Captain’s Log: June 2021

Here is how I did in the new condensed table format.

11k steps a dayI hurt my ankle in March. I am out of this game for the foreseeable.
150 active minutes per weekI am not getting “active” minutes (on the FitBit scale) on the exercise bike to the same degree I was from jogging. But I am doing 20 minutes at least 3 times a week. I am going out for walks with the kids and gardening at the weekends. None of this is seemingly counting on the FitBit scale.
I am working on getting back to activity it feels closer.
1 technical blog a monthSuccess. I documented the basics of attacking an internal network using Responder, Hashcat, Metasploit, Bloodhound and CrackMapExec. Giddy thrill of apparently this being shared by threat actors enough to wind up in threat intelligence feeds. Which is bemusing for entry level tooling and techniques that have been around for years.
Support my partner to exerciseThey stopped asking for this and I now am just taking the kids on wild adventures in and around the house for Saturday mornings. Counting down the days until I get vaccinated and feel willing to goto visitor attractions again like the world class museums in Glasgow.
Record five songsI have recorded heaps of short ideas. Mostly on the guitar sat out in the sunshine. Some of them I can see me converting into 2-3 minute items.
OSWEI’ll be honest I think this is a Winter time activity.
Panic AttacksI have avoided them again this month.

Other bits

  • Research – I was not able to talk about this last month but the Fedena research finally came out. My team and I found seven vulnerabilities in this school management software. It took over a year from discovery to posting. This was picked up by the daily swig, which was nice! Getting clear of this has given me a boost to go find some more bugs. The technical details for the authentication bypass CVE-2021-27980 are out for reading. Or just the short video of the PoC:

  • Euro 2020 – I cannot adequately put into words how excited I was for this. I barely watch football these days but I just love these tournaments. The fact that Scotland were at the party just made it all the more exciting. The build up to the first game was fantastic and I was singing through the entire game. It doesn’t matter that Scotland exited early. We actually played pretty well. I would say that was pretty much the tale for our tournament in the end. We played well. We created chances. But we couldn’t take them and that was the end of that.
  • Audiobooks 1 – technically still on Stealing Light: Shoal, Book 1 by Gary Gibson. A good bit of Sci-Fi. But without much exercise or walking occurring these days my time has been limited.
  • Television 1 – Star Trek Voyager. I have completed this and it honestly stands up quite well. Last time I watched it there were far more episodes I wanted to skip. This time I was ok with most of it. Some excellent Star Trek in here.
  • Television 2 – Brooklyn 99. After voyager I fell back into season 7 of this. What a lovingly made show this is. Captain Raymond Holt going badass over his fluffy boy being kidnapped is a total highlight.
  • House – We booked someone to come replace the bathroom sink and they have not done so yet. We have sort of been stuck waiting on that as we are trying to do things in a set order.
  • Garden – Has paid out strawberries twice already this summer. I have had horrific hay fever (the worst I have ever had) but I have still been able to murder the lawn appropriately so hopefully I will learn to get that done more effectively to minimise the impact. I have been out the back in a Darth Vader style breathing mask but that didn’t actually reduce the symptoms after cutting the grass. Answers on a post card (or comment) welcome.

That is the log for June.

Captain’s Log: May 2021

Here is how I did in the new condensed table format.

11k steps a dayI hurt my ankle in March. I am out of this game for the foreseeable.
150 active minutes per weekWeek 1 – No.
Week 2 – No.
Week 3 – No.
Week 4 – No.

I am not getting “active” minutes (on the FitBit scale) on the exercise bike to the same degree I was from jogging. But I am doing 20 minutes at least 3 times a week. I am going out for walks with the kids and gardening at the weekends. None of this is seemingly counting on the FitBit scale.
1 technical blog a monthA cheeky wee post about XSS. Nothing too fancy. But highlighting that the techniques I blogged about a while back still pay out.
Support my partner to exerciseThey stopped asking for this and I now am just taking the kids on wild adventures in and around the house for Saturday mornings. Counting down the days until I get vaccinated and feel willing to goto visitor attractions again like the Transport Museum.
Record five songsI recorded a song for the Euro2020 campaign called Singing and Swinging. I knocked out a cheap video over the bank holiday weekend so that it can be shared on YouTube. The video is under the table.
OSWEI’ll be honest I think this is a Winter time activity.
Panic AttacksI didn’t get to full blown panic attack. But I did medically need sleep one day at the end of May. Kids were just popping up at random times of the night. I also did rather a lot of things in the evenings into the wee hours too many nights on the bounce. It settled down after I finally got some sleep.

