BBC.com Cyber Security Article-Partial Solution

I saw a retweet of an article titled, "Do You Have The Brains for CyberSecurity? http://www.bbc.com/news/technology-34312697  I decided to give it a whirl.  The answers will be revealed next week.  If you would like to try to solve the puzzles, do not read any farther.  Update 2:  The official solutions have been posted.  http://www.bbc.co.uk/news/technology-35929741

Challenge One:

This first puzzle is pretty straightforward. You even get the key. Use it to decipher the questions and then choose the right answer.

Decoded:

Where was the centre of CODE BREAKING during WW2?

Bletchley- the answer was stated earlier in the article.

The man who designed the machine that CRACKED the ENIGMA CODE was?

Turing-This information was in the SANS Holiday Hack Challenge 2014.

The fundamental BUILDING block of ELECTRONIC devices is the?

Transistor

Challenge Two

This time there is no key to help decipher this short string of numbers, so it is a bit harder. However, here is a hint - once deciphered the string will reveal the name of a famous maths code that uses numbers.

5 8 1 14 13 0 2 2 8 18 4 16 20 4 13 2 4

The solution to this puzzle was a straight forward substitution cipher where A = 0, B = 1, C = 2, etc.  The answer is Fibonacci Sequence.

Challenge Three

Code-breaking was practised in Roman times: Julius Caesar was known to use a code to securely send messages to his armies. This message uses a type of cipher named after the general to conceal its meaning. When you crack it you will find out where he kept his armies. 

X S K L V V O H H Y L H V

This is referring to a Caesar Cipher.  I simply used a Caesar Cipher decoder tool to help me to solve this one.  The key was 23 and the answer was UP HIS SLEEVIES.

Challenge Four

Now the puzzles get more tricky. This code does not use numbers and letters to hide what it says. Instead, it swaps those familiar characters for symbols. Once cracked, the following message reveals who famously made use of this type of enciphering and the name of the technique. Here is a hint: it requires a code that shares its name with a place where a smelly farm animal is kept.

This is a pigpen cipher.  I found this image via a Google search.  It was on cyt-prasanna.blogspot.com.  One you figure out the cipher, it's another substitution cipher-substituting symbols for letters.

The answer is "IN THE 18TH CENTURY, FREEMASONS USED PIG PEN CIPHERS TO KEEP THEIR PRIVATE RECORDS."

Challenge Five

This one is a real step up in difficulty. It can probably be done by trial and error, but it will be quicker to work out the rules governing the substitution and apply them. The key to cracking the message is elementary and you may find it easier to sit at a table rather than a desk to crack it.

Breaking the cipher will reveal a question. The solution is the answer to that question.

81, 1, 68, 59, 68, 86, 53, 76, 105, 53, 24, 22, 89, 5, 57, 68, 77, 50, 89, 81, 85, 4, 113, 71, 95, 86, 47, 44, 45, 33, 11, 64, 99, 12, 63, 10, 73, 8, 87, 52, 67, 68, 24, 72, 63, 25, 77, 6, 13, 3, 68, 57, 63, 101, 99, 60, 43, 14, 76, 88, 64, 47, 7, 53, 50, 99, 66, 76, 60, 22, 1, 99, 5, 47, 62, 53, 106, 8, 9, 81, 2, 68, 53, 75, 89, 52, 8, 25, 77, 27, 28, 113, 42, 4, 63, 75, 34, 63, 71, 63, 27, 52, 88, 76, 11, 17, 8, 11, 26, 77, 32, 113, 45, 13, 52, 77, 76, 11, 14, 13, 11, 66, 44, 63, 6, 115, 44, 37, 77, 7, 31, 6, 67, 63, 42, 77, 17, 13, 57, 84, 45, 8, 15, 63, 86, 43, 77, 68, 62, 74, 68, 23, 63, 92, 14, 68, 66, 53, 22, 52, 8, 24, 44, 68, 13, 81, 63, 18, 17, 53, 46, 72, 68, 44, 83, 39, 92, 62, 77, 28, 31, 52, 67, 63, 53, 28, 77, 43, 53, 13, 3, 3, 68, 65, 43, 63, 45, 34, 8, 26, 73, 67, 63, 68, 3, 63, 42, 68, 60, 65, 21, 4, 92, 73, 52, 74, 8, 57, 68, 65, 43, 63, 44, 38, 20, 13, 10, 52, 5, 63, 92, 50, 68, 66, 74, 67, 13, 81, 33, 75, 68, 81, 80, 63, 70?

