SANS Holiday Hack 2015 Resources and Tools

Resources and Tools

(I don't check these, so I cannot guarantee that they don't contain malware.  I am not responsible for your information or machine if you decide to visit these sites.  I use VM's on a host machine that I do not use for anything other than challenges.  I also have this on a separate network from my normal devices.)

Counter Hack Team-Thanks, without your wisdom, I would never have been able to solve most of this challenge.
Kali
SIFT
CentOS Binwalk Scapy-rdpcap Python
Bless Hex Editor
Burp Suite (free version)
https://www.google.com
https://cyberchallenge.com.au/pdf/CySCA2014_Network_Forensics.pdf https://en.wikipedia.org/wiki/SquashFS http://unix.stackexchange.com/questions/94270/how-to-install-squashfs-tools-on-ubuntu http://stackoverflow.com/questions/3470546/python-base64-data-decode
https://www.shodan.io/
http://www.opinionatedgeek.com/dotnet/tools/base64decode/ https://ssodelta.wordpress.com/2014/01/06/image-secrecy-and-xor/ http://stackoverflow.com/questions/8504882/searching-for-a-way-to-do-bitwise-xor-on-images https://pen-testing.sans.org/blog
https://gist.github.com/joswr1ght/32f241d7d4074ec5e26b (colorful directory display) http://blog.commandlinekungfu.com/2009/04/episode-21-finding-locating-files.html http://blog.commandlinekungfu.com/2011/04/episode-142-xml-in-shell.html http://www.openwall.com/john/
http://hashcat.net/oclhashcat/
https://www.holidayhackchallenge.com/2015/giyh-capture.pcap https://www.holidayhackchallenge.com/2015/giyh-firmware-dump.bin
http://binwalk.org/ https://www.sans.org/reading-room/whitepapers/testing/exploiting-embedded-devices-34022 http://blog.commandlinekungfu.com/ http://www.amazon.com/Ready-Player-One-Ernest-Cline-ebook/dp/B004J4WKUQ/ https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf https://github.com/OpenRCE/sulley
https://github.com/jfoote/exploitable
http://www.coresecurity.com/files/attachments/StackGuard.pdf https://penturalabs.wordpress.com/2011/03/31/vulnerability-development-buffer-overflows-how-to- bypass-full-aslr/
https://gist.github.com/joswr1ght/a45d000ceaccf4cce6cb
http://expressjs.com/
https://hackerone.com/reports/7779 http://pen-testing.sans.org/blog/2015/12/03/nosql-no-problem-pillaging-mongodb-for-fun-and-profit http://portswigger.net/ (Burpsuite) http://www.thegeekstuff.com/2010/11/strings-command-examples/
https://www.wireshark.org/ http://www.packetstan.com/2010/11/packet-payloads-encryption-and-bacon.html

https://media.blackhat.com/bh-us-11/Sullivan/BH_US_11_Sullivan_Server_Side_WP.pdf http://s1gnalcha0s.github.io/node/2015/01/31/SSJS-webshell-injection.html http://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html https://pen-testing.sans.org/blog/2015/12/20/pen-testing-node-js-staying-n-sync-can-make-the-server- go-bye-bye-bye 

SANS Holiday Hack 2015 Challenge 2015-Answers Attempt

1. What commands were sent over the gnome's command and control center?
(I'm not certain if this answer is correct.  I was looking at the DNS responses in the case.  I may've needed the DNS requests.)

EXEC:iwconfig
EXEC:START_STATEEXEC:wlan0
EXEC:lo
EXEC:eth0
EXEC:cat /tmp/iwlistscan.txt EXEC:STOP_STATENONE:NONE:NONE:NONE:FILE:/root/Pictures/snapshot_CURRENT.jpg FILE:START_STATE,NAME=/root/Pictures/snapshot_CURRENT.jpg

(I wasn't sure if the whole C&C transaction was required. I listed it later in this write-up.)