Singing and Swinging

Other bits

  • Audiobooks 1 – carrying on with Stealing Light: Shoal, Book 1 by Gary Gibson. A good bit of Sci-Fi. With the school commute removed, and me no longer grinding out 11k steps a day otherwise I have barely touched the audiobooks. I should rethink my life!
  • Television 1 – Star Trek Voyager. I have not rewatched this in ages so it was a natural thing to give another go. I like it and think the performance of the Dr in particular stands out.
  • House – We finally got new windows installed having waited something like 6+ months. We moved at a point when you couldn’t get people to quote let alone fix anything. So this has been a massive boost. A new boiler has also gone in this month. I want to tackle at least painting everything now while we tread water for years waiting on the real work that I have to save up for.
  • Open Source – I got feedback from Daniel Card that my CVE-Offline project was out in the wild helping the Cyber 19 volunteers secure healthcare during covid-19. You never know where open source projects go or how they help. So this has been great to learn.
  • Bank holiday weekend – I really needed this one to be good, and it really was. I BBQed twice. I did some gardening (well I murdered a bunch of stuff and trimmed things). I went for a walk in some trees with the kids. Did the whole “look at me I know things” stuff when Kid B walked through stinging nettles and I used a doc leaf to sort it out. Started a log fire in the garden at night and sat talking to my partner into the wee hours. It was a really relaxed long weekend and I just want more like it. I feel like we have been low on joy for a very long time and we are getting back to it.

That is the log for May.

Captain’s Log: April 2021

Here is how I did in the new condensed table format.

11k steps a dayI hurt my ankle in March. I am out of this game for the foreseeable.
150 active minutes per weekWeek 1 – No. But I now have an exercise bike which I am starting a new journey on.
Week 2 – No.
Week 3 – No. Kids returned to school so I was walking rather than exercise.
Week 4 – No. Back on my bike now that school routine is established again.
1 technical blog a monthI sneaked out a wee post on enumerating RDP settings using PowerShell and release rdp-enum.
Support my partner to exerciseThey stopped asking for this and I now am just taking the kids on wild adventures in and around the house for Saturday mornings. Counting down the days until I get vaccinated and feel willing to goto visitor attractions again like the Transport Museum.
Record five songsI have recorded a mountain of partial songs. I just go sit in the garden and batter something out. Nothing quite fit for release this month.
OSWEI have not prioritised it this month.
Panic AttacksA clear month really. A few dicey moments but not full blown panic.

Other bits

  • Audiobooks 1 – carrying on with Stealing Light: Shoal, Book 1 by Gary Gibson. A good bit of Sci-Fi. With the school commute removed, and me no longer grinding out 11k steps a day otherwise I have barely touched the audiobooks. I should rethink my life!
  • Television 1 – Star Trek Discovery Season 3. Bravo to the makers they have really turned it around. While I didn’t hate STD season 1 and 2 I would say I was not in love with it. We didn’t get enough about the crew and the almost singular focus on one character was not working for me. It is Star Trek. I want some aliens. I want some exploration of humanity through the prism of different cultures. Maybe I like Season 3 because I have given up on that dream to some extent? Season 3 has been a breath of fresh air and we actively WANTED to watch the next episode. It was well done.
  • Television 2 – Titans. Oh wow… A DC property that isn’t just needlessly moody. With characters I know little or nothing about going into it. This show has been keeping me going on my exercise bike adventures. Like when I had a treadmill, I get a lot of TV shows watched while I exercise. I ran every minute of Sons of Anarchy, 24, and various other programmes in the past.
  • Game 1 – maquette. A PS Plus title of the month. It is gorgeous on so many levels. The sound track is sumptuous and the mechanics of the puzzles is so damn cute that your inner 5 year old will make you laugh. You honestly will.
  • Game 2 – Final Fantasy VII (remastered). I never played this before. I will start with that. Another PS Plus title which I would otherwise have not chosen to play. The story seems like it is going places. The kids are watching as I play along because of all the whizzy lights and swords and such. It is not a true open world because of the age of the title. You are very much on rails for the duration but it is going down well with me. Update: I finished this over the early May bank holiday before I got the post out. It was worth the time but suffered from massive cut scenes at times.

That is the log for April.

Captain’s Log: March 2021

Here is how I did in the new condensed table format.