The clue was given in the picture below this in the article.  They also state that you may want to do this at a table rather than a desk-they're referring to the periodic table.  The answer is that every number corresponds to an element on the periodic table.  Number 1 is Hydrogen, for instance.  So, you take the first letter of that element.  I wrote a program to solve it for me, in Java.  It's not the neatest program because I haven't programmed in a while.

public class PeriodicTableEncoding {

public static void main (String[] args) {

int[] encodedtext = {81, 1, 68, 59, 68, 86, 53, 76, 105, 53, 24, 22, 89, 5, 57, 68, 77, 50, 89, 81, 85, 4, 113, 71, 95, 86, 47, 44, 45, 33, 11, 64, 99, 12, 63, 10, 73, 8, 87, 52, 67, 68, 24, 72, 63, 25, 77, 6, 13, 3, 68, 57, 63, 101, 99, 60, 43, 14, 76, 88, 64, 47, 7, 53, 50, 99, 66, 76, 60, 22, 1, 99, 5, 47, 62, 53, 106, 8, 9, 81, 2, 68, 53, 75, 89, 52, 8, 25, 77, 27, 28, 113, 42, 4, 63, 75, 34, 63, 71, 63, 27, 52, 88, 76, 11, 17, 8, 11, 26, 77, 32, 113, 45, 13, 52, 77, 76, 11, 14, 13, 11, 66, 44, 63, 6, 115, 44, 37, 77, 7, 31, 6, 67, 63, 42, 77, 17, 13, 57, 84, 45, 8, 15, 63, 86, 43, 77, 68, 62, 74, 68, 23, 63, 92, 14, 68, 66, 53, 22, 52, 8, 24, 44, 68, 13, 81, 63, 18, 17, 53, 46, 72, 68, 44, 83, 39, 92, 62, 77, 28, 31, 52, 67, 63, 53, 28, 77, 43, 53, 13, 3, 3, 68, 65, 43, 63, 45, 34, 8, 26, 73, 67, 63, 68, 3, 63, 42, 68, 60, 65, 21, 4, 92, 73, 52, 74, 8, 57, 68, 65, 43, 63, 44, 38, 20, 13, 10, 52, 5, 63, 92, 50, 68, 66, 74, 67, 13, 81, 33, 75, 68, 81, 80, 63, 70};

String[] decodedtext = new String[246];

for (int x = 0; x < encodedtext.length; x++){

if (encodedtext[x] == 1)

decodedtext[x] = "H";

else if (encodedtext[x] == 2)

decodedtext[x] = "H";

else if (encodedtext[x] == 3)

decodedtext[x] = "L";

else if (encodedtext[x] == 4)

decodedtext[x] = "B";

else if (encodedtext[x] == 5)

decodedtext[x] = "B";

else if (encodedtext[x] == 6)

decodedtext[x] = "C";

else if (encodedtext[x] == 7)

decodedtext[x] = "N";

else if (encodedtext[x] == 8)

decodedtext[x] = "O";

else if (encodedtext[x] == 9)

decodedtext[x] = "F";

else if (encodedtext[x] == 10)

decodedtext[x] = "N";

else if (encodedtext[x] == 11)

decodedtext[x] = "N";

else if (encodedtext[x] == 12)

decodedtext[x] = "M";

