Site News

Post temporarily pulled

Beau Monday — Fri, 16 Dec 2005 13:35:00 GMT

A humorous post I made here a year and a half ago about a trip to Minnesota has caused me some heartburn at work, because the client I anonymously referred to in said post figured out I was talking about them. I've pulled the piece until the issue gets resolved.

I'll post more about this later.

Surreal

Beau Monday — Thu, 13 Oct 2005 10:14:00 GMT

My friend Mixa forwarded me via email yesterday's Security Update newsletter from Windows IT Pro Magazine, and said only “Search for Beau Monday.”

Doing that revealed this paragraph embedded in an article by Mark Joseph Edwards about using SSH to securely copy files from one system to another:

If you run Win2K Server, you can use Beau Monday's step-by-step guide, "Configuring OpenSSH (Win32) for Public Key Authentication." His guide is equally detailed and includes information about how to configure PuTTY, which is an open-source SSH command-line client for Windows platforms. The PuTTY package also includes a PuTTY Secure Copy (PSCP) client. If you use Monday's guide, take note that his link to OpenSSH for Windows is broken. The project has relocated to SourceForge, and you can find it by using the second URL below.

And then I went over to WindowsITPro.com, and saw the same article posted online as of yesterday.

The year-and-a-half old piece is the second most popular (by referrals) of my security articles on the blog (the most popular is the first MRTG how-to which was picked up by a couple online magazines). But it's still surreal to see anything I've written show up as a recommended guide for how to do a particular thing.

Which reminds me: I haven't written any security articles for a while. Now that the weather has turned crappy, I think I'll get back on that horse.

Trackback Spam

Beau Monday — Mon, 27 Jun 2005 11:01:00 GMT

If you remember a few months back, I implemented CAPTCHA-style comment system to battle the growing comment spam problem. That was a huge success, I have to say. I've only had a couple spams since, by people who actually entered in the code. Spammers rely on massive numbers of messages, so most see the effort required to enter the code and move on to softer targets. And what is security, really, besides encouraging the malcontent to move on to a softer target :).

But now spammers have turned to a new method of spamming blogs, by using trackbacks. Trackbacks, for those unfamiliar with the term, are essentially bookmarks left on individual posts when another blog references them. They are also sometimes referred to as Pingbacks. For example, when The Guardian linked to my China/Microsoft post recently, the Guardian's blog automatically left a trackback on the blog entry notifying me and others that the post had been referenced elsewhere. Trackbacks are usually listed in the comments section, along with regular comments, which is why they work for spammers almost as well as comment spam does.

Unfortunately, because of the automated nature of trackbacks, it's not possible to implement a CAPTCHA-style filter. There simply is not human intervention for the trackback facility.

But there is hope, however, especially for those using .Text for their blogging back-end, as I am here. Irish blogger Brian Dela has made public a method of filtering out trackback spam using regular expressions to filter out trackbacks containing commonly-used words. I implemented it over the weekend and my trackback comments went from 30-50 a day down to zero. I'm sure I have some additional tweaking to do, but so far so good.

Sayonara, May

Beau Monday — Thu, 02 Jun 2005 19:45:00 GMT

As I mentioned halfway through the month, May has been a disaster for us at work. We normally go months without an incident that impacts multiple customers, but May brought us 8, yes EIGHT, such incidents.

They weren't all network issues (2 of them were, thanks F5!), so I wasn't on the hook to solve them all. But still, as the lead security/network specialist, I was often brought in to make sure whatever problem we were having wasn't network- or security-related. I'm one of the few guys that seems to be always on call, due to my specialized role.

The whole team is tired, stressed, frustrated, and probably a good bit embarrassed by the month we've had. Our Director spent so much time on the phone trying to calm frustrated customers that he's got 500 emails in his inbox. This is a man who feels overwhelmed when he has 100 emails in his inbox.

The one good thing that came out of this past month is that it really shined a spotlight on some things we could be doing better. We have a lot of diagnostic information laying about, but none of it is easily correlated. I'm diving in feet first to provide some scripts to the data center team that will allow them to pull relevant logs and performance metrics more quickly than they have been up until now. I'll be making a well overdue update to FirstOnScene, extending it further. I've also recently purchased the new Syngress book on Log Parser, and I expect to couple that with some scripts to pull IIS log data from our various web farms, among other things.

Expect a few related articles in June as I work on these new incident response tools and make them available to the rest of you folks.

Heading to Vancouver

Beau Monday — Sat, 12 Mar 2005 23:44:00 GMT

I'll be getting up at o'dark-thirty tomorrow to make the drive up to Canada. The Directory Experts Conference officially starts on Monday, but I decided to sit in on the special one-day active directory security training they are conducting on Sunday. It starts at 8:00, so I need to be on the road by 5:00 or so to make it to Vancouver without having to stress about the schedule.

