Saturday, August 22, 2015

Cracking a Combination Lock, Some Counter-Stealth Thoughts, and More Apple Information

Someone was recently trying to sell a safe but they didn't have the combination (they had proof of ownership if you're wondering). Anybody who has been faced with this situation is often torn because sometimes the item in question is valuable but the safe can be of comparable value so it's a lose lose situation. If you remember that the original combination then all is fine and well (I first encountered this situation in a hotel when I locked something but forgot the combination. It took me an agonising amount of time to recall the unlock code). If not, you're left with physical destruction of the safe to get back in, etc...

Tips on getting back in:
- did you use mneumonics of some sort to get at the combination?
- is there a limitation on the string that can be entered (any side intelligence is useful)?
- is there a time lock involved?
- does changing particular variables make it easier to get back in non-descructively?
- keep a log on the combinations that you have tried to ensure you don't re-cover the same territory

In this case, things were a bit odd. It had rubber buttons which when removed exposed membrane type switches which could be interfaced via an environmental sensor acquisition and interface device (something like an Arduino)(if you're curious this was designed and produced by a well known international security firm proving that brand doesn't always equate to quality). Once you program it and wire things up correctly, it's simply a case of letting your robot and program run until you open the safe. Another option is a more robust robot where it pushes buttons but obviously this takes quite a bit more hardware (which can make the project pretty expensive and potentially unworthwhile) to get working.
http://techcrunch.com/2015/05/14/this-robot-cracks-open-combination-locks-in-seconds/

As I covered in my book on 'Cloud and Internet Security' please use proper locks with adequate countemeasures (time locks, variable string lengths, abnormal characters, shim proof, relatively unbreakable, etc...) and have a backup in case something goes wrong.
https://play.google.com/store/books/author?id=Binh+Nguyen
http://www.amazon.com/mn/search/?_encoding=UTF8&camp=1789&creative=390957&field-author=Binh%20Nguyen&linkCode=ur2&search-alias=digital-text&sort=relevancerank&tag=bnsb-20&linkId=3BWQJUK2RCDNUGFY

Been thinking about stealth design and counter measures a bit more.