else if (encodedtext[x] == 13)

decodedtext[x] = "A";

else if (encodedtext[x] == 14)

decodedtext[x] = "S";

else if (encodedtext[x] == 15)

decodedtext[x] = "P";

else if (encodedtext[x] == 16)

decodedtext[x] = "S";

else if (encodedtext[x] == 17)

decodedtext[x] = "C";

else if (encodedtext[x] == 18)

decodedtext[x] = "A";

else if (encodedtext[x] == 19)

decodedtext[x] = "K";

else if (encodedtext[x] == 20)

decodedtext[x] = "C";

else if (encodedtext[x] == 21)

decodedtext[x] = "S";

else if (encodedtext[x] == 22)

decodedtext[x] = "T";

else if (encodedtext[x] == 23)

decodedtext[x] = "V";

else if (encodedtext[x] == 24)

decodedtext[x] = "C";

else if (encodedtext[x] == 25)

decodedtext[x] = "M";

else if (encodedtext[x] == 26)

decodedtext[x] = "F";

else if (encodedtext[x] == 27)

decodedtext[x] = "C";

else if (encodedtext[x] == 28)

decodedtext[x] = "N";

else if (encodedtext[x] == 29)

decodedtext[x] = "C";

else if (encodedtext[x] == 30)

decodedtext[x] = "Z";

else if (encodedtext[x] == 31)

decodedtext[x] = "G";

else if (encodedtext[x] == 32)

decodedtext[x] = "G";

else if (encodedtext[x] == 33)

decodedtext[x] = "A";

else if (encodedtext[x] == 34)

decodedtext[x] = "S";

else if (encodedtext[x] == 35)

decodedtext[x] = "B";

else if (encodedtext[x] == 36)

decodedtext[x] = "K";

else if (encodedtext[x] == 37)

decodedtext[x] = "R";

else if (encodedtext[x] == 38)

decodedtext[x] = "S";

else if (encodedtext[x] == 39)

decodedtext[x] = "Y";

else if (encodedtext[x] == 40)

decodedtext[x] = "Z";

else if (encodedtext[x] == 41)

decodedtext[x] = "N";

else if (encodedtext[x] == 42)

decodedtext[x] = "M";

else if (encodedtext[x] == 43)

decodedtext[x] = "T";

else if (encodedtext[x] == 44)

decodedtext[x] = "R";

else if (encodedtext[x] == 45)

decodedtext[x] = "R";

else if (encodedtext[x] == 46)

decodedtext[x] = "P";

else if (encodedtext[x] == 47)

decodedtext[x] = "A";

else if (encodedtext[x] == 48)

decodedtext[x] = "C";

else if (encodedtext[x] == 49)

decodedtext[x] = "I";

else if (encodedtext[x] == 50)

decodedtext[x] = "S";

else if (encodedtext[x] == 51)

decodedtext[x] = "S";

else if (encodedtext[x] == 52)

decodedtext[x] = "T";

else if (encodedtext[x] == 53)

decodedtext[x] = "I";

else if (encodedtext[x] == 54)

decodedtext[x] = "X";

else if (encodedtext[x] == 55)

decodedtext[x] = "C";

else if (encodedtext[x] == 56)

decodedtext[x] = "B";

else if (encodedtext[x] == 57)

decodedtext[x] = "L";

else if (encodedtext[x] == 58)

decodedtext[x] = "C";

else if (encodedtext[x] == 59)

decodedtext[x] = "P";

else if (encodedtext[x] == 60)

decodedtext[x] = "N";

else if (encodedtext[x] == 61)

decodedtext[x] = "P";

else if (encodedtext[x] == 62)

decodedtext[x] = "S";

else if (encodedtext[x] == 63)

decodedtext[x] = "E";

else if (encodedtext[x] == 64)

decodedtext[x] = "G";

else if (encodedtext[x] == 65)

decodedtext[x] = "T";