2. What image appears in the photo the Gnome sent across the channel from the Dosis' home?

3. What operating system and CPU type are being used in the Gnome? 

The operating system is OpenWrt. The CPU type is ARMx64.

3. What type of web framework is the Gnome web interface built in?

The web framework that the Gnome web interface is built in is Express web framework which is a Node.js type of framework.

4. What kind of a database engine is used to support the Gnome web interface?

The kind of database engine that is used to support the Gnome web interface is Mongo.

4. What is the password stored in the Gnome database?

The password stored in the Gnome database is SittingOnAShelf.

5. What are the IP Addresses of the five Super Gnomes scattered around the world, as verified by Tom Hessman in the Dosis neighborhood?

The IP Addresses of the five Super Gnomes scattered around the world, as verified by Tom Hessman are:
Super Gnome 1: 52.2.229.189
Super Gnome 2: 52.34.3.80
Super Gnome 3: 52.64.191.71 
Super Gnome 4: 52.192.152.132 
Super Gnome 5: 54.233.105.81

6. Where is each gnome located geographically? 

One gnome is located in Japan
One gnome is located in Australia.
One gnome is located in Brazil.
Two gnomes are located in the United States.

7. Please describe the vulnerabilities that you discovered in the Gnome firmware.

Every gnome except for Gnome 3 has the password reuse vulnerability.
The first gnome had a plain text password stored in the Gnome.0 Mongo database.
The second gnome's vulnerability was in the settings files upload feature and the cam viewer feature. The cam viewer feature introduces a local file inclusion vulnerability in the camera variable.
The third gnome has a flaw that allows one to bypass the login page.
The fourth gnome has image processing capability added to it. Unfortunately, in the files upload section, this image processing is sent to an “eval” statement, and the user input isn't sanitized. The only protection is a mime-type check, which can be bypassed.
The fifth gnome has a is vulnerable to attack via port 4242. There is a Super Gnome Status Server on that port. The first gnome had the source code for a service running on that port. I suspect that the sgstatd.c is vulnerable to a buffer overflow vulnerability or a frame pointer overwrite.

8.  Please describe how you exploited each vulnerability.

Super Gnome 1: One could simply log onto the IP Address at 52.2.229.189 using the username “admin” and password, “SittingOnAShelf”. The IP Address is in the etc/hosts file in the firmware.

Super Gnome 2: One could use the upload “filen” variable to create a directory that they had access to. One could create a directory that had a .png in the directory name to bypass the .png requirement in the camera viewer. Once the .png requirement was bypassed, whatever the cam viewer variable “camera”, was set to, was displayed to the screen. After creating a directory that had .png in it, and that one has access to, one could craft a url like the one below to access the directory and file that they wished to.

http://52.34.3.80/cam? camera=../../../../../../../gnome/www/public/upload/LUbQRcPB/abcde/bob.png/../../../../../../../gnome/ww w/files/gnome.conf

Super Gnome 3: One could use the username “admin” and have the password evaluate to true, by using the content-type:application/json. Then typing, “{“username”: “admin”, “password”: “{“$gt”: “”}” in the body of the POST message.

Super Gnome 4: One could put an SSJS injection in place of the postproc body POST request and can exploit the “eval” function. Eval takes strings as functions and executes them.

Super Gnome 5: I'm not certain how one would exploit this Super Gnome. I do notice that it is handling buffers and pointers to memory locations, though, and usually the pointers can be overwritten to point to whatever position in memory that the attacker wants to target via the buffer, hence the term, “buffer overflow vulnerability”. Canaries are used to help mitigate this problem, although they aren't always successful. There are ways to bypass them. This may actually require a frame pointer overwrite, which is different than a buffer overflow.

9.  What is the nefarious plot of the ATNAS corporation?

The nefarious plot of the ATNAS Corporation is outlined in the e-mail contained in Super Gnome 3. The nefarious plot is to rob everyone who owns a Gnome In Your Home on Christmas Eve.