- when you look at the the 2D thrust vectoring configuration of the F-22 Raptor you think why didn't they go 3D at times. One possible reason may be the 'letterbox effect'. It was designed as an air superiority fighter predominantly that relies heavily on BVR capabilities. From front on the plume effect is diminished (think about particle/energy weapon implementation problems) making it more difficult to detect. Obviously, this potentially reduces sideward movement (paricularly in comparison with 3D TVT options. Pure turn is more difficult but combined bank and turn isn't). Obvious tactic is to force the F-22 into sideward movements if it is ever on your tail (unlikely, due to apparently better sensor technology though)
- the above is a null point if you factor in variable thrust (one engine fires at a higher rate of thrust relative to the other) but it may result in feedback issues. People who have experience with fly by wire systems or high performance race cars which are undertuned will better understand this
- people keep on harping on about how 5th gen fighters can rely more heavily on BVR capabilities. Something which is often little spoken of is the relatively low performance of AAM (Air to Air Missile) systems (Morever, there is a difference between seeing, achieving RADAR lock, and achieving a kill). There must be upgrades along the way/in the pipeline to make 5th gen fighters a viable/economic option into the future
- the fact that several allied nations (Japan, Korea, and Turkey are among them currently)(India, Indonesia, and Russia are among those who are developing their own based on non-Western design) are developing their own indiginous 5th gen fighters which have characteristics more similar to the F-22 Raptor (the notable exception may be Israel who are maintaining and upgrading their F-15 fleet) and have air superiority in mind tells us that the F-35 is a much poorer brother to the F-22 Raptor in spite of what is being publicly said
https://www.rt.com/usa/312220-f-35-flying-saucer-tech/
http://www.news1130.com/2015/08/12/f-35-might-not-meet-performance-standards-of-cf-18s-says-u-s-think-tank/
http://www.defensenews.com/story/defense/air-space/strike/2015/08/10/turkey-upgrade-f-16-block-30-aircraft/31408875/
https://en.wikipedia.org/wiki/Mitsubishi_ATD-X
http://www.businessinsider.in/Indo-Russian-5th-Generation-Fighter-Aircraft-program-Delays-and-the-possible-outcomes/articleshow/47655536.cms
http://www.defenseone.com/technology/2015/02/heres-what-youll-find-fighter-jet-2030/104736/
https://en.wikipedia.org/wiki/Fifth-generation_jet_fighter
https://en.wikipedia.org/wiki/TAI_TFX
https://en.wikipedia.org/wiki/KAI_KF-X
http://www.defenseindustrydaily.com/kf-x-paper-pushing-or-peer-fighter-program-010647/
Warplanes: No Tears For The T-50
https://www.strategypage.com/htmw/htairfo/articles/20150421.aspx
- it's clear that the US and several allied nations believe that current stealth may have limited utility in the future. In fact, the Israeli's have said that within 5-10 years the JSF may lost any significant advantage that it currently has without upgrades
- everyone knows of the limited utility of AAM (Air to Air Missile) systems. It will be interesting to see whether particle/energy weapons are retrofitted to the JSF or whether they will be reserved entirely for 6th gen fighters. I'd be curious to know how much progress they've made with regards to this particularly with regards to energy consumption
- even if there have been/are intelligence breaches in the design of new fighter jets there's still the problem of production. The Soviets basically had the complete blue prints for NASA's Space Shuttle but ultimately decided against using it on a regular basis/producing more because like the Americans they discovered that it was extremely uneconomical. For a long time, the Soviets have trailed the West with regards to semiconductor technology which means that their sensor technology may not have caught up. This mightn't be the case with the Chinese. Ironically, should the Chinese fund the Russians and they work together they may achieve greater progress then working too independently
http://www.abc.net.au/news/2015-08-18/former-spy-molly-sasson-says-soviet-mole-infiltrated-asio/6704096
https://en.wikipedia.org/wiki/Buran_(spacecraft)
- some of the passive IRST systems out have current ranges of about 100-150km mark (that is publicly acknowledged)
http://www.washingtonexaminer.com/the-price-of-stealth/article/2570647
http://aviationweek.com/technology/new-radars-irst-strengthen-stealth-detection-claims
https://en.wikipedia.org/wiki/Stealth_aircraft
http://thediplomat.com/2014/10/how-effective-is-chinas-new-anti-stealth-radar-system-really/
http://www.wired.co.uk/news/archive/2012-10/01/radar-detects-stealth-aircraft
https://en.wikipedia.org/wiki/Radar
http://www.migflug.com/jetflights/p-i-r-a-t-e-versus-raptor.html
http://nationalinterest.org/blog/the-buzz/are-us-fighter-jets-about-become-obsolete-12612
http://nationalinterest.org/feature/are-submarines-about-become-obsolete-12253
http://theminiaturespage.com/boards/msg.mv?id=374487
http://www.navytimes.com/story/military/tech/2015/02/09/greenert-questions-stealth-future/22949703/
http://watchingamerica.com/WA/2015/03/23/the-us-navy-has-already-stopped-believing-in-the-jsf/
- disoriention of gyroscopes has been used as a strategy against UCAV/UAVs. I'd be curious about how such technology would work against modern fighters which often go into failsafe mode (nobody wants to lose a fighter jet worth 8 or more figures. Hence, the technology) when the pilot blacks out... The other interesting thing would be how on field technologies such as temporal sensory deprivation (blinding, deafening, dis-orirentation, etc...) could be used in unison from longer range. All technologies which have been tested and used against ground based troops before)
http://defensesystems.com/articles/2015/08/10/kaist-researchers-take-out-drones-with-sound.aspx
https://en.wikipedia.org/wiki/Brown_note
- I've been thinking/theorising about some light based detection technologies to aircraft in general. One option I've been considering is somewhat like a sperical ball. The spherical ball is composed of lenses which focus in on a centre which is composed of sensors which would be a hybrid based technology based on the photoelectric effect and spectrascopic theory. The light would automatically trigger a voltage (much like a solar cell) while use of diffraction/spectrascopic theory would enable identification of aircraft from long range using light. The theory behind this is based on the way engine plumes work and the way jet fuels differ. Think about this carefully. Russian rocket fuel is very different from Western rocket fuel. I suspect it's much the same for jet fuel. We currently identify star/planet composition on roughly the same theory. Why not fighter aircraft? Moreover, there are other distinguishing aspects of the jet fighter nozzle exhausts (see my previous post and the section on LOAN systems, http://dtbnguyen.blogspot.com/2015/07/joint-strike-fighter-f-35-notes.html). Think about the length and shape of each one based on their current flight mode (full afterburner, cruising, etc...) and the way most engine exhausts are unique (due to a number of different reasons including engine design, fuel, etc...). Clearly, the F-22, F-35, B-2, and other stealth have very unique nozzle shapes when compared to current 4th gen fighter options and among one another. The other thing is that given sufficient research (and I suspect a lot of time) I believe that the benefits of night or day flight will/could be largely mitigated. Think about the way in which light and camera filters (and night vision) work. They basically screen out based on frequency/wavelength to make things more visible. You should be able achieve the same thing during daylight. The other bonus of such technology is that it is entirely passive giving the advantage back to the party in defense and intelligence is relatively easy to collect. Just show up at a demonstration or near an airfield...
https://en.wikipedia.org/wiki/Jet_fuel
http://foxtrotalpha.jalopnik.com/so-what-were-those-secret-flying-wing-aircraft-spotted-1555124270
http://www.globalsecurity.org/military/world/stealth-aircraft-vulnerabilities-contrails.htm
https://en.wikipedia.org/wiki/Electro-optical_sensor
https://en.wikipedia.org/wiki/Optical_spectrometer
https://en.wikipedia.org/wiki/AN/AAQ-37 
- such technology may be a moot point as we have already made progress on cloaking (effectively invisible to the naked eye) technology (though exact details are classified as is a lot of other details regarding particle/energy weapons and shielding technologies)... There's also the problem of straight lines. For practical purposes, light travels in straight lines... OTH type capabilities are beyond such technology (for the time being. Who knows what will happen in the future?)
- someone may contest that I seem to be focusing in on exhaust only but as as you aware this style of detection should also work against standard objects as well (though it's practicallity would be somewhat limited). Just like RADAR though you give up on being able to power through weather and other physical anomalies because you can't use a conventional LASER. For me, this represents a balance between being detected from an attackers perspective and being able to track them from afar... If you've ever been involved in a security/bug sweep you will know that a LASER even of modest power can be seen from quite a distance away
- everybody knows how dependent allied forces are upon integrated systems (sensors, re-fuelling, etc...)
- never fly straight and level against a 5th gen fighter. Weave up and down and side to side even on patrols to maximise the chances of detection earlier in the game because all of them don't have genuine all aspect stealth
- I've been thinking of other ways of defending against low observability aircraft. The first is based on 'loitering' weapons. Namely, weapons which move at low velocity/loiter until they come within targeting range of aicraft. Then they 'activate' and chase their target much like a 'moving mine' (a technology often seen in cartoons?). Another is essentially turning off all of your sensors once they become within targeting range. Once they end up in passive detection range, then you fire in massive, independent volleys knowing full well that low observability aircraft have low payload capability owing to comprimises in their design
- as stated previously, I very much doubt that the JSF is as bad some people are portraying
http://sputniknews.com/military/20150816/1025815446.html
http://news.usni.org/2015/08/13/davis-f-35b-external-weapons-give-marines-4th-5th-generation-capabilities-in-one-plane
- it's clear that defense has become more integrated with economics now by virtue of the fact that most of our current defense theory is based on the notion of deterrence. I beleive that the only true way forward is reform of the United Nations, increased use of un-manned technologies, and perhaps people coming to terms with their circumstances more differently (unlikely given how long humanity has been around), etc... There is a strong possibility that the defense estabilshment's belief that future defense programs could be unaffordable could become true within the context of deterence and our need to want to control affairs around the word. We need cheaper options with the ability to 'push up' when required...
http://www.thephora.net/forum/showthread.php?t=79496
http://breakingdefense.com/2014/04/f-35s-stealth-ew-not-enough-so-jsf-and-navy-need-growlers-boeing-says-50-100-more/
http://theaviationist.com/2013/06/17/su-35-le-bourget/
http://staugustine.com/news/2015-08-18/pentagon-plans-increase-drone-flights-50-percent