else if (encodedtext[x] == 66)

decodedtext[x] = "D";

else if (encodedtext[x] == 67)

decodedtext[x] = "H";

else if (encodedtext[x] == 68)

decodedtext[x] = "E";

else if (encodedtext[x] == 69)

decodedtext[x] = "T";

else if (encodedtext[x] == 70)

decodedtext[x] = "Y";

else if (encodedtext[x] == 71)

decodedtext[x] = "L";

else if (encodedtext[x] == 72)

decodedtext[x] = "H";

else if (encodedtext[x] == 73)

decodedtext[x] = "T";

else if (encodedtext[x] == 74)

decodedtext[x] = "W";

else if (encodedtext[x] == 75)

decodedtext[x] = "R";

else if (encodedtext[x] == 76)

decodedtext[x] = "O";

else if (encodedtext[x] == 77)

decodedtext[x] = "I";

else if (encodedtext[x] == 78)

decodedtext[x] = "P";

else if (encodedtext[x] == 79)

decodedtext[x] = "A";

else if (encodedtext[x] == 80)

decodedtext[x] = "H";

else if (encodedtext[x] == 81)

decodedtext[x] = "T";

else if (encodedtext[x] == 82)

decodedtext[x] = "P";

else if (encodedtext[x] == 83)

decodedtext[x] = "B";

else if (encodedtext[x] == 84)

decodedtext[x] = "P";

else if (encodedtext[x] == 85)

decodedtext[x] = "A";

else if (encodedtext[x] == 86)

decodedtext[x] = "R";

else if (encodedtext[x] == 87)

decodedtext[x] = "F";

else if (encodedtext[x] == 88)

decodedtext[x] = "R";

else if (encodedtext[x] == 89)

decodedtext[x] = "A";

else if (encodedtext[x] == 90)

decodedtext[x] = "T";

else if (encodedtext[x] == 91)

decodedtext[x] = "P";

else if (encodedtext[x] == 92)

decodedtext[x] = "U";

else if (encodedtext[x] == 93)

decodedtext[x] = "N";

else if (encodedtext[x] == 94)

decodedtext[x] = "P";

else if (encodedtext[x] == 95)

decodedtext[x] = "A";

else if (encodedtext[x] == 96)

decodedtext[x] = "C";

else if (encodedtext[x] == 97)

decodedtext[x] = "B";

else if (encodedtext[x] == 98)

decodedtext[x] = "C";

else if (encodedtext[x] == 99)

decodedtext[x] = "E";

else if (encodedtext[x] == 100)

decodedtext[x] = "F";

else if (encodedtext[x] == 101)

decodedtext[x] = "M";

else if (encodedtext[x] == 102)

decodedtext[x] = "N";

else if (encodedtext[x] == 103)

decodedtext[x] = "L";

else if (encodedtext[x] == 104)

decodedtext[x] = "R";

else if (encodedtext[x] == 105)

decodedtext[x] = "D";

else if (encodedtext[x] == 106)

decodedtext[x] = "S";

else if (encodedtext[x] == 107)

decodedtext[x] = "B";

else if (encodedtext[x] == 108)

decodedtext[x] = "H";

else if (encodedtext[x] == 109)

decodedtext[x] = "M";

else if (encodedtext[x] == 110)

decodedtext[x] = "D";

else if (encodedtext[x] == 111)

decodedtext[x] = "R";

else if (encodedtext[x] == 112)

decodedtext[x] = "C";

else if (encodedtext[x] == 113)

decodedtext[x] = "U";

else if (encodedtext[x] == 114)

decodedtext[x] = "F";

else if (encodedtext[x] == 115)

decodedtext[x] = "U";

else if (encodedtext[x] == 116)

decodedtext[x] = "L";

else if (encodedtext[x] == 117)

decodedtext[x] = "U";

else if (encodedtext[x] == 118)

decodedtext[x] = "U";

else

decodedtext[x] = "Error";