10.  Who is the villain behind this plot?

It's Cindy Lou Who. In the e-mail contained in Super Gnome 3, the boss spells out the plan, the manner of speech is that of the Grinch. In the e-mail contained in Super Gnome 4, Cindy Lou Who explains that seeing the Grinch rob her home when she was about two traumatized her and caused her to hate the Christmas season. When one xors the camera images of factory_cam_1.png, factory_cam_2.png, factory_cam_3.png, factory_cam_4.png, and the camera_feed_overlap_error.png; one starts to notice a picture emerging. It appears to be Cindy Lou Who. 

SANS Holiday Hack Quest 2015

Holiday Hack Quest

When I first arrived, I saw the friendly 8 bit face of Lynn Schifano. I chatted with her to get an idea of what to do. I looked at the office tour. I noticed that one of the achievements states to find the secret rooms.

Lynn: “Welcome to the Holiday Hack Quest. My name is Lynn Schifano. I work at Counter Hack iHQ. Have you seen the office tour? I’ll be your source for news and events. Check back often for more information. Counter Hack staff are working in the general area. If you talk to us, we’ll share information about the tech we’ve been working on. Not everyone is so forthcoming though. You might have to coax them into talking along the way by providing them with goodies you find scattered throughout the neighborhood. Also, we’re having trouble finding our intern. If you see him, let Ed know.”

Secret room one was shown in the office tour.

Ed was in the home right above Lynn.

Josh Dossis is near the corner of Einstein Blvd and Lovelace Way. He would like to know the text that was in the photo in the traffic capture.

I had to get off the game to analyze the pcap. I found DNS traffic with Base64 encoded messages in it. I extracted the Base64 encoded messages. I used Wireshark to find the DNS queries. I looked at “Statistics”, "Protocol Hierarchy", and then selected “Domain Name Service” and right-clicked and selected “apply a filter”, and “selected”. I saw a lot of the DNS query responses had 0x1337. I followed the UDP stream on those. They were base64 encoded. I used the “Follow UDP” window to save all of the base64 encoded strings into a text file. I used find and replace to take out all of the plain text and decoded the base 64 strings using python. Once I realized what was going on, I used the whole original pcap to decode the base64 strings using Scapy. Once decoded, they showed the information that the gnome was sending back to the C&C. When Scapy decoded the base64, the hex for the image with the answer to Joshua's question was shown. I will detail my method for extracting the image in a later post.

Josh Dossis: “Wow, that’s right. Wow, congratulations! That is amazing. I wonder how far this operation is, if our gnome is specific to North America. Did you talk to Jessica yet? She has been tackling the hardware side of things. If you need it again, you can download the packet capture, here."


Jessica Dossis: is in the same home as Josh, in the room on the left hand side. She won’t give the firmware until Josh gets his answer. Once Josh has his answer, she says,
"Hi. I’m Jess Dossis. Josh mentioned that you’ve been helping figure out what’s been going on. I took the liberty of disassembling the Gnome and dumped the NAND storage using my Xeltek SuperPro 6100 to a file. Can you extract the password from this data dump?
You should also chat with Jeff - he’s the go-to guy for firmware analysis. I think Jeff is teaching NetWars next door right now.”

I talked to Jeff.

Jeff McJunkin was in the Grand Hotel, near the corner of Tesla Street and Lovelace Way. He wanted one of Jo Mamma's cookies. He said that Tom Hessman had unrestricted access to Jo Mama's cookies. 