All of this is a moot point though because genuine 5th gen fighters should be able to see you from a mile off and most countries who have entered into the stealth technology arena are struggling to build 5th gen options (including Russia who have a long history in defense research and manufacturing). For the most part, they're opting for a combination of direct confrontation and damage limitation through reduction of defensive projection capability through long range weapons such as aicraft carrier destroying missiles, targeting of AWACS/refuelling systems, etc... and like for like battle options...
http://www.businessinsider.com/all-the-weapons-russias-sukhoi-t-50-fighter-jet-is-designed-to-carry-in-one-infographic-2015-8?IR=T
http://www.onislam.net/english/health-and-science/special-coverage/492459-muslim-sibirs-stealth-sukhoi-pak-fa-infographs.html

I've been working on more Apple based technolgy of late (I've been curious about the software development side for a while). It's been intriguing taking a closer look at their hardware. Most people I've come across have been impressed by the Apple ecosystem. To be honest, the more I look at the technology borne from this company the more 'generic' them seem. Much of the technology is simply repackaged but in a better way. They've had more than their fair share of problems.

How to identify MacBook models
https://support.apple.com/en-au/HT201608
How to identify MacBook Pro models
https://support.apple.com/en-us/HT201300

A whole heap of companies including graphic card, game console, and computer manufacturers were caught out with BGA implementation problems (basically, people tried to save money by reducing the quality of solder. These problems have largely been fixed much like the earlier capacitor saga). Apple weren't immune
https://www.ifixit.com/Guide/Yellow+Light+of+Death+Repair/3654
https://www.ifixit.com/Store/Game-Console/PlayStation-3-Yellow-Light-of-Death-YLOD-Fix-Kit/IF213-028-1
http://www.gamefaqs.com/ps3/927750-playstation-3/answers/66227-any-solutions-on-fixing-ylod-yellow-light-of-death

Lines on a screen of an Apple iMac. Can be due to software settings, firmware, or hardware
https://discussions.apple.com/thread/5625161
https://discussions.apple.com/thread/6604981
https://www.ifixit.com/Answers/View/172653/How+to+fix+%22vertical+lines%22+on+my+iMac+27+late+2009
https://www.ifixit.com/Answers/View/349/Vertical+lines+appearing+on+display

Apparently, Macbooks get noisy headjacks from time to time. Can be due to software settings or hardware failure
http://hints.macworld.com/article.php?story=20090729165848939
https://discussions.apple.com/thread/5516994
https://discussions.apple.com/thread/3853844
http://apple.stackexchange.com/questions/8039/how-can-i-make-my-macbook-pros-headphone-jack-stop-humming

One of the strangest things I've found is that in spite of a core failure of primary storage device people still try to sell hardware for almost what the current market value of a perfectly functional machine is. Some people still go for it but I'm guessing they have spare hardware lying around
https://discussions.apple.com/thread/5565827
https://discussions.apple.com/thread/6151526
http://apple.stackexchange.com/questions/158092/a-bad-shutdown-resulting-in-a-flashing-folder-with-question-mark

There are some interesting aspects to their MagSafe power adapters. Some aspects are similar to authentication protocols used by manufacturers such as HP to ensure that that everthing is safe and that only original OEM equipment is used. Something tells me they don't do enough testing though. They seem to have a continuous stream of anomalous problems. It could be similar to the Microsoft Windows security problem though. Do you want an OS delivered in a timely fashion or one that is deprecated but secure at a later date (delivered in a lecture by a Microsoft spokesman a while back). You can't predict everything that happens when things move into mass scale production but I would have thought that the 'torquing' problem would have been obvious from a consumer engineering/design perspective from the outset...
https://en.wikipedia.org/wiki/MagSafe
http://www.righto.com/2013/06/teardown-and-exploration-of-magsafe.html
https://www.ifixit.com/Answers/View/34477/Correct+wiring+of+MagSafe+power+adapter
http://www.instructables.com/id/MacBook-Mag-Safe-Charger-Budget-Repair-Disas/step2/Disassembly-of-Power-Brick-Brute-Force-Attack/
http://apple.stackexchange.com/questions/111617/using-85w-magsafe-inplace-of-60w-magsafe-2-for-mbp-retina-13
https://www.ifixit.com/Answers/View/1855/Definitive+answer+on+using+60w+or+85w+power+adapter+with+Macbook+Air