}

for (int i = 0; i < decodedtext.length; i++){

System.out.println(decodedtext[i]);

}

}

}

The answer is THE PERIODIC TABLE IS A TABULAR ARRANGEMENT OF THE CHEMICAL ELEMENTS ORGANIZED ON THE BASIS OF THEIR ATOMIC NUMBERS, ELECTRON CONFIGURATIONS, AND RECURRING CHEMICAL PROPERTIES.  WE'VE USED IT TO CREATE A CIPHER BY USING THE INITIAL LETTERS OF THE ELEMENTS, BUT TWO LETTERS CAN'T BE USED.  WHAT ARE THEY?

The answer is J and Q, the only two letters of the alphabet that are not initial letters on the periodic table.

Challenge Six

Good work if you have got this far. This final challenging set of puzzles has three parts; when each one is completed it will reveal a quote from a well-known work of literature, whose author loved intellectual games of all kinds. Can you find all three? 

Bear in mind while you are working on these that each puzzle is not necessarily just a cipher - there are some computer science basics mixed in. Each one is designed to be solved independently so if one of the puzzles defeats you then move on. Here's one final clue: Alice fell down a rabbit hole and left clues so Bob could find her...

I've only solved the first part of this one so far.

Puzzle Number One is hex encoded.  Decoding the hex, you get a weird phrase.

"Jr'er nyy znq urer. V'z znq. Lbh'er znq." "Ubj qb lbh xacj V'z znq?" fnvq Nyvpr. "Lbh zhfg or," fnvq gur Png, "be lbh jbhyqa'g unir pbzr urer."

This looks like it could be English text, given the apostrophes could be contractions.  I've seen similar text in rotation ciphers, like rot13.  This one just happens to be a rot13 cipher.  I used a rot13 tool to solve this puzzle.

The answer is "WE'RE ALL MAD HERE.  I'M MAD. YOU'RE MAD." HOW DO YOU KNOW I'M MAD? SAID ALICE.  "YOU MUST BE," SAID THE CAT, "OR YOU WOULDN'T HAVE COME HERE."

Update:

Challenge 6 Part 2:

I think that this may be a VIC cipher/Straddling Checkerboard Cipher.  I haven't been able to decipher it yet.  I have to figure out the key and which numerals are left empty.  I found the image below here:  I'm not sure if the link is safe or not, so don't click on the link.  I used a LiveCD VM to find it.  http://crypto.interactive-maths.com/uploads/1/1/3/4/11345755/777166.jpg&imgrefurl=http://crypto.interactive-maths.com/straddling-checkerboard.html&h=88&w=226&tbnid=0btk2h9aeOLT2M:&docid=gSXf53kT4ebHNM&ei=Zub6VpntGYO5Ubr8pOgL&tbm=isch&ved=0ahUKEwiZuIHx3ubLAhWDXBQKHTo-Cb0QMwgfKAIwAg

Usually the key is estoniar, which are the most commonly used letters.  Sometimes, it's different though.  Two of the numerals in the top part of the cipher need to be left blank.  They are the numerals used on the left.  Those numerals on the left hand side signify that those letters are represented by two digits instead of one digit.  So, E would be represented by 0 in this case, F would be represented by 10, and M would be represented by 70.  The letters on the 3rd and 4th rows are the characters that were not used in the second row.  They can be placed in order, or jumbled up.  Note, that some positions need to be left blank or have some form of punctuation in them.

This can be used alone or along with another step to make the cipher more difficult to break.

When I use the numerals 0, 8 as blank, and order the letters, estoniarbcdfghjkmpquvwxyz, part of it is deciphered to "I see one star".  Maybe that is just a happy accident though?  The rest looks jumbled.  Not really sure what all the rules are with this cipher.  I'll do more research.

