So this year we finally got around to going to the red dress run.
It was packed, and there's pretty much no way to get 7000+ people
to hash a mixed-up course between bars, so it was straightforward
and kinda leisurely. Would have to have been in the heat, I think.

I am usually not up for drinking that early in the morning other
than on Mardi Gras, mind you. I took this from the balcony at
lafitte's in exile, and there was red all the way down Bourbon
to Canal. Clay borrowed a red sundress I dislike and I
decided to go a little bit 80s.

Comments (0)

I found this somewhat ambitious restoration project a while back. They are even smaller than they look; think smaller than a 1980s civic; honda beat sized. This one is a 1958 as far as I can tell (by this I mean wikipedia) because it has no trunk lid.

This pretty blue and white thing is still a driver; I heard from people in the neigborhood that the original owner's son drives it occasionally since she passed away. I think it's a 1960, but it could be 1959. In doing my car research I found this exact car on the wikipedia article for the metropolitans.

(By the way if you like old cars, this pair showed up on my cars blog, rust chronicles, a while back. I try to post a different shot here when I cross-post a car just to keep it interesting.)

Comments (0)

I got possessed to write a file carver in the middle of the night in the middle of this. I could have used foremost, but, having it drilled into my head that foremost sucked, since the people I learned forensics from wrote scalpel, I thought, well, it can't be that hard to pull a PE file out of a snippet of raw data; it really isn't, that was maybe two hours of leisurely C. (Yes, I know I should be using python like a good modern security person. Have you seen how fast I am at C?)

Anyway. If you want to check out my writeup it is here, and it is really probably better written than anything I turned in for forensics class last semester because I had time to put it together while Clay studied for the professional engineer exam. I decided on the Tuesday before it was due that I was going to finish the puzzle and really make a go at it; so this is only really about eight or ten hours worth of work over a few nights.

I really have no idea what to do with all this free time since I've graduated and the wedding is thankfully overwith. It's not like there isn't work; one of my companies is expanding and the other one wants more hours. Every spare moment in the last few years was eaten up by something; now all I have outside of work is ballet. And malware. But what do I do with it?

Comments (0)

We are coming to you live from egobsd n-point-0. Because I honestly have no idea how many revisions this site has been through in its ten years.

I read this post last year about static blogging and thought it might work very well with movable type. So far it does, as I've
been able to build and update via rsync. I've got shiny new disqus comments set up here, and the old comments on entries are all visible, but not imported. (I dislike it when people import my comments into disqus without permission, so I will not do that to you.)

As a bonus I moved the site back home so when it breaks I can call my dad to walk out to the shed and hit it with a hammer, at least until it moves thirty miles to a proper server room.

Oh yeah, and I actually managed to graduate back in May. Novel concept.

Comments (0)

caramel tarte tatin, originally uploaded by candice quates.

A lovely french tart to distract from the lack of actual content, as I fear I've bored you all to death with viruses.

This was inspired by having read an assortment of recipes and piecing them together, and it's some caramel made in a No. 5 cast iron frying pan, two apples worth of pie filling and half of a tart shell crust on top. Baked for half an hour at 375 and flipped over, and it was awesome.

One day I will do the "how to make pie crust" post with bunches of pictures, but probably not in the summer; because you have to work so quickly in the heat, even when you have an air conditioned kitchen, that there isn't time to take pictures.

Comments (0)

Today Susie is at least 10 years old. I declared her birthday to be June 1st years ago, as it was the best estimate I had for her age when I picked her up from the pound in Rochester in 2001.

The picture here is because she conned the wedding photographers into taking pictures of her while we got ready to go take portraits in the evening.

Clay is going to try to feed her steak tonight or something probably.

Comments (3)

And how this applies to entropy is that we got told "Go do something neat for 40% of your grade, either write a paper or write some code." So I decided to write up a little piece of code to calculate shannon entropy, figuring I could use it later to distinguish packed from unpacked where it refers to binaries.

Code: shannon.c under a don't steal this for your homework license.

I hesitate to put a link to the web frontend up, because it was hastily written, but I got extra credit for it, which was cool. I had to make a powerpoint presentation full of background and results as well.

Values go from 0 to 8 in theory, but I've not seen more than 5.5. UPX packed malware looks almost as high entropy as encrypting a text file with AES. Hand-rolled packing is a little bit lower entropy. First two samples come from Forensics Puzzle Contest #5, the rest are from email.

UPX packed:
skirt% ../shannon file.exe\[1\].octet-stream
filename: file.exe[1].octet-stream
bytes in file: 68097.000000
entropy: 5.3945613760

Same file, unpacked, second layer less obfuscated:
skirt% ../shannon file.exe.octet-stream
filename: file.exe.octet-stream
bytes in file: 82433.000000
entropy: 5.0533276137

Random file AES encrypted:
filename: test2.bin
bytes in file: 4100801.000000
entropy: 5.5451381195

Partly encrypted of what is likely a bredolab trojan:
filename: officexp-KB910721-FullFile-ENU.exe
bytes in file: 23553.000000
entropy: 3.3439501448

Another variant of the same family is much higher:
filename: DHL_invoice _2345.exe
bytes in file: 74241.000000
entropy: 4.1100030304

Plain text is predictably around 3.0, which the stuff I remember from information theory backs up. Things that are lower than plain text in the 1.0 range are IDApro save file databases and blank goat files, and the binary for the old virus Murkry.390 (it was homework in reverse engineering class last year.) Some of the malware I collect out of email attachments actually doesn't appear to be completely encrypted which is odd, but I haven't broken this down to work on sections, which is really the next step here.