Upgrading Apple laptop hard drives is similar in complexity to that of PC based laptops
http://www.extremetech.com/computing/58220-upgrade-your-macbook-pros-hard-drive-2
http://www.macinstruct.com/node/130

One thing has to be said of Apple hardware construction. It's radically different to that of PC based systems. I'd rather deal with a business class laptop that is designed to be upgraded and probably exhibits greater reliability to be honest. Opening a lot of their devices has told me that form takes too much in the ratio between form and function
https://www.ifixit.com/Guide/MacBook+Core+2+Duo+Upper+Case+Replacement/515
https://www.ifixit.com/Guide/MacBook+Core+2+Duo+Logic+Board+Replacement/528
https://www.ifixit.com/Guide/MacBook+Pro+15-Inch+Unibody+Late+2011+Logic+Board+Replacement/7518

One frustrating aspect of the Apple ecosystem is that they gradually phase out support of old hardware by inserting pre-requisite checking. Thankfully, as others (and I) have discovered bypassing some of their checks can be trivial at times
https://en.wikipedia.org/wiki/OS_X
http://ask.metafilter.com/276359/How-to-best-upgrade-my-2006-MacBook-Pro
http://osxdaily.com/2011/04/08/hack-mac-os-x-lion-for-core-duo-core-solo-mac/
https://www.thinkclassic.org/viewtopic.php?id=425
http://www.macbreaker.com/2013/06/how-to-install-os-x-109-mavericks-dp1.html
http://apple.stackexchange.com/questions/103054/unsupported-hack-or-workaround-to-get-64-bit-os-x-to-install-on-a-macbook-pro-ha

Friday, August 7, 2015

Apple iCloud Device Locking and General Apple Information

If you work in IT you probably have people ask you random questions out of nowhere from time to time. I was recently asked about how to bypass Apple iCloud device locking.

First of all, my opinion of this. I just try to avoid this space (from any perspective). If it sounds too good/cheap to be true it probably is, yadayada...

There does seem to be some tools online to enable checking prior to purchase but obviously even that isn't full proof. For example, if the seller knows that the goods have been locked but never connects to Apple servers then it is impossible/unlikely that the device in question will be locked prior to be the sale. They could feign ignorance also when confronted, law enforcement and the legal system may offer no avenue for recourse, etc...
https://support.apple.com/en-au/HT201581
http://apple.stackexchange.com/questions/62448/find-original-sales-information-of-macbook-by-serial-number
https://www.powermax.com/stolen/index
http://notebooks.com/2011/05/10/how-to-avoid-buying-a-stolen-mac-apple-store-robbed-of-24-macbooks-in-30-seconds-video/
http://www.reddit.com/r/apple/comments/1lfko4/macbook_pro_got_stolen_how_can_i_access_the/
Safe to give out the serial number of a Mac I'm selling?
http://arstechnica.com/civis/viewtopic.php?f=19&t=93200
https://www.icloud.com/activationlock/
http://apple.stackexchange.com/questions/132478/macbook-pro-locked-with-find-my-mac-and-wont-let-me-boot
http://www.cnet.com/au/news/apples-icloud-lock-for-macs-is-not-very-secure/
iPhone 6 Plus Are "Stolen Goods" from Futu_Online eBay Promotion
https://www.ozbargain.com.au/node/205809
http://www.amta.org.au/pages/amta/Check.the.Status.of.your.Handset

If you've been watching this space for a while you'll know that about the Doucli bypass. This seems to work based on MITM (Man in the Middle Attack) principles (I haven't taken too close a look at this).
http://maypalo.com/2014/05/24/doulci-alternative-method-gadgetwide/
http://howtosifiwiki.com/bypass-icloud-account/
http://apple.stackexchange.com/questions/167978/factory-reset-an-ipad-without-knowing-the-icloud-password

For those who don't know what this is is that any communications that go from Apple to your device now go through a third party (Doucli). Doucli filters out any traffic which relates to iCloud locking or simply inserts a different set of communications which can then unlock the device. For anyone who knows how this is done this can be extremely tedious and difficult especially if the defender has taken extensive counter-measures against attack.