11k steps a dayI hurt my ankle. I do not know how and cannot recall a slip or anything I was just suddenly in lots of pain walking one day. So.. At day 452 since I started going for 10k steps a day my run ended. I needed to rest it up.
150 active minutes per weekWeek 1 – Yes
Week 2 – No – ankle injury and sore throat so I took a week off.
Week 3 – Ditto on the ankle.
Week 4 – Ditto on the ankle.
1 technical blog a monthI managed 2 short but useful posts that I will need to refer to in future.
How to use letsencrypt with python HTTP services.
Solving a pentester’s pesky proxy problem.
Support my partner to exerciseWeek 1 – Yes
Week 2 – No – they actually smashed their goal and didn’t need me on the Saturday.
Week 3 – Yes
Week 4 – Yes
Record five songsSince I was inactive I had more time and I actually have made a song. Well almost. It is not finished. I had a DAW to try and learn and fancied trying some layers because that is all new to me:

Whatever – version 3

The vocals will be re-recorded sometime when the kids aren’t asleep in the next room, the lyrics are already different on paper, and there is a 3rd verse from a different protagonist to be expected. But still.. Been happily listening to it today on a loop.
OSWEI have not prioritised it this month.
Panic AttacksA clear month really. A few dicey moments but not full blown panic.

Other bits

  • Audiobooks 1 – carrying on with Stealing Light: Shoal, Book 1 by Gary Gibson. A good bit of Sci-Fi.
  • Television 1 – Star Trek Discovery (catch up Season 1 and 2). My house loves Star Trek. So we watched this when it came out. We sat down to consider watching season 3 and realised; we cannot remember a damn thing that happened. Like literally nothing. So we decided to re-watch Season 1 and 2 first. It is definitely different to previous ST series. It is not necessarily good or bad that it is different. I feel a bit like I really don’t care about any of the characters at all and that the plot is too heavily reliant on the lead character instead of there being an ensemble to draw on. Rewatching it again was like watching it for the first time for us. It was definitely a chore at times. Then we finally got to Season 3. It was like a breathe of fresh air. Suddenly it was way more exciting and we were happy to watch the next one as soon as possible!
  • Television 2 – Away (netflix) – I like a bit of sci-fi but I also have a soft spot for content imagining our near future with basically the technology we have but an increased will to use it. This series was pretty decent in that category. Some good acting performances. A nice distraction. I wanted the next episode when the season ended. But so far this is likely to be something I entirely forget in a few weeks.

That is the log for March. It is sunny outside and I have some days off. Excellent.

Captain’s Log: February 2021

Here is how I did in the new condensed table format.

11k steps a day5 miles of steps. Every single day.
150 active minutes per weekWeek 1 – Yes
Week 2 – Yes
Week 3 – Yes
Week 4 – Yes
1 technical blog a monthI missed this in January (which seems mad when I had several drafts almost ready to go). So in February I put out two:

Verifying Insecure SSL/TLS protocols are enabled
Pentesting Electron Applications

On track for that. I have a few other ideas for coming months.
Support my partner to exerciseWeek 1 – Yes
Week 2 – Yes
Week 3 – Yes
Week 4 – Yes
Record five songsI have not prioritised it this month.
OSWEI have not prioritised it this month.
Panic AttacksI never actually got to the state of disruptive levels of panic this month. I got pretty close. I had a fairly stressful project to work on at the same time as home schooling while maintaining the daily and weekly exercise tasks. This had me doing some pretty long days which definitely made me stressed. I just knew better when to go and take a lie down. All hail the hour nap.

Other bits

  • Audiobooks 1 – I completed Dune by Frank Herbert. This was a great listen and I thoroughly enjoyed it.
  • Audiobooks 2 – I have started Stealing Light: Shoal, Book 1 by Gary Gibson. This was a recommendation and so far I am not far into it. It is painting an interesting universe for mankind’s future. There is a species that pops up to other sentient species and goes: We can give you a bunch of technology and help you colonise this region of space which is yours. In order to get this you agree to not do X, Y and Z. Which creates a dependence on the Shoal corporation. So far it is some pretty decent Sci-Fi which shows despite the advancement of time we remain just as seedy.
  • Television – I have loved South Park for years. I haven’t been keeping up with it for over a decade. With a bunch of episodes being added to Netflix I have started to catch up. They are masters at talking about issues in an interesting way. You don’t have to agree with everything they say to enjoy it. But it is worth remembering how great this show is (once we get past the initial seasons which were mostly fun but entirely juvenile).
  • Television – A while back I started watching Babylon 5 again when I realised I could get it on Amazon Prime (not free). I watched the show when I was clearly too young to understand it. For some reason I didn’t complete the full watch through even though I was enjoying it. I picked it up again and mid season there was an announcement that the content had been upgraded to HD. This makes it even more watchable. The writing is amazing and the cast do some fantastic things together. It is truly amazing that this was made pre-streaming to be as layered as it is. You had to wait a week for another episode, and they would sometimes not have a thing pay off for years. Now that you can watch this back-to-back I intend to and so should you :D.

That is the log for February.

Captain’s Log: January 2021

A new year has begun.

