complex random number generation that allowed me to log in to systems securely.

Here's how it works (paraphrased from this).

The token is a completely standalone unit. It does not have any sort of connection to any other electronic device.

Each token contains a clock chip and a unique seed number, which I assume is displayed on the back of the token.

Every minute, the combination of the current time and the unique seed number as input of the algorithm and produces the six digit number you see on the token (I have no information on the algorithm itself).

The server performing the authentication (known as an ACE Server) knows your unique seed number, the algorithm being used, and the time. With this information, it performs the same function on the server. It receives your code and compares it to the code it computes. If the codes match you are authenticated.

Edit:
I found a more detailed breakdown after the original post is here:

All versions of the SecurID use RSA's patented
technology to synchronize the use of Current Time in a SecurID token and
its remote authentication server, what RSA calls the
ACE/Server. (Typically, as you know, the link between the token-holder and
the ACE/Server is through an intermediary -- an ACE/Agent or RADIUS agent
-- which intercepts an authentication call and relays it to the ACE/Server
for processing.)

The classic SecurID, for 15 years, used a proprietary algorithm to
hash a token-specific 64-bit seed and Current Time. The new SecurID --
introduced at the beginning of 2003 -- uses the AES block cipher, in
standard ECB mode, to hash:

- a 128-bit token-specific true-random seed,
- a 64-bit standard ISO representation of Current Time
(yr/mo/day/hour/min/second),
- a 32-bit token-specific salt (the serial number of the token), and
- another 32 bits of padding, which can be adapted for new functions or
additional defensive layers in the future.

Conflated and hashed by the AES, these inputs generate the series
of 6-8 digit (or alphanumeric) token-codes that are continuous displayed on
the SecurID's LCD, rolling over every 60 seconds. (The standard mode of
use, as you know, requires two-factor authentication: the token-holder is
required to provide both a SecurID token-code and a user-memorized PIN to
the remote ACE/Server.)

ECB mode in AES is executed on 128-bit blocks, of course, so it is
obvious that RSA had to pad the standard 64-bit expression of Current Time
with another 64 bits. Using a token-specific salt blocks any attempt to
pre-calculate a library of possible token-codes for all 128-bit seeds. That
means that any brute-force attack on the AES SecurIDs would have be focused
on a particular token.

Gold Digger Pwned

I know everyone has probably linked to this craislist listing and there's a good reason for it... It rules.

What am I doing wrong?

Okay, I'm tired of beating around the bush. I'm a beautiful (spectacularly beautiful) 25 year old girl. I'm articulate and classy. I'm not from New York. I'm looking to get married to a guy who makes at least half a million a year. I know how that sounds, but keep in mind that a million a year is middle class in New York City, so I don't think I'm overreaching at all.

Are there any guys who make 500K or more on this board? Any wives? Could you send me some tips? I dated a business man who makes average around 200 - 250. But that's where I seem to hit a roadblock. 250,000 won't get me to central park west. I know a woman in my yoga class who was married to an investment banker and lives in Tribeca, and she's not as pretty as I am, nor is she a great genius. So what is she doing right? How do I get to her level?

Here are my questions specifically:
- Where do you single rich men hang out? Give me specifics- bars, restaurants, gyms
-What are you looking for in a mate? Be honest guys, you won't hurt my feelings
-Is there an age range I should be targeting (I'm 25)?
- Why are some of the women living lavish lifestyles on the upper east side so plain? I've seen really 'plain jane' boring types who have nothing to offer married to incredibly wealthy guys. I've seen drop dead gorgeous girls in singles bars in the east village. What's the story
there?
- Jobs I should look out for? Everyone knows - lawyer, investment banker, doctor. How much do those guys really make? And where do they hang out? Where do the hedge fund guys hang out?
- How you decide marriage vs. just a girlfriend? I am looking for MARRIAGE ONLY
Please hold your insults - I'm putting myself out there in an honest way. Most beautiful women are superficial; at least I'm being up front about it. I wouldn't be searching for these kind of guys if I wasn't able to match them - in looks, culture, sophistication, and keeping a
nice home and hearth.

it's NOT ok to contact this poster with services or other commercial interests
PostingID: 432279810

THE ANSWER
Dear Pers-431649184:

I read your posting with great interest and have thought meaningfully about your dilemma. I offer the following analysis of your predicament.