If you are interested in possible avenues of attacking it here goes:
- preventing it from locking your device should be simple enough. Don't connect it to the Internet and allow it to hook up with Apple servers. Earlier versions of the Doucli hack depend on DNS host file hacking. Later version of Apple software seems to block this behaviour though. Easiest way around this is to setup a layered defense/attack with DNS re-directs occuring at multiple points between you and Apple whether it may be via software (relevant configuration files, virtual machines, containers, etc...) and/or hardware (networking hardware, servers, etc...)
- the network/server setup of Apple systems is such that the authentication servers may not be isolated from the store purchases making things slightly more difficult (there are plenty of programs out there to do this). If you must use a second/intermediary system to which downloads music/software and use this to transfer to another system which is never connected online. This allows you to have the benefits of the purchasing online while not having to deal with iCloud authentication issues. Your device can not be locked without relevant identifying information being transferred between yourself and Apple (obviously, if this becomes a widespread means of bypassing iCloud then they'll be counter-measures which are deployed, etc...)
- the game keeps on changing. As cracks in the protocol/system are identified attackers and Apple have to continually change the game. If you really want to understand it, you're best trying to understand live packet manipulation and reverse engineering/cracking or DRM systems
- I've looked at this and for me the easiest way to attack is via direct hardware if your device is locked. It requires no advance knowledge of the software/protocol and is reliant entirely on the way in which data is stored on the device itself (obviously, this only makes the problem slightly easier to deal with). It's similar to the way in which firmware reset mode works on embedded devices such as eBooks and to the way in which bypass is achieved in physical security systems. The only troubling thing may access. They're BGA! Realistically this could mean that this type of attack is neigh on impossible (I think it may be possible though. When I have dead hardware lying around I often play around with it. A single copper fibre and the right type of signal/voltage may be enough to create the type of data corruption that I require). Effectively, the type of attack that I envisage revolves around storage corruption. Since, everything is stored via a combination of encrypted keys at multiple layers my belief is that destroying/corrupting the storage and restoring iOS clean and bypassing Apple servers is easier than engaging in a continual race against Apple (making the assumption that restoration of iOS can be completed independently of iCloud lock checking)
http://dtbnguyen.blogspot.com/2012/07/if-only-reading-were-easier.html
http://dtbnguyen.blogspot.com/2012/08/funky-firmware.html
http://images.apple.com/iphone/business/docs/iOS_Security_Feb14.pdf
https://www.ifixit.com/Answers/View/192220/Is+it+possible+to+transfer+NAND+Flash+from+iPhone+to+another
http://www.datarecovery.net/newsletters/what-kills-flash-drive.html
Toshiba THGBX2G7B2JLA01 16 GB NAND Flash
SK Hynix H2JTDG8UD1BMR 16 GB NAND Flash
- clearly, I'm working on the premise that attacking hardware is easier than attacking software since it is more difficult to change. To change the pin-out structure on a single chip requires re-tooling on a mass scale for chips that may also be used in other devices making it un-economical for both Apple and flash chip manufacturers to engage in. Once a design is out there, we can just figure it out and it should work across that entire design specification/model though... Of course, this could be somewhat of a moot point because a lot of Apple devices aren't easily upgradeable, change layout on each iteration, etc...
- another type of attack revolves around changing identifying information on the device and then clearing iOS. That said, you don't know whether or not Apple may have some sort of unique/class based identification system which may block non-Apple identified systems from accessing their servers. Either way, it requires a second system to act as an intermediary
- insider at Apple who removes gives you a 'clean sheet'
- that said, much of what I'm saying here is theoretical. I don't have access to an iPod/iPad at the moment so I don't know The best I've been able to manage are online teardowns
http://www.techhive.com/article/116572/article.html
http://superuser.com/questions/616033/are-unpowered-ssds-vulnerable-to-an-emp-shock
http://www.survivalistboards.com/showthread.php?t=72855
http://electronics.stackexchange.com/questions/36921/does-magnetism-affect-sd-cards
https://en.wikipedia.org/wiki/Flash_memory

Cracking Open: Apple iPad Air 2
https://www.youtube.com/watch?v=-tZlpBz8WF4
https://www.ifixit.com/Teardown/iPad+Mini+Wi-Fi+Teardown/11423
https://www.ifixit.com/Teardown/iPad+Mini+2+Teardown/19374
https://www.ifixit.com/Teardown/iPad+Mini+3+Wi-Fi+Teardown/30628
https://www.ifixit.com/Teardown/iPad+Wi-Fi+Teardown/2183
https://www.ifixit.com/Teardown/iPad+3+4G+Teardown/8277
https://www.ifixit.com/Teardown/iPad+Air+LTE+Teardown/18907
https://www.ifixit.com/Teardown/iPad+Air+2+Teardown/30592
- just don't get why some groups simply don't release downloadable software which can be used to bypass. A local/loopback proxy would likely have minimal system impact if the protocol break feels as simple as it could possibly be. My guess is that at least some hacker/cracker groups are using the (supposedly) free and altruistic bypasses as a means of gaining access to people's private details. All the more reason to avoid these third party hacks and buy equipment 'clean'...
- if you're used to researching DRM and disassembly/reverse engineering of files some of the above may seem foreign to you. Believe me, it's not that much of a leap up. Conceptually, many of the same techniques and theories are employed. You just have to get used to a new setting. That's all...