If we go back to two years to 2019 for a moment. I was diagnosed with a medical condition that is prone to immobilise me periodically for around 2 weeks. There were a few bouts of that. I also had some unrelated chest infections, tonsillitis, and a run of bad health that went through the peak of summer until December 2019. I had been pretty miserable and had seen my weight increase due to the lack of mobility.

By Christmas eve 2019 I had been on medication to control my condition long enough for me to get back to walking around. Sick of the misery I set myself a goal of doing the 10k steps per day that Fitbit offers as good minimum level. Through lockdowns this became an absolute mission but I got it done.

I got through my self-set 2020 challenges, and now I have to ask what next?

I have set some health, lifestyle, and hobby goals for 2021.

Lets get Spectabular!

I am going to introduce you to the table of the six labours, and one thing I need to track monthly:

11k steps a daySlightly more than 2020. I have increased the number because this should take me over 4 million steps for the year which sounds like a thing. Really I am aiming to do 5 miles a day or greater than 1,825 miles in the year.
150 active minutes per weekThis equates to 22 active minutes every single day. I will get there with a mix of jogging, cycling, using a kettle bell, using my stairs to step exercise, and anything else that comes to mind. This is the REAL target for 2021.
1 technical blog a monthThe main focus of should always be technical content. As I will be posting my captain’s log entries once a month it makes sense to at least post something technical every month too.
Support my partner to exerciseI do not live in isolation. It is clear that my goals are only possible because of the love and support they provide. They created swathes of space for me to do so by looking after the kids and putting up with me going out at all hours to mine steps. There should absolutely be quid quo pro on this. They want a Saturday morning every week to be child free for a couple of hours to then do some exercise themselves. Totally onboard with that!
Record five songsI can play guitar. I can sing reasonably badly. But that hasn’t stopped me increasingly putting out content. Usually cover versions thrown together with little skill in a single take. I don’t even practice before hitting record. I do not know the lyrics. I am reading them on screen and playing the chords as they come on some tab or other. Why not try writing some new songs myself and putting a little more effort into it? It is rare for me to get the time to do so meaning that starting with five over a year should be achievable. Looking forward to learning how to use the kit I have collected rather than going “fuck it audacity and the mic that I used for conference calls is sufficient”.
OSWEI have pretty much no certifications to show I am even half way relevant or decent as a penetration tester. There are techniques that I need time to practice which are right there in the course material for OSWE. I am committing here to buying the lab access and using it. It is likely that I will be harvesting some of the technical blog posts based on the learning I do for this. I may or may not go for the certification. But for me I suspect the lab exposure and cost of many many evenings will be beneficial overall. If it looks like I can get a decent run at the exam than I might give it a go.
Panic AttacksThis is not a goal. This is just something I want to note happened or not in a given month. Gathering evidence as to their frequency, triggers, and impact. My logical brain is saying based on 2020 that these happen after a run of poor nights sleep.
Six Labours and One to Track

I will complete this table each month to add a bit more brevity and structure to the rather chaotic approach used last year. Starting from February I should get away with much shorter blogs as a result.

How did I do in January?

Now into the meat.

11k steps a day5 miles of steps. Every single day.
150 active minutes per weekDone.
1 technical blog a monthA couple of drafts in progress but the day job put this on the back burner.
Support my partner to exerciseWeek 1 – Yes
Week 2 – Yes
Week 3 – Yes
Week 4 – Yes
Week 5 – Yes (though contested by my partner I wasn’t fast enough in getting a kid ready to leave the house on time).
Record five songsI have not prioritised it this month.
OSWEI have not prioritised it this month.
Panic AttacksA clear month.

The Good

  • Board Games – I discovered that someone at the school had taught my eldest how to play chess. We had tried for years to play board games but their lack of patience and attitude to losing at anything was too explosive and caused fights. I bought a compendium of old board games and made the time to play just with them regularly. It has been great fun! I can see they have a logical brain when they are not exploding about losing. Seeing them mature is beautiful.
  • Music – Having setup the Piano over the keyboard over the holidays, and procured a poster which shows the chord shapes, I have been able to belt out a few songs in the evenings. Since I have never had a lesson or loads of time to do this before it has been nice. I am happy mucking about like this. My goal clearly isn’t to master the instrument. Simply to have fun and this has been great.
  • Health – I have lost weight. I am just not terribly interested in the number this time. The focus is the exercise goals and maintaining those and the results will continue. Or not. But I will be healthier regardless of my mass. In most things I find data and statistics comforting. Somehow weighing myself is a mixed bag as it can be as demotivating as it is motivating. Trying it differently this time and not going for weekly weigh ins.
  • Audiobook 1 – I listened to Sandworm by Andy Greenberg. I found this very interesting and should be the kind of book you can recommend to non-infosec humans. It is well delivered. The pace is expertly done.
  • Audiobook 2 – From there I moved on to Dune by Frank Herbert. I would like to state for the record that I didn’t listen to Sandworm (which is a reference to Dune itself) and then decide to buy Dune to listen to. That would be far too logical! I had actually been meaning to read Dune for many years. I had bought it on Audible before I was recommended Sandworm. I let the recommendation jump the queue and was laughing when Sandworm was revealed as a reference to Dune. The audible production of Dune is excellent and is the first I have heard with additional music. It isn’t quite a radio play version but is definitely acted more than just read.