Challenge 6 Part 3:

I was overthinking 6:3.  I was looking for ciphers that involved bishops.  Andrew Welham kindly told me in the comments that Challenge 6 Part 3 was Morse Code.

I tried his solution, and he was correct.  Thank you.

I used dashes for the white bishops and dots for the black bishops.  So I got:

--- ..-. ..-. .-- .. - .... - .... . .. .-. .... . .- -.. ... which translates to "OFF WITH THEIR HEADS"

SANS@Night

I got home from Orlando the day before yesterday.  My spouse went to training.  He took the children and I along to Orlando so that we could have kind of a vacation.  I say "kind of" because anyone who has been on vacation with children knows that it is still 24/7 watching the children.  Magnify that times 100 at the parks because they want to do everything.  They got me onto a couple of roller coasters-they were the baby roller coasters, but anyone who knows me knows that I am not a fan of rollercoasters.  My middle child takes after me; he doesn't like the roller coasters either.

Someone arranged for me to get a SANS Guest badge.  I attended a SANS@Night.  I wish that I had more opportunities to attend the SANS@Night talks.  My spouse was in a bootcamp style course, so he didn't get out until most of the SANS@Night talks were over.  Someone, AKA, me had to watch the children.

I absolutely loved the SANS@Night talk that I attended.  It was "Malware Analysis for Incident Responders:  Getting Started" by Lenny Zeltser.  I never thought of reverse malware engineering as being in the realm of possibilities for myself as far as career aspirations.  I thought that I needed extensive programming skills as well as knowledge of assembly.  Turns out, that isn't so.  I can explore malware with less knowledge than I thought.  Don't get me wrong, I still want to learn as much as I can.  I want to know how things work.  I just realize that I shouldn't be intimidated, and I should just try and see what I can do.  I plan on firing up Remnux and looking at some of the resources that I was given in the SANS@Night talk.

Currently, I'm still doing the Linux Foundation Training.  I'm looking at the evidence for the Black T-Shirt challenge.  I don't actually plan on submitting anything for it.  I just find that it's good practice.  I used ewfmount to mount the E01 files that were given in the challenge.  It's pretty neat that I can see everything on that drive and use tools like bulk extractor to automatically get information off of the disk for me.  I'm trying to see if I can use Volatility on one the images now that I have it mounted.  Not sure if that is possible.  I'm going to keep researching about it.

Hacks4Pancake Blog/My Learning Goal

I regularly read Twitter posts of industry experts.  Lesley Carhart (hacks4pancakes) posted about how she found your "secret" dating profile.  I read that article.  I saw some older posts on her site about how to start in the information security field.  I suggest that anyone wanting to get into information security check out her blog.

http://tisiphone.net/2015/10/12/starting-an-infosec-career-the-megamix-chapters-1-3/
http://tisiphone.net/2015/11/08/starting-an-infosec-career-the-megamix-chapters-4-5/
http://tisiphone.net/2016/02/10/starting-an-infosec-career-the-megamix-chapter-6/

I've decided to devote at least an hour a day to learning.  I figure an hour a day adds up over time.  In a year, that's 365 hours, and it doesn't seem to cut any time with the family, and work-time.

I'm still working through the Linux training.  I'm a hands-on type learner, meaning that if I do enough labs, I can usually remember what to do.

I'm also doing C# training off of the Channel9 website.  Bob Tabor has a series of videos about using C# in Visual Studio.  It's much easier than my C course.  We didn't use Visual Studio.  My instructor made us hand write programs for our assignments and exams.  She wanted to be absolutely certain that we learned how to do the programs.  I will never forget a semi-colon.  I won't forget documentation, either.  Here's the website in case anyone else is interested in learning C#.  If you've already learned a language or two, this may be too easy for you.  Since it's been a while for me, I think it best that I start from the beginning.

https://channel9.msdn.com/Series/C-Sharp-Fundamentals-Development-for-Absolute-Beginners

Apple V FBI

I've been reading articles regarding the dispute between Apple and the FBI regarding the FBI trying to force Apple to create an operating system to undermine the security of Apple's devices so that the FBI can acquire evidence in cases.