Identify your iPod model
https://support.apple.com/en-au/HT204217

Diagnostic mode for Apple iPod devices
https://discussions.apple.com/thread/3110831
http://www.methodshop.com/gadgets/ipodsupport/diagnosticmode/index.shtml

Sources/options for replacement storage on iPod Classics
http://www.ebay.com/bhp/ipod-classic-120gb-hard-drive
http://rockbox.cool.haxx.narkive.com/ibajtp9V/mk1214gah-or-spinpoint-n2
http://blog.macsales.com/28857-give-your-ipod-classic-new-life-with-owc-iflash
http://eshop.macsales.com/item/OWC/TARIPODFLSH/
http://apple.stackexchange.com/questions/89367/were-the-2009-mbps-affected-by-the-nvidia-problem
http://forums.whirlpool.net.au/archive/1123805

Source for replacement of Apple parts locally
https://www.macfixit.com.au/apple-ipad-iphone-ipod-accessories/ipad-iphone-ipod-repair-replacement-parts/ipod-parts.html
Enabling alternative filesystem support on Mac OS X Yosemite
http://www.cnet.com/au/news/how-to-manually-enable-ntfs-read-and-write-in-os-x/
http://apple.stackexchange.com/questions/152661/write-to-ntfs-formated-drives-on-yosemite
http://computers.tutsplus.com/tutorials/quick-tip-how-to-write-to-ntfs-drives-in-os-x-mavericks--cms-21434
http://www.cnet.com/au/how-to/how-to-manage-ext2ext3-disks-in-os-x/
http://osxdaily.com/2014/03/20/mount-ext-linux-file-system-mac/

Booting Live Linux discs on an Apple Macbook
http://askubuntu.com/questions/71189/how-do-i-boot-the-live-cd-on-a-macbook-pro
https://en.wikipedia.org/wiki/List_of_live_CDs

Mac OS X Live discs are an interesting option for those who are interested in testing/trying Mac OS X without wanting to purchase hardware beforehand.
http://www.insanelymac.com/forum/topic/22193-104145-live-and-install-dvd/
http://www.insanelymac.com/forum/forum/109-os-x-livedvd/

How to install latest Mac OS X on iMac without original DVD
https://discussions.apple.com/thread/7006750
Create a bootable installer for OS X Mavericks or Yosemite
https://support.apple.com/en-au/HT201372

Thursday, July 23, 2015

Self Replacing Secure Code, our Strange World, Mac OS X Images Online, Password Recovery Software, and Python Code Obfuscation

A while back (several years ago) I wrote about self replacing code in my 'Cloud and Security' report (p.399-402)(I worked on it on and off over an extended period of time) within the context of building more secure codebases. DARPA are currently funding projects within this space. Based on I've seen it's early days. To be honest it's not that difficult to build if you think about it carefully and break it down. Much of the code that is required is already in wide spread use and I already have much of the code ready to go. The problem is dealing with the sub-components. There are some aspects that are incredibly tedious to deal with especially within the context of multiple languages.

If you're curious, I also looked at fully automated network defense (as in the CGC (Cyber Grand Challenge)) in all of my three reports, 'Building a Coud Computing Service', 'Convergence Effect', and 'Cloud and Internet Security' (I also looked at a lot of other concepts such as 'Active Defense' systems which involves automated network response/attack but there are a lot of legal, ethical, technical, and other conundrums that we need to think about if we proceed further down this path...). I'll be curious to see what the final implementations will be like...
https://en.wikipedia.org/wiki/DARPA
http://www.darpa.mil/
https://play.google.com/store/books/author?id=Binh+Nguyen
http://www.amazon.com/mn/search/?_encoding=UTF8&camp=1789&creative=390957&field-author=Binh%20Nguyen&linkCode=ur2&search-alias=digital-text&sort=relevancerank&tag=bnsb-20&linkId=3BWQJUK2RCDNUGFY
http://www.brisbanetimes.com.au/it-pro/security-it/csail-fixes-software-bugs-automatically-in-any-language-by-copying-from-safer-applications-20150720-gifyo3
http://www.smh.com.au/it-pro/security-it/csail-fixes-software-bugs-automatically-in-any-language-by-copying-from-safer-applications-20150720-gifyo3
http://www.theverge.com/2015/7/8/8911493/darpa-cyber-grand-challenge-finalists-defcon
http://www.networkworld.com/article/2945443/security0/darpas-4m-cyber-threat-clash-down-to-seven-challengers.html

If you've ever worked in the computer security industry you'll realise that it can be incredibly frustrating at times. As I've stated previously it can sometimes be easier to get information from countries under sanction than legitimately (even in a professional setting in a 'safe environment') for study. I find it very difficult to understand this perspective especially when search engines allow independent researchers easy access to adequate samples and how you're supposed to defend against something if you (and many others around you) have little idea of how some attack system/code works.
http://www.itnews.com.au/News/406655,infosec-firms-oppose-misguided-exploit-export-controls.aspx
http://www.theaustralian.com.au/business/technology/australian-firms-under-attack-every-week-centrify/story-e6frgakx-1227444081288?nk=2712dc6b13f189c643cb547351652f41-1437018757

It's interesting how the West views China and Russia via diplomatic cables (WikiLeaks). They say that China is being overly aggressive particularly with regards to economics and defense. Russia is viewed as a hybrid criminal state. When you think about it carefully the world is just shades of grey. A lot of what we do in the West is very difficult to defend when you look behind the scenes and realise that we straddle such a fine line and much of what they do we also engage in. We're just more subtle about it. If the general public were to realise that Obama once held off on seizing money from the financial system (proceeds of crime and terrorism) because there was so much locked up in US banks that it would cause the whole system to crash would they see things differently? If the world in general knew that much of southern Italy's economy was from crime would they view it in the same way as they saw Russia? If the world knew exactly how much 'economic intelligence' seems to play a role in 'national security' would we think about the role of state security differently?
http://www.theguardian.com/world/2010/nov/29/wikileaks-cables-china-reunified-korea
https://en.wikipedia.org/wiki/Contents_of_the_United_States_diplomatic_cables_leak_%28People%27s_Republic_of_China%29
https://en.wikipedia.org/wiki/Reactions_to_the_United_States_diplomatic_cables_leak
https://en.wikipedia.org/wiki/Reception_of_WikiLeaks
http://www.theguardian.com/world/2010/dec/01/wikileaks-cables-russia-mafia-kleptocracy
http://www.telegraph.co.uk/news/worldnews/wikileaks/8304654/WikiLeaks-cables-US-agrees-to-tell-Russia-Britains-nuclear-secrets.html
https://www.techdirt.com/articles/20130910/13145824474/former-nsa-officer-wikileaks-is-front-russian-intelligence-snowdens-probably-spy.shtml
http://www.news.com.au/finance/work/the-human-tragedy-of-mh17-could-boost-vladimir-putins-popularity-despite-damning-video-evidence/story-fn5tas5k-1227448079141