Comments (0)

breakfast crepes., originally uploaded by candice quates.

Back to food for a few. A few weeks ago I got a hankering for my mom's strawberry crepes. She used to make them on rare occasions on weekend mornings.

She hasn't made them in forever, so I called her up to ask how she made the filling (easy, cook down strawberries with sugar) and looked up julia child's dessert crepe recipe to make them. I like 5-6" super-thin see-through crepes, and that recipe seems to work very well. Here's a picture of the crepe-making setup, too.

Nice thing about these is they keep in the fridge for a day or two, so you don't have to eat them all at once, you can use the leftovers for breakfast, like here.

Comments (0)

Check out the presentation here.

Handout is reproduced and slightly edited below, it's just a description and a list of tools, but since I bothered to clean up the html to make it presentable, I might as well add it.

Automated Malware Analysis tools and papers.
CSCI 4621 Presentation 11/24/2009

So, basically, to set this up, I had a Linux machine (ubuntu on netbook), installed VirtualBox, installed an XP image into it, then set up the minibis client and server programs. Made a minibis ftp account and turned on an ftp daemon. Went into Virtualbox, put the client program on it, started it, took a snapshot. Started server minibis program with some binaries, and went to go get some more coffee. Looked at procmon logs when it was done.

To add the network, I used a host-only network, so that it shows up as a linux device, and can be very easily sniffed. I also set up a second IP on the host-only network to run INetSim on. INetSim was easy to set up, so I just set the DNS server to always point to the host. InetSim creates nice, detailed logs. Packet sniffers weren't as useful as I initially thought - I expected more programs to call home. Static analysis comes later.

Tools for the virus-runner I built:
CERT.at: Mass Malware Analysis: A Do-It-Yourself Kit http://cert.at/downloads/papers/mass_malware_analysis_en.html
Sun's VirtualBox http://www.virtualbox.org/
Sysinternals Toolkit - for procmon and many other useful things http://www.sysinternals.com/
INetSim: Internet Services Simulation Suite. http://www.inetsim.org/about.html

Other reference material about virus runners:
Building an Automated Behavioral Malware Analysis Environment using Open Source Software http://www.giac.org/certified_professionals/practicals/grem/48.php
Truman - The Reusable Unknown Malware Analysis Net http://www.secureworks.com/research/tools/truman.html

Web based analysis services:
Anubis - service for analyzing malware http://anubis.iseclab.org/
Norman Sandbox http://www.norman.com/security_center/security_tools/en
VirusTotal - runs samples against a pile of antivirus tools http://www.virustotal.com/

General reference:
MSDN -for all you ever need to know about the windows API. http://www.msdn.com
Internet Storm Center http://isc.sans.org/
Offensive Computing is a nice sample source as well as being useful. http://www.offensivecomputing.net/

More tools:
HT Editor - small terminal-based disassembler, for unix, can handle PE files, I use it to check out binaries if they happen to be unpacked. http://hte.sourceforge.net/
Memoryze - memory dump analyzer. really nifty.http://www.mandiant.com/software/memoryze.htm

Comments (0)

I got the rest of the images on disk back from the photographer today. I hope to have a small gallery up with some of them soon so that people can dig through it.

Comments (0)

So, for the wedding I was lucky enough to have all four
of my grandparents there. But, Monday we lost my Grandpa,
the one seated here. It's been a long week, but
it's starting to get better.

administrative note: there is a chance this site is going
to go down soon and I will have to bring it back up on a new
server.

Comments (3)

This one at home, I found just before Mardi Gras, just a few blocks
from our house, next to Lafayette No. 1. It is a 1974 Toyota FJ40
Land Cruiser.

This one I found in florida on honeymoon a few weeks ago. I did not
know they made FJ40 pickups. I have a whole post about it over on
the other site. It is from 1977.

Which leads me to a question. How much of the other site should I syndicate here? I'm not sure if I will annoy people with duplicates,
but I've found some really cool cars lately and I think adding the
occasional car roundup might be a nice change from all the food.

Comments (2)

Patches at the wedding, originally uploaded by Noladishu.

It's done!

Comments (2)

roses, originally uploaded by candice quates.

We get married this Saturday. Even with all this I'm not sure it's set in yet. This is one of the pictures from the invitations. We tried to work cars into the wedding in a fun way. (Driving off in the truck, as long as she decides to run for us!)

See you all on the flip side.

Comments (3)

Broccoli Cheese Rice, originally uploaded by Noladishu.

This is broccoli cheese rice in my new favorite dish. It's a roughly 8x5 cast iron enameled le creuset gratin dish. (No. 24) They don't sell these to us in america anymore, so Clay found this vintage one on Ebay and got it for me as a birthday present.



The broccoli cheese rice is an attempt to re-create the rich, bechamel-sauce-y version of this at Cochon; my cajun grandma's broccoli cheese rice is of course, better, but attempting to replicate it exactly is always going to fail. Cochon's was excellent.

How to make it?

Broccoli cut into small florets, enough to cover the bottom of a baking dish. Roughly the same amount of leftover rice; about a cup in this case. Make 1 cup of your favorite bechamel sauce (I use Julia Child's method), melt some cheese in it, and mix it all together in the dish. Put more cheese on top and bake it. We were using Gruyere which is really overkill, but tasty. Brown under broiler.

The best part about this little gratin dish? Unlike the other five casserole dishes in my cabinet, this one is broiler safe, so you can get gorgeous. tasty brown crusts on everything.

Comments (0)