I stand with Apple.  The reason that I stand with Apple is because the constitution of the United States was made to protect businesses from this sort of government interference.  If the government has their way, and is allowed to force one company to create something, no matter how well-meaning their intentions are, it sets a precedent for them to use to require companies to create the same thing, or even other things.  This is a government overreach.  I'm in favor of a government that has just enough power-not too much, and not too little.

This also affects Apple's market share.  The government directly influences whether or not a business succeeds or fails.  I know, that I personally, would take issue using a device if I knew that it was extremely easy to to be hacked.  One of the reasons that I chose my current device was directly because of its security.  I can't imagine that I'm the only one who feels this way.  What about other countries who use Apple for the very reason that it's secure?  Apple has to say good bye to those contracts.

Aside from the political reasons;  from what I understand, the devices used in the government right now, for government communications are Blackberries.  I would think that they'd want the best encrypted devices, which isn't difficult to argue, is probably iOS devices.  So what if Apple makes an OS capable of taking that encryption down?  Then you have a device that it useless considering its intended design is to be secure.  All of those government officials who use any Apple device are vulnerable to attack.  All it takes is for one person, whether inside Apple, or out, to exfiltrate that OS. Then government officials and private citizens alike are vulnerable.  I can see headlines of officials resigning because someone got information that they shouldn't have even been able to access.

Security Researcher Gets Accused of Being a Hacker

I read some articles yesterday that detailed a dispute between a company and a security researcher.  The company claims that the security researcher hacked into their database.  The security researcher claims to be a white hat hacker-i.e. a person who hacks for good.  I'm attaching links below that describe the dispute.  I do not claim that any sites are secure/insecure, so instead of clicking on links, I suggest that you use your favorite search engine and look for them. 

http://www.zdnet.com/article/uknowkids-child-tracker-firm-in-row-with-security-researcher/
http://www.theregister.co.uk/2016/02/24/child_tracker_firm_uknowkids_admits_breach/
https://threatpost.com/uknowkids-goes-on-attack-after-database-of-1700-kids-found-insecure/116427/

I've seen blog postings in support of the security researcher.  I don't personally know the security researcher.  I don't know if he was specifically hired to do a pen test-I don't think so, considering the organization's response to him tampering with their database.  I don't know if the organization's allegations of him refusing to delete documents are true.  My opinions are based on the information that I have at hand-which isn't a lot.

I think that both parties are at fault.

The organization is at fault because they disclosed the name of the individual before having any real proof that he tampered with their database.  They used IP Addresses to "prove" who he is.  IP Addresses can be spoofed.  I understand needing to warn your customers of the breach, but there is a proper way to handle it.  I don't know law, but I think that this may potentially open them up to a libel case depending on the laws of their government, state, and local government.  The security researcher could potentially lose his job and prove the damage that they caused him if he is innocent.

The security researcher was at fault because he could've only gone so far as to prove a vulnerability.  He did not need to copy parts of their database.  I don't know much about law, but I do remember reading SANS articles stating that laws could apply in the case of retrieving information from companies that you pen-test-laws like HIPAA.  HIPAA law probably don't apply in this case, but it makes me wonder what laws could apply in this case as far as protecting information? The security researcher, in the act of retrieving this information, may have made himself responsible for protecting the information depending on the laws of his government, state, or local government. 

Depending on his reasoning for hacking into the database, he may have also put his job at risk.  The 2nd IP is presumably the IP Address of his employer.  He's potentially causing them legal issues because company resources were used in his discovery of the organization's vulnerability.

In my opinion, the security researcher isn't a white hat hacker as he claims.  He's a grey hat.  The one thing that is important in this case is permission, and from what I understand, he didn't have permission.  He will be lucky if a civil or criminal case doesn't come out of this.  He did break laws.