The Bad

  • Maybe not “bad” really. This one is actually a bittersweet. One of my team decided to move on to pastures new to continue their career progression. This is always both a sad and a wonderful thing. Sad because you won’t be talking to them every day anymore. But also wonderful because everyone needs to eventually move on. They were definitely ready to do so. Even though I will miss our wide ranging phone calls that always started “I have five minutes” and ended up an hour later with us both much happier for the exchange.

Captain’s Log: December 2020

This is the final Captain’s Log of 2020. I think I will keep doing this monthly but go me. I have managed this for 12 straight months.

The Good

10k Step Challenge – I have plodded 10 thousand steps a day. Every single day for over a year. The vast majority of that in a locked down flat. It has been a grind at times. But I am happy I have done that.

While several people have been great about my tweeting about this I have to give a special shout out to David Carson. In September I was at a low point as I was sick. I pithily put it out to the universe on Twitter that I was going to just lie down but they dropped a dash of encouragement at the exact right moment if you want to read the thread here:

Thanks to David I got the whole year done and so this video of the final steps on Christmas Eve is in part his responsibility:

150 active minutes a week challenge – December bit hard so my active minutes basically fell by the wayside as I focused on taking care of my family picking up some slack. We will get back to this after the chaos dies down in the new year. I have to set some new targets.

Audiobooks – A recommendation from the Stephanie Hill over at Ascent Cyber was to check out Social Engineering: the science of Human Hacking written by @humanhacker. I have never been into social engineering. I see its value (which can be huge) and understand the basics. Listening to this audiobook has removed some of the fog of war from the social engineering map and has been a worthwhile use of an audible credit. I would recommend it.

Weegiecast – I was invited by fuzz_sh and zephrfish to go onto their Podcast WeegieCast. This was my first ever podcast. It was fun. Though I think some bits of it are clunky now I have listened back to it. I am new to being recorded saying stuff so please forgive me. If you want to hear it then you can get to the links to it via the tweet thread linked below:

Christmas – with the miserable 2020 coming to a close it is worth taking a moment to grab hold of anything that is good and pure. We are each here for whatever time we have in this life. With whatever skills we can learn. Within whatever capabilities we can train our bodies to deliver. Some start with a shittier deck of cards but the player can overcome the odds in some respects.

2020 has had many of us walking up to the edge and peering over into the oblivion. Christmas serves as a circuit breaker for me most years where I unplug. This year I went for it. I ate rather a lot of ALDI’s Christmas related sweets and chocolates (you really should go there as zee Germans really know their confections). I haven’t been to a work Christmas do in years as I cannot travel so actually the remote nature was a nice change of pace:

Whatever this view on Teams is we had a Christmas bash of sorts

Genuine Blog Posts – In December I dragged three actual blog posts out of my drafts folder:

I do enjoy blogging about technical things and that is the real mission of this blog overall. So December was actually a productive month for this site.

Music Time – I know I spam you all with this shit all the time but I do enjoy recording music even if it is on a mobile phone.

  • Rudolph (the Red Team junior) – I was asked by two groups of lovely people to make a sort of novelty Christmas song which was actually pretty good to be asked for! Neither actually panned out but as it happened I delivered a report and had a spare 30 minutes to bash out a version of Rudolph the red nosed reindeer over lunch. I think it is notable for featuring me using several layers (not a hallmark of my silly ditties). Two guitars with different tones, my mouth drum :D, vocals, and even jingle bells via my Christmas Jumper’s embedded bells. Yes the pun is “SamT” instead of “Santa/Samty Clause”. Sam T is our Director of research and I love him:
  • Merry Whatever – Appropriate for new years. A couple of points here. I have never had a piano lesson in my life. I got a keyboard about a year ago but quickly found out I had to hide the power cable or the kids basically refused to do anything BUT discordant noise experiments at maximum volume. Therefore I haven’t actually had time to practice. I bought a poster with the common Piano chords on it and fired into that early on Boxing day to achieve this:

In 2021 I can only guarantee more stupid songs because I get a kick out of them at least.