If you develop across multiple platforms you'll have discovered that it is just easier to have a copy of Mac OS X running in a Virtual Machine rather than having to shuffle back and forth between different machines. Copies of the ISO/DMG image (technically, Mac OS X is free for those who don't know) are widely available and as many have discovered most of the time setup is reasonably easy.
http://www.reddit.com/r/osx/comments/1oey0b/download_os_x_109_mavericks_gm_final_dmg/
http://www.techglobex.net/2013/10/download-os-x-109-mavericks-gm-final.html

If you've ever lost your password to an archive, password recovery programs can save a lot of time. Most of the free password recovery tools deal only with a limited number of filetypes and passwords.
http://www.lostpassword.com/kit-forensic.htm
http://www.top-password.com/download.html
http://www.passwordsrecoverytool.com/download/
http://www.passwordsrecoverytool.com/downloads/
https://www.elcomsoft.com/eprb.html
http://www.password-changer.com/
http://www.password-changer.com/download.htm
http://www.livecd.com/
http://livecd.com/DataStudio/download.htm
http://pcsupport.about.com/od/toolsofthetrade/tp/passrecovery.htm
http://www.techrepublic.com/blog/five-apps/five-trustworthy-password-recovery-tools/

There are some Python bytecode obfuscation utilities out there but like standard obfuscators they are of limited utility against skilled programmers.
http://reverseengineering.stackexchange.com/questions/1943/what-are-the-techniques-and-tools-to-obfuscate-python-programs
http://stackoverflow.com/questions/14997414/obfuscating-python-bytecode-through-interpreter-mutation
http://stackoverflow.com/questions/261638/how-do-i-protect-python-code

Tuesday, July 21, 2015

Joint Strike Fighter F-35 Notes

Below are a bunch of thoughts, collation of articles about the F-35 JSF, F-22 Raptor, and associated technologies...