I had to go and search for Tom Hessman. I remembered that Tom Hessman often works on NetWars, but I was already in the NetWars room, and Tom wasn't in there. Then I thought that maybe he controls it remotely, from Counter Hack. I really didn't know much about it. So, it got me to thinking about Ed. So, I went to Ed's room. I noticed the book case, and remembered the company tour had a secret room behind the book case. So I clicked on the book case and found Tom Hessman. He stated, “I am the great and powerful oracle, also known as Tom Hessman. If you enter some text, I will treat it as a question. Ask me about an IP address. I will tell you if it is scope. You can only target those I approve, despite my entertaining trope. I didn't realize what to do at first. Then I noticed that the chat screen stated that I was in a “cone of silence”, so I typed the first IP Address. Tom Hessman said, “Yes! 52.2.229.189 is in scope! Just make sure that you don’t launch denial of service attacks, or otherwise interfere with the host’s production processing. Dirbuster will not help you.” 

While I was there, I asked about the other IP Addresses as well, and got the same message, but with the different IP Addresses. The song, “Grandma Got Ran Over By A Reindeer” was playing in Tom's room. Did Tom’s poor grandma get run over by a reindeer? There were no Jo Mamma's cookies in sight. I searched around the rest of the town to no avail. Then I remembered that there was a secret room #2 in the achievements. Knowing that the cookies should be near Tom Hessman, I checked his room for a secret passage. I noticed that the panel on the wall on the top right hand side looked kind of weird. I hovered my mouse cursor over it, and sure enough, it was green. I clicked on it. I ended up in a room with Jo Mama's cookies.

I took the cookies back to Jeff.

He said, “Firmware files often consist of header records and binary code, followed by one or more compressed images, squashed together into a single file. The compressed portions of the firmware file can sometimes be decompressed to extract micro controller code, or even full embedded device file systems. Bin walk is a handy tool that searches through a given file using file signatures to identify and even extract the individual firmware components smushed together. There is a great paper about using Binwalk for firmware analysis by Neil Jones. Once you get the file system extracted, you’ll have to go firmware spelunking: exploring the contents of the files or the decompressed file system for interesting artifacts and data. If you’re exploring file system data, Ed would be the guy to talk to about that. Serious CLKF skills. CLKF=Command Line Kung Fu. The intern was supposed to help with NetWars. The Intern was really interested in the Holiday Hack development efforts. Jeff and the Intern spoke about Ready Player One. The Intern was interested in the Konami Code.”

I had to get off the game to analyze the firmware. Once I retrieved the password, Jess said, “Wow, that’s right. Great work recovering that password! Amazing! Sometimes all you need is just one foot in the door: a single password goes a long way to compromising a target. Come to think of it, you should 'sho' Dan the password information. Interesting, it looks like the Gnome is using Node.js for web services. Node.js is a recent platform that is getting a lot of attention. SSJS programming uses an event- driven non-blocking architecture. Oh, SSJS is Server-Side JavaScript. Combined with NoSQL databases, it can scale and perform to much greater levels than traditional MVC architectures. I know Dan and JoshW have been spending a lot of time working with SSJS and NoSQL, you should chat with them too. This is powerful stuff, I’m going to keep digging here. If you need to grab it again, you can download the firmware here.”

I had been working on the SANS ICS Security Challenge, so I had been introduced to Shodan. At first, I didn't realize that the spelling error was on purpose, but I looked up the IP Address that I had found on Shodan anyway. That's when I noticed the weird phrase, “GIYH::SuperGnome by Atnascorp”. I searched for that phrase in Shodan and found the other IP Addresses. I filed that information away for later.

Since they hinted that I needed to speak to Dan, I spoke to Dan next. I found out where the characters were in my search for Jo Mamma's cookies.

Dan is on the right hand side of the corner of Turing Avenue and Boole Way. Dan has been working with NoSQL databases. NoSQL is a data storage mechanism that uses a different data structure mechanism, making it faster than traditional relational databases for some applications. For example, MongoDB is a popular NoSQL database. Instead of relational tables, it stores indexed JSON documents. From a security perspective, MongoDB and other NoSQL databases are just as vulnerable to injection attacks as classic relational databases. One option for NoSQL injection is to manipulate the input JSON data before it is deserialized. Deserializing is just taking the JSON and converting it into the internal programmatic variables it represents. Check out Petko D. Petkov’s article on MongoDB injection. Talk to Tim about Server Side JavaScript Injection Attacks. He’s been doing a lot of that work lately.”