The Bad

A panic attack (late on Christmas Eve) which ensured I was exhausted for Christmas Day. Nothing much to write home about here I am getting ever better at spotting them coming, dealing with them in the moment, and recovering from them.

The kids didn’t sleep great so by the time I was downstairs with them at 7am I was a total mess of a human. Yelling at them for stupid things such as not eating their breakfasts etc. To be fair it is the biggest fight we have – around them not bloody eating. It just takes on a rather ludicrous dimension when you just want to get through the fucking meal to play games or do absolutely ANYTHING else. I’d look forward to a session of hammering molten nails through the tips of my fingers, if it just meant I didn’t have to fight over the next three bites of toast!

Seriously this was clusterfuck of a day. But after a full nights sleep I declared Boxing Day as Christmas mark 2 and we had an excellent time.

Highlights of the month

Panic attack and my behaviour aside the Christmas break has been amazingly refreshing. I haven’t had a computer turned on until right now on New Years eve to finish up this post. I never “unplug” like this. This has been good.

Happy new year and we’ll meet again.

Captain’s Log: November 2020

The Good

  • 10k a day steps challenge – I have managed this every day again. That-is-11-months. Almost an entire freaking year. If I get to Christmas eve I will have actually done something I said I would do. Which in this whole crazy wreck of a year is something to be celebrated.
  • 150 active minutes a week challenge – I hurt my thigh as I started running again at the end of October. I needed to rest that up for a week or so. But I banged into November with bad news (see “The Bad”) regarding my health. After the thigh issue cleared up I had an excellent run of it (pun gleefully intended). Most weekday mornings I would be out jogging before work and I got both fitter, and thinner as a result. I ordered an exercise bike which was said to be “next day delivery” that I have not seen any more about. I ordered before England locked back down so I was expecting to get a bike :(. Update: It eventually arrived 3 weeks later, but I haven’t had time to build it.
  • Eating well challenge – (see the rabbit food ^^^) I don’t think I really ate too badly before but lockdown definitely accelerated the amount of crap I was eating. After the bad news (see “The Bad”) I went back to tracking calories. The act of having to scan barcodes and weigh spinach is so damn annoying that I definitely eat less as a result. The first bit of weight loss for me always goes really well. So into the baggy clothes and feeling good part of the process. Back to sorta where I was pre-lockdown when I started this series of posts. It is paying off.
  • Audiobooks – I moved back to feeding my brain with Sapiens. It started by reminding me about the Naked Ape which I read a good 20 years ago. I am intrigued by the speculation around what happened 70k years ago when suddenly one of several species of tool using humans came to dominance. The theory is that there was a cognitive revolution after which one species was capable of more complex language allowing both gossip and shared fantasies like religions. This allowed evolution through co-operation instead of time consuming genetics. The most fascinating point was that this is why we have anxiety about various things that logically do not make sense. Genetically speaking we are not apex predators but it turns out we are purely because of cognitive abilities. We get anxiety about things that would kill us on the plains of Africa. We have obesity because sweet things are great for survival (high calorie content) but rare in nature. If a chimp finds a ripe fig tree they immediately gorge the whole supply. Exactly how we cannot stop ourselves with a box of chocolates. Looking forward to where it is going.
  • Testing – I have done several testing projects this month. I learned lots of things. I found lots of things. This is always brilliant.
  • PS5 – There was a whole awful Saga where I can rant about how crap the vendor I ordered from were. But it eventually arrived the day after launch more because of luck that I had a postal redirect setup than the effort of the vendor. It remained in its box until the 29th and then it was an expensive massive brick while it downloaded update upon update upon update. I haven’t really played it. The Spiderman game seems good.

The Bad

  • I was tentatively diagnosed with a liver disease – This was found as a result of blood tests I had ordered due to me feeling extra shitty after moving house for weeks. The results said I had fatty liver meaning that I need to now actively lose weight and eat right for a real reason. We do not know the extent of the problem until I get an ultrasound and other tests done. But the chances are this is extremely early stage and if I lose weight the problem will reverse. That’s the hope. So I have thrown myself into that.

Highlights of the month

Football – Scotland Qualified for Euro 2020 through a delightful playoff win against Serbia. I honestly was calm throughout. I had no doubt we were going to do it and didn’t even waver when Serbia scored in the last minute. I just felt it was going to happen.

To be clear I have supported Scotland for a long time now and I have never once felt like that before. I have been hopeful, but always sort of knew it would implode. Because we had done the penalties so well in the previous game I just expected us to do it again when we had to play extra time.