I understand that security researchers have it difficult.  Many of them want to help people, and they risk getting in trouble for it.  I appreciate their desire to make people more safe by disclosing vulnerabilities to companies, but there is a correct way to do it.

Easy Solution to Kids That Have Trouble Typing Addresses

I made a custom homepage for my kids using html and images that I had gathered from their favorite websites a while back.  My daughter was too young to know how to spell things, but she wanted to play games on websites any time I let her.  Unfortunately, she wanted to be independent as well, which meant that she wanted to type the websites herself.  She didn't know how to spell most of them.  So, to save my sanity, I made a folder and put images of her favorite websites in it.  Then I created a homepage with the images in it.  Each image was a hotspot to one of her favorite websites.  She had no trouble navigating to her favorite websites.  The only issue:  I have each page opening in a new tab, which means that I can have quite a bit of music going at once.  She can close pages, but chooses not to close the pages most of the time. 

You don't need to know a lot of html or css to create a custom homepage.  Simply typing the syntax below into a Notepad document, and saving it as an html files works. (Make sure to change the "Save as Type" elevator button that usually has ".txt" to "All Files", then type in "desiredfilename.html" in the "File name" textbox.  I suggest creating a folder in your Documents folder called "KidHomePage" and putting all of the files in there.  Save the html file as "KidHomePage.html".  In Notepad, type the example below. Replace the purple part with your desired website address.  Replace the red part with the name that you saved your desired logo.  Replace the green part with the name of the Website in case the logo doesn't load for some reason.  Your kids may not be able to read it, but it's good practice.  They might surprise you and know what is supposed to go there.  If you add the logos one after another, they will appear next to each other.  If you want them on separate lines, add a <br> tag at the end, after the "</a>" tag.

<html>
<body>
<a href="http://www.example.com" target="_blank"><img src="example_img.jpg" height="50" weight="50" alt="Example Website"</a>
<a href="http://www.example.com2" target="_blank"><img src="example_img2.jpg" height="50" weight="50" alt="Example Website2"</a>
</body>
</html>

If you want to change your homepage to point to this custom made homepage, you'll have to configure your browser to do so.  In Edge, you click on the ... menu on the top right hand side of the screen.  Then you select settings from the drop down menu.  Under "Open With", Click the radio button next to "A specific page or pages".  Then you type in the path of your file in the "Enter a web address text box", then press enter.  To point to files on your local file with your browser, in Windows, you have to prepend the path with file:///.  Most of the time the path is something like "file:///C:/Users/Username/Documents/KidHomePage/KidHomePage.html"  (It's wherever you saved it when you created the file.  Make certain that the file is in the same folder as the logos, or the logo images won't load.)

Linux Foundation Training

I'm finding myself seemingly short of time of late.  I'm now employed.  My job isn't extremely time-consuming, but I do have the family life and wanting to learn.  I have to find a balance in those activities.

I purchased a Linux Foundation Training Course a few months ago as kind of a Christmas present to myself.  They had Black Friday pricing on this particular course.  I had no idea that training could have Black Friday pricing.  I can see why now because some posters claim that the training and certification that I'm doing are considered "trivial".  It's a start though.  As part of the pricing they sent me a Linux Foundation Certified Systems Administrator penguin t-shirt.  I hope to earn that title.

The course has a prerequisite course.  Fortunately the prerequisite is free.  The only problem that I have with the prerequisite is that it is so easy.  I'm almost tempted to skip it, but I'm afraid to because as I've said before, learning the basics is important.  I know everything that I've seen in the course so far.  Hopefully there will be some interesting thing that I have not learned, yet.

I did have a bit of a hiccup getting the paid Linux Foundation course to work.  The customer service was decent.  They were having technical difficulties across the board the exact day that I decided to try the course.  They had it fixed overnight though.  So far, I'd recommend the training to anyone interested in learning about Linux.