I went inside the building next door to Dan, the one on the corner of Turing Avenue and Lovelace Way. When I entered, I hovered over the sign, clicked on it and read it. It is a coffee shop called Cuppa Josephine's Coffee. I talked to Brittiny. She stated that she was on break.

Lynn stated that Tim was in the park to the East, at the very beginning of the game, so I went to talk to Tim. The park is near the corner of Einstein Blvd and Babbage St.

Tim stated that he wanted hot chocolate.

I remembered that Brittiny worked in Cuppa Josephine's Coffee. Brittany left the hot chocolate on the bar for me. 

I took the hot chocolate back to Tim. He said, “Thanks for the hot chocolate, that hit the spot. I hear that you are working on packet capture analysis. Here are a few useful things that will be useful for you to know. First, you’ll often see different encoding methods for binary data in network protocols. Tools like Burp Suite will be useful in decoding all sorts of data. Don’t forget to use the Linux strings utility. You can quickly grab and examine ASCII or Unicode Strings from any file. If you have to reassemble bits of data, you’ll need to figure out packet reassembly order. Wireshark and some manual analysis will be useful. Complex data reassembly is best implemented with a short script. Scapy makes quick work of a packet capture for extracting useful information. In Scapy, check out the rdpcap() function and the custom callback handler with the prn parameter. We still don’t know where the intern is, but I’m concerned. He was asking some odd questions about how we run email and transport encryption before he left for lunch.”

Dan mentioned asking JoshW about getting him to eat disgusting shrimp, so I visited JoshW.  Josh W is in Susabune (top right hand building), on the corner of Tesla Street, and Ritchie Street. JoshW wanted a candy cane to wash the disgusting taste out of his mouth. I found the candy cane on the top left-hand side of the screen. Once I gave him the candy cane, JoshW said, “Yes, Jess is right. I have been working with node.js. The platform takes some getting used to, it’s radically different than the normal LAMP model. For one, Node.js IS the web server, often using the Express web framework. No separate Apache, NGINX, or IIS process to attack. By itself, the platform doesn’t stop most traditional web attacks. It’s still up to the developer to carefully process all input. Someone found a Local File Include bug in Yahoo’s marketing-dam.yahoo.com site last year. He got a $2500 bug bounty for reporting it. LFI attacks are useful when combined with arbitrary file upload features. The difficulty in LFI attacks is often figuring out what the code does when processing filenames. Sometimes it becomes necessary to manipulate your input string to satisfy a filename extension or other server requirement from the included files. PHP LFI vulnerabilities could classically use NULL termination with to terminate a string and stop the server from processing any content appended to the end of the injected value. http://target/vuln.php?id=2&pdf=/etc/passwd With SSJS LFI vulnerabilities, you need to figure out a different way to satisfy a directory or filename extension requirement, but still targeting the exact file that you want to grab. The trick doesn’t work with SSJS. http://target/vulnid=2&pdf=/.pdf../../etc/passwd. Read his article about pillaging MongoDB databases.” 

I got the gift from Josh W to give to Dan. He gave me the clue that the intern was by dumpster near the hotel. When I went to the hotel dumpster, the pin to the control center was laying on the ground.

I talked to Dan.

The gift was a gift certificate to the restaurant, stapled to his “volunteer pink slip.” "Dan, Thank you for your work as a volunteer at my restaurant. You’re fired. :) Happy Holidays! Your Friend, JoshW.”