InfoSec Community – The lovely people over at Ladies of London Hacking Society asked me to do a workshop on CVE bug hunting. Despite me being an absolute fraud with only one CVE to my name I took that on. It seemed like everyone had a good time – me included. It was recorded here. I am starting at 31 minutes and 05 seconds if you just want to see my face:

That’s all folks.

Captain’s Log: October 2020

The Good

  • 10k a day steps challenge – Completed for another month. There were some tricky days. Some extremely tricky days where I was just stressed beyond belief and somehow managed to fight fatigue to stay on target. Probably the hardest month to be fair. The idea of hitting 22 active minutes a day was mostly out the window due to the stress and disorientation of the month (see below).
  • Audiobooks – I completed the Rama series of books this month. Overall I really enjoyed them. The first one for the mystery. The follow ups slowly peel back the mystery and then leave you with a tale of growing old that absolutely rings with me at the moment. I have never felt the aging process so much as I am now. Autumnal thoughts and all that. I would highly recommend this. I then lightened it up a bit with the Alan Partridge: From the Oast house. I was recommended this by Mr Paul Mason in our final conversation and I admit I am chuckling along knowing exactly why he loved it. Hand in glove with the aging thing. You do start to think a bit more Partridge the older you get. The writers and acting play an absolute blinder with this character every time.
  • I moved house – Most of this blog post is going to be dominated by this lets be honest. At its basic level I moved from a flat to a house and gained myself a little garden, and an office space which is outside of my bedroom again. In terms of lifestyle going forward this should be major. Given lockdown(s) are going to continue for a while you need to be more comfortable with the space you have. Now I have options. I can walk away from work, close the door and be done with it when the task is over which is nice. I can play PC games at night with a microphone since I am at least not at the foot of the bed where my partner is trying to sleep.
  • It has a garden – I have completed the majority of my 10k steps a day challenge in a corridor of my flat which was about 1 metre wide by 8 long. The garden is an upgrade and gets me fresh air at the same time. It also has one solid step to elevate the heart rate on before getting onto the light jogging I am capable of. It ain’t much. But as of the 16th of October I have cleared the space and found all the running stuff from the myriad of boxes and am set to get back to the “lets get 22 active minutes a day” side mission.
  • Good weekends – We managed a pretty relaxing weekend or two at the end of the month which helped me recover. While hard to do we built 3 new flat pack beds on a Sunday. A great thing is building furniture with the eldest. They want to help but have been “far too silly” until just about now (I have tried). They got to thwack things with a hammer and screw in screws until they were thoroughly bored of it. We did some Halloween drawing with the kids, we played some board games. It was overall pretty decent.

  • Borat Subsequent Moviefilm – I mean. An absolute stunning work this one. They had a point they wanted to make about #MeToo and politics in general. They went after it and it is as fascinating as is it funny to witness. Making it part of the “freely” available content on Prime instead of charging a fortune for new content shows they wanted to make the point land on as many screens as possible. A truly fascinating project and absolutely worth a watch.
  • Left4Dead 2 – I played a round of L4D2 on Halloween eve. I really like that game when you have a squad to play then it is a satisfying online gaming experience since it rewards teamwork and not lone wolves with sniper rifles. Great times.

The Bad

  • Loss of a friend – The legend that was Paul Mason sadly died the same weekend as my house move. I have covered this a lot already as he was worth his own blog entry and more.
  • Panic Attack(s) – I have not had one in a long time this year fortunately. As this monthly blog tracks them I think the last entry was pre-Glasgow Defcon in February. The month has been a total blip of panics which I have mostly been fine about as the effects are more easily mitigated. However, I believe the stressors are now removed so I hope we get back our regular schedule of hardly any a year. Classical cause reason: poor sleeping patterns.
  • They say moving home is stressful. I have never really experienced that before as it was mostly fun to pack stuff up and cleanse your life from unnecessary possessions and go on a new adventure. The problem with that rosy attitude is I had never experienced the full lawyer experience. If you both have to SELL a property and BUY one you get both barrels of them.
  • There is definitely a blog post in me only about the experience I had on this with a slant on incident management brewing. I may calm down enough to let it lie.

Highlight of the month

I would say actually getting moved and starting to make a new place our home.