Firstly, I'm not wasting your time, I qualify as a guy who fits your bill; that is I make more than $500K per year. That said here's how I see it.

Your offer, from the prospective of a guy like me, is plain and simple a crappy business deal. Here's why. Cutting through all the B.S., what you suggest is a simple trade: you bring your looks to the party and I bring my money. Fine, simple. But here's the rub, your looks will fade and my money will likely continue into perpetuity...in fact, it is very likely that my income increases but it is an absolute certainty that you won't be getting any more beautiful!

So, in economic terms you are a depreciating asset and I am an earning asset. Not only are you a depreciating asset, your depreciation accelerates! Let me explain, you're 25 now and will likely stay pretty hot for the next 5 years, but less so each year. Then the fade begins in earnest. By 35 stick a fork in you!

So in Wall Street terms, we would call you a trading position, not a buy and hold...hence the rub...marriage. It doesn't make good business sense to "buy you" (which is what you're asking) so I'd rather lease. In case you think I'm being cruel, I would say the following. If my money were to go away, so would you, so when your beauty fades I need an out. It's as simple as that. So a deal that makes sense is dating, not marriage.

Separately, I was taught early in my career about efficient markets. So, I wonder why a girl as "articulate, classy and spectacularly beautiful" as you has been unable to find your sugar daddy. I find it hard to believe that if you are as gorgeous as you say you are that the $500K hasn't found you, if not only for a tryout. By the way, you could always find a way to make your own money and then we wouldn't need to have this difficult conversation.

With all that said, I must say you're going about it the right way. Classic "pump and dump."

I hope this is helpful, and if you want to enter into some sort of lease, let me know.

NFS - Topic #1

Topic #1

1) On the server, the port mapper starts (usually by the server upon boot).
2) On the server, the mountd (sometimes known as rpc.mountd) starts and open one ephemeral TCP port and one UDP port. It registers these newly opened ports to the port mapper.
3) On the client, the mount command issues an RPC call to the port mapper on the server to obtain the port number for the mountd daemon.
4) The server replies back with the port number.
5) On the client, the mount command issues an RPC call to the mount daemon to mount a filesystem on the server. This is where validation happens.
6) On the server, the mount daemon replies with the file handle for the given filesystem.
7) On the client, the mount command issues the mount system call to associate the file handle to the mount point on the client.

- The NFS server privides 15 procedures in the form of procedure calls.

- TCP or UDP capability

One Skill A Day

I'm going to try something new to beef up my arsenal of skills before I start looking for a new job. Each day I'm going to learn one new tech skill. The topics will not follow any particular pattern or will not stick to one technical area. Rather, I'll probably jump around between disparate topics. That'll prevent me from getting bored.

In this blog I will type out a brief synopsis of what I learned in addition to key concepts. Some topics will obviously take more than one day to even learn the basics.

If I miss a day I'll will learn two things the next day.

Here are a few topics I want to brush up on:

1) NFS
2) XEN
3) VxFS
4) Performance Tuning
5) IP Subnetting
6) DB queries
7) Basic Oracle Admin
8) netstat usage

the brand, the image, the logo

Go Bag Revisited

I've been obsessively adding and removing stuff. Here's what I still need:

1) A new bag (looking at Ogio, The Northface, Supreme)
2) Ibuprofen
3) Multifunctional space pen
4) Bandaids (2) and small tube of antibiotic ointment
5) Ziploc containing spare change
6) Vitamins
7) Caffeine Mints
8) Pictures
9) Laptop Lock
10) Keycatcher
11)

Remember This (Re: Kids)

Do you ever notice when you're genuinely happy and you smile at your son he almost always smiles back with the same genuine fervor?

Do you notice when your attitude is very positive your daughter always responds back with the same positivity despite being in the midst of a tantrum?

It never fails.

It's like these kids (pre-3 yr old as far as I know) possess an innate bullshit detector that we all lose as we get older. Actually we don't lose it but it transforms into different type of BS detector --one that detects layers and layers of bullshit, I guess.

What does that tell you?

If you desire a specific positive behavior from a child (good temperment, good grades, etc) you must be true to them. And that means you can't pretend you've been doing positive things when you've really been out there with your homies snorting coke or screwing whores. A consistency between what you've actually been doing and what you want to present yourself as been doing needs to exist and needs to be legit.

Kids can see through your charlatan ass.

Keep it real, always.