Everyone suggested talking to Tim for help, so I spoke to him again. He said, “LOL, fired from a volunteer position, Classic Dan. So yeah, SSJS injection attacks are pretty exciting. Like classic injection attacks, which allow you to run a local command on the target platform, SSJS injection attacks allow you to run arbitrary commands. Unlike XSS which allows you to run JavaScript on the victim’s browser, SSJS injection allows you to run arbitrary JavaScript on the server. When a developer uses the JavaScript eval() method without validating the input, it is vulnerable to SSJS injection. Anytime you see a parameter that can be manipulated on a site using Node.js, replace it with JavaScript that would produce a calculated value. Check out Bryan Sullivan’s paper Server-Side JavaScript Injection and SSJS Web Shell Injection by @signalcha0s. The intern? I still haven’t found him. I did find Tom VanNorman though. He’s working on some amazing stuff. You should talk to him too.”

I visited Tom V, because he was the only person that I hadn't talked to and Tim recommended talking to him. He wanted a string of lights.

The string of lights was in Dan's room.

I gave Tom V. the string of lights. He said, “In addition to working on these PLCs, I also work on software attacks which consists of two primary components: vulnerability discovery followed by exploit development. Without access to source code, vulnerability discovery can be done using reverse engineering tools such as Hopper or IDA Pro, or through manual or automated testing
For simpler programs with limited input options, manually manipulating input fields to identify a crash condition can be a useful vulnerability discovery technique
For complex programs, you can create small testing scripts using Python or Bash with Netcat or use more complex fuzzing frameworks such as Sulley
Once you’ve identified a crash condition, you need to determine if the flaw is exploitable. You have to determine where the program crashes.” He suggested using the following tools and reading the

following articles:
GDB Exploitable
modern-bypass exploit mitigation techniques
Gerardo Richard paper-if you destroy a stack canary, you’ll have to fix the stack before the vulnerable function exits
Address Space Layout Randomization - Oxdusty paper
check to see if a system has Data Execution Prevention (DEP) to see if you need to bypass it.”

The “Authorized Personnel” building was the only one that I hadn't visited. It was near the corner of Turing Avenue and Babbage St. I was told to find the intern, so he must be in there. It took me a while to figure out how to get into the NOC. I remember that part of cyber security is physical security, so I looked closely around the building, and noticed an area of fence that looked like I could crawl beneath it. I crawled under it, and was in the fence. Then I walked up to the door. I noticed that I was in another cone of silence, so I looked at my inventory, and typed in the pin. The pin was 0262.
I ended up in a maze. Through trial and error, and many notes, I found my way through the maze.

Maze Solution:

Up Up Right Left Up Up Down Down Left Right Left Right
That “Left-Up” path at the end was annoying. It took a while to figure out that I was going in circles.

I found the intern at the end of the maze. The intern had a nefarious plot to place a gnome inside the data center. I caught him red-handed. It’s all a part of ATNAS Corporation’s plot. He stated that he didn’t know the details of the big plot. His part was to plant the gnome in the data center so that ATNAS could monitor the communications between Counter Hack and the Holiday Hack participants. That way if anyone figured out the big plot, the senior leadership of ATNAS corporation would know. I foiled his dastardly plan, but the big plot continues. Since he betrayed Counter Hack, I think that his punishment should be to eat the fruit cake that has been passed around for decades, but it's not my decision to make.

Lynn told me to tell Ed when I found the intern, so I went to speak with Ed. He said, “You met Jeff, isn’t he wonderful? Firmware spelunking? It’s amazing! When you extract the firmware of a device, you have unlocked a treasure trove of information. The hard part is identifying the valuable information. First, it’s easy to get lost when you are exploring a filesystem extracted on top of your normal filesystem. Changing your command line prompt to clearly show you the directory you are in will eliminate some confusion when exploring. You can even use a nice colorful display of your current directory on a line all by itself. Use the Linux find and grep utilities effectively. They will help you uncover useful data much faster than manually analyzing the file system. For Linux filesystems, you’ll find clues in the /etc directory. Take a look at the configuration files for different services including system startup scripts in the init.d directory. Look at the system services and the directories mentioned in the configuration files. Always remember the SEC560 credo: ABC Always be Cracking’ if you find password hashes crack them with John the Ripper or Hashcat.”