The good news is that I am taking this entire week off from work (conferences are only partially work, but don't tell my boss), and I expect I'll have some time for blogging. I might spend a couple extra days in Vancouver soaking in the culture. I've lived in Seattle for 12 or so years, but never really spent any quality time in Vancouver, Portland, or any of the other cities that are day trips away.

Books going with me: The Art of Intrusion (Mitnick's new book), Google Hacking for Penetration Testers, and Computer Forensics Jump Start.

And if you're surprised that my idea of a vacation is sitting in a coffee shop on Hastings reading computer security books.... well, you just don't know me at all :)

If anyone wants to get together while I'm in Vancouver, hit me on the gmail.

Squelching the comment spam

Beau Monday — Tue, 18 Jan 2005 01:01:00 GMT

Comment spam pisses me off. It's akin to slapping a bumper sticker on someone else's car. Money for the bandwidth this site uses and everything that goes along with maintaining bmonday(dot)com comes out of my own pocket, and I don't appreciate spammers hitching a ride on the Free Advertising Express.

I've been getting a few comment spams a day, and it's steadily increasing. I've been trying to keep on top of it, but it's annoying to babysit the comments section when I am at work or have other things to do. So I finally did something about it.

Miguel Jiminez has worked up a pre-compiled control for .Text blogs that foils all currently known automated comment spam mechanisms. It uses HIP (Human Interaction Proof) techniques to validate that a human is making the comment, not a spammer's script. It works for all kinds of .NET blog engines, but was designed around .Text.

If you want to leave a comment on a subject, you will now have to type in the 6-digit code that appears in the window above the Submit button.

Sending Care packages to American Forces in Harm's Way

Beau Monday — Fri, 07 Jan 2005 01:09:00 GMT

I've closed the comments on a couple old posts regarding sending gifts to American forces in harm's way. The comments have degenerated into little more than a dating service, and the useful information was being buried in the noise.

These two posts received a ton of traffic over the past 12 months, including over 35,000 referrals from other web sites. This was primarily due to the fact that one of them became the top result for people searching Google for “sending gifts to soldiers in Iraq“. Google loves blogs, what can I say.

If you want to send gifts to soldiers in Iraq, Afghanistan, or anywhere else overseas, please go to www.anysoldier.com where you can find out how to contact nearly 43,000 soldiers who are not receiving regular care packages from home.

Writers' Block

Beau Monday — Mon, 03 Jan 2005 23:52:00 GMT

I haven't felt like blogging, as I've mentioned previously. I've been trying to understand why.

And I think I've hit upon the root cause.

It's actually illustrated quite nicely in the following image, which graphs the usage of bmonday.com:

1.7 *million* hits for the year. Over 200,000 in November alone, where I wrote, if you recall, a whopping 5 posts.

Do you know how many times I've embarrassed myself on this blog? How many posts I fight the urge to go back and delete because they were born of too much beer and too little reason?

75% of these posts would have never seen the light of day had I known this blog would be as popular as it has become.

And therein, my friends, is the reason I cannot bring myself to blog these days. Nothing I feel like blogging lately gets past my mental filtering process. At the end of the day, the list of things that I find interesting gets whittled down to nothing as I go through each topic and realize that I have very little relevant information to add to any of them. Nothing seems *worthy* of posting to my stupidly-large readership.

Honestly, if you read the sites on my blogroll, you'll probably be reading the same things that historically inspire my posts here. Probably 1% of the content on this blog is original, the rest is regurgitation of something someone much more clever recently said.

But you know what? I wrote a long time ago that I blog mostly to exercise my writing muscles. And I can feel those muscles atrophying over the past couple months as my posting frequency here has dwindled. It has become harder to get motivated to tackle some of the writing-related projects that have piled up on my desk at work over the past couple of months. Even my desire to write scripts took a hit when I realized that FirstOnScene was downloaded several thousand times.

A wise man once said “You have to blog like nobody's reading.” And that's what I'm gonna do from here on out. Expect a sudden surge of posts about music, Seattle, beer, and copious amounts of swearing (which is downright obligatory when one speaks of beer, and other topics of such high importance). And I may even find some time to throw some security tidbits into the mix, just to keep you guessing.

I may spell check. I may not. That's just how crazy I'm prepared to be, ladies and gentlemen.

So let me start it all off by saying:

Happy fucking New Year!

Sorry for the Downtime

Beau Monday — Tue, 16 Nov 2004 08:26:00 GMT

I've been having an increasing number of problems with the Linksys DSL/Cable router that I have been using, and decided to finally replace it with something else. The Linksys device was randomly disconnecting, and was lately requiring a lot of babysitting to keep up.

I replaced the device with a different model last night, but couldn't get it to save any settings. After sleeping on the problem, I woke up this morning and had it up and running in about 5 minutes.