Lead by example.

Job Opening at Ning

Lately, I've been hyping up Marc Andreessen's new company, Ning, to many of my tech savvy friends. My argument is that everyone of his creations have changed the world (the first web browser) or at least changed (or will change) the IT world (Opsware).

They all think I'm talking out of my ass. So here it is for the record:

Ning (or whatever it evolves into) is my prediction for the next big thing.

And here is an open req they have open that fits my skillset (although I haven't done Sysadmin work in years).

Here it is in its entirety in case they take it down one day:

Unix/Linux System Administrator Profile

* You love the operations of online services and Internet start-ups. You love the thrill of a 24/7 infrastructure that’s always changing.

* You have experience with online services run at scale or would like to.

* You don't mind being on-call. It sort of reminds you of college.

* You've stayed at a few companies for enough time to see an infrastructure evolve over time. You've also had alot of different projects within that environment.

* You are an expert in Solaris and Linux systems. You have experience with DTrace, Zones and Xen.

* You’ve spent a lot of time with storage management, such as SAN and NFS. If you’ve spent time with iSCSI that’s also a plus. ZFS experience? Another big plus.

* You know your way around database and network administration. You consider your time with Oracle, Cisco and Force10 time well spent.

* You love a solid night of system performance tuning, troubleshooting and problem solving.

* You started in operations because you were curious about how you manage a data center with thousands of servers. You’re constantly looking for the most efficient ways to do so. Some might call it lazy. We call it smart.

* Google isn’t your main source of information. You love spending a lot of time online and staying up-to-date on new things in infrastructure via a variety of favorite blogs.

* You are equally comfortable building everything yourself as you are with buying shrink wrapped software. You aren’t religious about either path, but instead look for the right tool for the job.

* You are independent, but not so independent that you don't enjoy working on a great team.

* You graduated from a university, ideally with a technical degree. If you didn’t graduate from a university with a technical degree, your hands on experience will blow our minds and we’ll forget about school.

* You choose simplicity, iteration and continuous improvement over ivory tower, complex architecture projects.

* Before you send in your resume, you create a social network on Ning. In doing so, you want to know how the heck we’re going to scale to millions of social networks. And the thought of which is already getting you pretty jazzed.

Go Bag

Probably influenced by this Lifehacker article, I've been thinking about building the Ultimate Go Bag. It would comfort me knowing I could jump out of bed grab this said bag and diffuse a bomb then pwn some NSA servers at any given time. Here's what I would need. This list will be updated frequently.

1) Quad-function space pen
2) Victorinox Cybertool 41
3) Toothbrush
4) Toothpaste
5) Moleskine
6) Notebook computer
7) USB thumb drive
8) Flask
9) Cliff Bar
10) Ibuprofen
11) Carabiner
12) Keys
13) Wallet
14) Mobile Phone
15) Blackberry
16) Knife
17) tiny first aid kit (antibiotic ointment, bandaid)
18) Kleenex
19) Gum
20) Laptop lock
21) Claritin
22) Ipod
23) earphones
24) maglite mini flashlite
25) cough drops
26) mints
27) hipster PDA
28) lip balm
29) camera with usb cable
30) business cards
31) pictures
32) sharpie markers
33) highlighter
34) vitamins
35) pencil with eraser
36) dental floss
37) spare change in a altoids can
38) All purpose boot CD *
39) Extra phone and blackberry batteries
40) bluetooth headset
41) ethernet cable *
42) sunglasses
43) stamps
44) universal charger
45) extra contacts
46) Verizon PC5740 Wireless adapter card
47) Tiny post-it notes
48) Notebook AC adapter
49) Caffeine mints
50) Lighter
51) Cigs
52) Ogio or Northface bag (light one with more pockets)


Ninja Jump Kit

1) Blank CDs/DVDs
2) OTS cable
3) Tiny Network Hub
4) Crossover ethernet adapter
5) Keycatcher
6) Western Digital passport USB hard drive (2)
7) Ethernet Loopback Adapter
8) Ethernet LinkCheck
9) Flexible Shaft Ratcheting Screwdriver
10) Workstation Repair Kit
11) Analog notebook
12) digital voice recorder
13) soldering iron
14) USB Floppy Drive
15) Torx Screwdrivers
16) Universal wire stripper/crimping tool
17) IDE/SATA to USB Converter
18) Yaesu handheld