I told Ed about the evil Intern’s dastardly plan and completed the first part of the challenge. The credits rolled. Love the ending of the Holiday Hack Quest. Star Wars rolling credits! Can’t beat that! 

Kano Review

I wanted to post about Kano computers today.  I don't get any revenue from anyone for discussing products.  It's an excellent investment for my kids to learn about programming and technology.  I just like this one enough that I want to share it in case someone else is interested in their kids learning about programming and technology.  This one is relatively inexpensive for what it is.

I want my children to be familiar with technology because that's where we are now, and where we're headed in the future.  It doesn't matter what field people go into now.  Everyone should at least have basic experience with computers.

My spouse sent me a link to the Kano computer website.  We'd been discussing teaching the kids python programming and Linux. I was a little skeptical, looking at the website.  A Kano is a computer that kids can make themselves.  It's not as difficult as one would think.  It comes with directions.  The computer is a Raspberry Pi II.

https://www.raspberrypi.org

Basically, the kids can see the inside of the computer.  They just put together the case, the speaker, and they plug it into a monitor, and the wall.

http://us.kano.me/products/kano-kit

I'd seen Raspberry Pis before, so I decided to go ahead and order a few.  I've been meaning to order a Pi for myself anyway, to get familiar with it.

I'm now glad that I did.  I love how easy they are to put together.  We ordered screen kits as well.  The screens are nice because you can sit them on your lap instead of having them on the table, and the Raspberry Pi snaps into place on the bottom of the screen.  They are High Definition Screens as well.  The keyboard is just the right size for little hands, as well as small adult hands.  The keyboards have a trackpad and a button to click, so no separate mouse is needed unless your child is more comfortable with a mouse.  The mouse would have to be a USB mouse though.

I would suggest getting a USB hub if you want to have more USB ports.  It only has four to begin with, and two are used, one for the keyboard, and the other for the WiFi dongle.

The little cardboard insert that they include to label the buttons keeps falling off.  It's a minor inconvenience as long as you remember what the buttons do.

The speakers were a little annoying to put into place.  It takes a little finesse to get them properly aligned.  I had to help each of my children with this part.  Also, they are not USB speakers.  My eldest son's speaker has stopped working already.  (I think that it's because he keeps unplugging it from the wall instead of shutting it down properly.)  We are thinking about purchasing separate USB speakers instead of using the ones that came with it.

The games on the Kano seem to be keeping my children interested in playing with it.  They mostly like the Minecraft game that came with it, but the Terminal game is fun as well, and it teaches the Linux Terminal.  They haven't tried the other games that were included.  I guess that the app-like logos haven't been enticing enough for them to want to try those.

I played with the music game a little bit.  I didn't really find it to be entertaining because of the quality of the speakers.  I think that if the speakers were better that it might be fun.

The Kano forums are good.  You can visit them to download updates to the current games, get new game/projects, and share your current work.

I had a little glitch with the shipping, ordering around the holidays, but we got them in time for Christmas, and the customer support was superb.

I purchased a Kano for myself as well.  I plan on trying to install either Raspbian or Windows 10 IoT on it.  It should work, given that it's a Raspberry Pi II.  The Kano software that it comes with is great for kids, and if you're unfamiliar with Linux, the Terminal game will help you learn the command line, but you might get bored.  It isn't advanced, yet.  Too many people often forget the importance of basics, though, and I think that this is a fun way to learn them.  It just depends on what kind of person you are.  The Terminal game reminds me of Zork, and I loved that game.  I admittedly spent an hour or two playing that game, myself.

Overall, I would give this an 8/10.  There are a couple of things that could be better, but for the most part, it's excellent.