Captain’s Log: September 2020

The Good

  • 10k Daily Steps Challenge + **New Goal** – Still rumbling along with this nicely. I upped my game to now add a sub task to aim for 22 active minutes a day. That means having the heart rate properly elevated. This is going to take a while to get habitual but I have made a decent start and lowered my resting heart rate a couple of beats at the same time. The month went well until the final 2 days where I had a beast of a cold and sore throat. I managed the 10k but it took a lot of effort. I whinged on twitter about a possible chainbreaker while being sick and @TIA568B reminded me to keep going so voila:
Some days this is what success looks like
  • Blog Posts – I got an actual technical blog post out the door getting re(started) with iOS app testing. I prefer this blog maintaining its technical edge but I was never prolific with that stuff with at most 8 a year. The commitment to track my 2020 with the Captain’s Log series has drowned out the few technical posts.
  • Audio Books – Absolutely still devouring the Rama series of books by Arthur C Clarke. I am on to “Rama Revealed” which is the final book. The first book was a wonderful and relatively short story but the later instalments have been much longer listens with this one being 20 hours. Very much worth watching.
  • Youtube Channel – I have been watching Kurzegesagt with my kids. It is probably a bit beyond them but my eldest is getting all kinds of joy out of the existential and space series. I keep regularly having “mind blown!!” reactions to these videos. Honestly they are amazingly well put together. Delve into the series on ants… Pro tip.
  • Sleep – The youngest has started to sleep through the night! Hopefully this continues. So I relocated myself from sleeping on their floor to an actual bed. Like a real person I have slept on a bed! As I write this on the 7th of September for 4 consecutive nights. Long may this continue. *update.. It continued :D*. This is the real shift as it enabled the new exercise goal. If you don’t get sleep you cannot recover from exercise and so it was of limited value without this.
  • Games – XCOM: Chimera Squad. I had no idea that this had been released! I am a long time lover of the XCOM series. Over the years they have tried multiple different game modes including flight simulator, FPS etc. This is an interesting twist which is close to old school final fantasy game dynamics. Each mission is a series of breach and clear engagements. Upgrade kit to make more breach possibilities occur i.e. a brute force device to defeat doors locked with keypads, or explosives to make entries in walls. It has been interesting and a different direction for the series.
  • Weekends – We managed to get to the park most weekends for outside activities. Getting this done early in the weekend sets us up for a happier time over the weekend. Even ventured out to the forest for a roam about in nature. The kids were mainly asking where the slides were until they discovered a massive pile of rocks to climb.
  • CENSIS Talk – I was asked to speak at an event for CENSIS. Work were all for it, and gave me time in the busy schedule. The talk was around security practices in the IoT ecosystem space. While I tell everyone I am not the expert in this area I do slowly improve my understanding of it. The real positive about this was that we had agreed to do a live hacking demo. No bother when the event was face2face, but I needed to record it. The process of recording and editing was enjoyable and I really get a kick out of making little films.

AWS Snafu Finally Solved!

In April I bought a book called “AWS Pentesting with Kali”. I had decided to fire into some cloud skills as I am increasingly back on customer engagements again and it is always nice to learn new things. Sadly I have not even opened the book yet. But I did develop a tool (still not released) to enable data in and data out of restricted environments.

Data in via typing, and data out via QR codes which are both established techniques already but I like to make my own tools for these things sometimes.

Anywho, I needed a Windows server over an Internet connection and RDP to get the right feel for speed. So I went with opening an AWS account, woohoo! I would spin up a new instance each time I worked on the tool and then crush it as I went to bed using my free-tier allowance like a boss.

Unfortunately ever since May I have been sent an email every month warning my of my free-tier allowance being at 85%. But.. but.. I have nothing running? I log in to the dashboard and see nothing even paused. As the months roll on I eventually tweeted about it:

Enter the heroes I needed: @JGMSoftware, @UK_Daniel_Card, and @joe_jag who all deftly informed me I know nothing about AWS because I had assumed that dashboard showed me everything when it is indeed tied by region. I have honestly no idea why the server was spun up once in Ohio when I seem to default to Virginia on the dashboard.

Lesson very well learned and THAT is why I bothered opening an AWS account in the first place. Now that my test server is properly wiped I can now crack that AWS book open in the dead of winter and not incur costs immediately as I will have my free-tier amount back.

To the helpers. I salute thee. Keep being beautiful.

The Bad

  • Stress – I had a very stressful couple of weeks over the end of August and start of September. Some times are tough but this one was pretty up there. On being positive about it something good should come of it mid October unless there are delays or catastrophe. Fortunately the uptick in weekends being relaxing and sleep came just as it ended. Nicely timed.
    • I would like to caveat this with the fact that, after the initial rocky start, the increase in sleep quality and duration by sleeping on an actual bed made it vanish.

Highlight of the month

Work took me to places where I needed to record multiple videos for different audiences. Some for internal training, and then this one which I can share with you.

This is notable because it was made for a non-security audience. That meant doing some background theory in risk analysis and threat modelling before going into a live hacking demo to help contextualise what was happening.

Research it is not. But a reasonable demo against a vulnerable spoofed IoT ecosystem which was fun to put together.