ICS Challenge and SANS Holiday Hack

I did what I could on the SANS ICS Challenge.  I was trying to work on two challenges at one time.  I looked forward to the SANS Holiday Hack Challenge all year.  I'm disappointed with myself though.  I wasn't able to complete either of them.  I guess that I did okay, considering that I don't have a lot of work experience or course experience with either of them.  I'll post the answers that I did get after the challenges are officially over.

I picked up a new book called "The Art of Memory Forensics".  I used it to help me solve some of the ICS Challenge.  I'm haven't read much of it, because I don't understand much of what it is talking about.  I keep Googling stuff that I don't understand.

I think that I need to get a book that goes into depth about different OS processes, and what is normal.  I can't recognize abnormal because I don't know what normal is.

I like forensics, but I imagine that working in forensics is quite different than this challenge.  I think that when one is working in forensics, they are probably using a lot of automated tools/scripts, and there really isn't a lot of spelunking.  They might have to verify results, but it's not the same.  That's not necessarily a bad thing, though.  It could be interesting, but in a different way.

On the Holiday Hack Challenge, I feel that I'm close on two of the super gnomes, but I just can't get what I'm trying to do to work.  My spouse states that sometimes it's about attitude.  A student might try one thing, and it doesn't work, then the instructor walks up, types the exact same thing, and suddenly it works.  You have to believe that it will work.  It doesn't make much sense to me.  Who would've thought that turning a computer off then on again would solve about 98% of computer problems though?

I learned stuff so quickly to begin with, and now I'm at that point where things are getting more difficult to learn as I progress in knowledge.  I just have to power through this and keep trying.

SANS ICS Challenge

SANS is starting a new Challenge soon.  Registration has already started.  The challenge officially starts on November 15th, 2015.  I'm looking forward to it because it has to do with industrial control systems, and it was inspired by the DC3 Digital Forensics Challenges.  It states on the website that it's for all levels of experience as well, so I might have a chance to learn something new.

Here's the link to the SANS ICS Challenge website:

http://icscybersecuritychallenge.com

iPhone 6 Plus "Feature"

My husband and I discovered a "feature" with the IPhone 6 Plus.  One morning, my husband was able to see my phone under his "WiFi" Connections as a device that was able to be connected to.  (Note:  Not under Bluetooth, Under WiFi.  He wasn't able to see it before that update.)  The problem:  I did not have the "Personal Hotspot" setting turned on on my phone.  I did happen to have my Bluetooth setting turned on so that I could connect to my Fit Bit Surge via Bluetooth.  It gets even worse.  Not only was he able to see my device in his connections, he was able to connect to it without even having to type in a password at all.  (It was set to the default password on the Personal Hotspot settings of the phone.)  When he connected to my phone with his phone, it changed MY "Personal Hotspot" setting to On.  Fortunately, they fixed the authentication issue, requiring him to put in a password, now, however, when I have my Bluetooth on, he can still see my phone under his WiFi connections, and when he tries to connect, it still changes MY "Personal Hotspot" Setting to On.  In the original bug report, I tested it with a device with a different Apple ID, and I was able to see and connect to my phone.  Now the different ID still detects the phone but requires a Bluetooth pairing.  This was with a MacBook Pro, though, not another phone.  I do not know what another phone with a different AppleID will do, considering that I don't own another phone.  I did think that it was prudent to mention that I submitted this "Feature" of another person being able to change my "Personal Hotspot" setting from their device as a bug, however, I was told that as long as it's the same Apple ID on both devices that it was working as intended.  Okay, so how do the devices know that they are on the same ID?  Do they broadcast that information?  Is it stored in the AppleID database under a devices section?  Secondly, what if someone happened to steal the ID and was near enough to automatically connect to my device?  It doesn't sound like a feature to me.  It sounds like a bug that needs to be resolved.  I'm keeping my Bluetooth on my device turned off.  I don't need to sync my FitBit Surge that bad.  If you really need to sync something via Bluetooth, I suggest changing that default password on your "Personal Hotspot" setting just in case, and testing it.