- every single defense analyst knows that comprimises had to be made in order to achieve a blend of cost effectiveness, stealth, agility, etc... in the F-22 and F-35. What's also clear is that once things get up close and personal things mightn't be as clear cut as we're being told. I was of the impression that the F-22 would basically outdo anything and everything in the sky all of the time. It's clear that based on training excercises that unless the F-22's have been backing off it may not be as phenomenal as we're being led to believe (one possible reason to deliberately back off is to not provide intelligence on max performance envelope to provide less of a target for near peer threats with regards to research and engineering). There are actually a lot of low speed manouvres that I've seen a late model 3D-vectored Sukhoi perform that a 2D-vectored F-22 has not demonstrated. The F-35 is dead on arrival in many areas (at the moment. Definitely from a WVR perspective) as many people have stated. My hope and expectation is that it will have significant upgrades throughout it's lifetime
https://medium.com/war-is-boring/don-t-think-the-f-35-can-fight-it-does-in-this-realistic-war-game-fc10706ba9f4
https://medium.com/war-is-boring/one-analyst-predicted-the-f-35s-s-dogfight-failure-50a942d0cf8a
http://asia.rbth.com/why_the_indonesian_air_force_wants_the_su-35_45943.html 
https://defenseissues.wordpress.com/2013/12/21/on-rafale-vs-f-22-bfm/
http://www.flightglobal.com/blogs/the-dewline/2009/11/rafale-beats-f-35-f-22-in-flig/
http://bestfighter4canada.blogspot.com.au/2014/09/fighter-jet-fight-club-f-35-vs-gripen.html
http://asia.rbth.com/science_and_tech/2013/10/09/su-35s_overtakes_american_f-22_in_terms_intellect_30639.html 
http://www.migflug.com/jetflights/p-i-r-a-t-e-versus-raptor.html
https://defenseissues.wordpress.com/2012/10/20/cleaning-up-red-flag-alaska-f-22-vs-typhoon-debate/
http://www.businessinsider.com/f-22-wont-win-a-dogfight-thrust-vectoring-raptor-typhoon-eurofighter-2013-2
F22 vs Rafale dogfight video
https://www.youtube.com/watch?v=ioTTnjxNc7o
Dogfight: Rafale vs F22 (Close combat)
https://www.youtube.com/watch?v=KOswfrc7Xtg
F-22 RAPTOR vs F-15 EAGLE
https://www.youtube.com/watch?v=wr-8dSkfs8Y
- in the past public information/intelligence regarding some defense programs/equipment have been limited to reduce the chances of a setting off arms race. That way the side who has disemminated the mis-information can be guaranteed an advantage should there be a conflict. Here's the problem though, while some of this may be such, I doubt that all of it is. My expectation that due to some of the intelligence leaks (many terabytes. Some details of the breach are available publicly) regarding designs of the ATF (F-22) and JSF (F-35) programs is also causing some problems as well. They need to overcome technical problems as well as problems posed by previous intelligence leaks. Some of what is being said makes no sense as well. Most of what we're being sold on doesn't actually work (yet) (fusion, radar, passive sensors, identification friend-or-foe, etc...)...
http://www.wired.com/2013/03/f-35-blind-spot/
http://blogs.crikey.com.au/planetalking/2009/07/12/the-f-35-jsf-predator-or-prey/
https://medium.com/war-is-boring/no-the-f-35-can-t-fight-at-long-range-either-5508913252dd
https://medium.com/war-is-boring/one-analyst-predicted-the-f-35s-s-dogfight-failure-50a942d0cf8a
https://medium.com/war-is-boring/fd-how-the-u-s-and-its-allies-got-stuck-with-the-worlds-worst-new-warplane-5c95d45f86a5 
http://english.pravda.ru/opinion/columnists/30-04-2009/107481-jsf_swindle-0/
http://www.wired.com/2012/04/f35-videos/
http://aviationweek.com/defense/opinion-joint-strike-fighter-debate-enters-new-phase
http://www.vanityfair.com/news/2013/09/joint-strike-fighter-lockheed-martin
http://www.theaustralian.com.au/national-affairs/policy/jsf-the-only-way-to-fly-into-future/story-fn59nlz9-1226936460799
http://www.dailytech.com/Report+Air+Forces+Spoiled+F35+Superjet+Has+No+Code+to+Shoot+Its+Gun/article37043.htm
http://www.smh.com.au/national/china-stole-plans-for-a-new-fighter-plane-spy-documents-have-revealed-20150118-12sp1o.html
- if production is really as problematic as they say that it could be without possible recourse then the only thing left is to bluff. Deterrence is based on the notion that your opponent will not attack because you have a qualitative or quantitative advantage... Obviously, the problem if there is actual conflict we have a huge problem. We purportedly want to be able to defend ourselves should anything potentially bad occur. The irony is that our notion of self defense often incorporates force projection in far off, distant lands...
F22 Raptor Exposed - Why the F22 Was Cancelled
https://www.youtube.com/watch?v=KaoYz90giTk
F-35 - a trillion dollar disaster
https://www.youtube.com/watch?v=39AO-axUd-k
4/6 F-35 JOINT STRIKE FIGHTER IS A LEMON
https://www.youtube.com/watch?v=ojPnp2hwqaE
JSF 35 vs F18 superhornet
https://www.youtube.com/watch?v=IUf_hhxngK4
- we keep on giving Lockheed Martin a tough time regarding development and implementation but we keep on forgetting that they have delivered many successful platforms including the U-2, the Lockheed SR-71 Blackbird, the Lockheed F-117 Nighthawk, and the Lockheed Martin F-22 Raptor
https://en.wikipedia.org/wiki/Lockheed_Martin
https://en.wikipedia.org/wiki/Skunk_Works
https://en.wikipedia.org/wiki/The_Boeing_Company
https://en.wikipedia.org/wiki/Boeing_Phantom_Works
f-22 raptor crash landing
https://www.youtube.com/watch?v=faB5bIdksi8
- SIGINT/COMINT often produces a lot of a false positives. Imagine listening to every single conversation that you overheard every single conversation about you. Would you possibly be concerned about your security? Probably more than usual despite whatever you might say? As I said previously in posts on this blog it doesn't makes sense that we would have such money invested in SIGINT/COMINT without a return on investment. I believe that we may be involved in far more 'economic intelligence' then we may be led to believe
http://dtbnguyen.blogspot.com/2015/06/the-value-of-money-part-4.html
- despite what is said about the US (and what they say about themselves), they do tell half-truths/falsehoods. They said that the Patriot missile defense systems were a complete success upon release with ~80% success rates when first released. Subsequent revisions of past performance have indicated actual success rate of about half that. It has been said that the US has enjoyed substantive qualitative and quantitative advantages over Soviet/Russian aircraft for a long time. Recently released data seems to indicate that it is closer to parity (not 100% sure about the validity of this data) when pilots are properly trained. There seems to be indications that Russian pilots may have been involved in conflicts where they shouldn't have been or were unknown to be involved...
https://en.wikipedia.org/wiki/MIM-104_Patriot
https://en.wikipedia.org/wiki/Aegis_Ballistic_Missile_Defense_System
https://en.wikipedia.org/wiki/Anti-ballistic_missile
https://en.wikipedia.org/wiki/Missile_defense_systems_by_country
https://en.wikipedia.org/wiki/Missile_defense
- the irony between the Russians and US is that they both deny that their technology is worth pursuing and yet time seems to indicate otherwise. A long time ago Russian scientists didn't bother with stealth because they though it was overly expensive without enough of a gain (especially in light of updated sensor technology) and yet the PAK-FA/T50 is clearly a test bed for such technology. Previously, the US denied that that thrust vectoring was worth pursuing and yet the the F-22 clearly makes use of it
- based on some estimates that I've seen the F-22 may be capable of close to Mach 3 (~2.5 based on some of the estimates that I've seen) under limited circumstances
- people keep on saying maintaining a larger, indigenous defense program is simply too expensive. I say otherwise. Based on what has been leaked regarding the bidding process many people basically signed on without necessarily knowing everything about the JSF program. If we had more knowledge we may have proceeded a little bit differently
- a lot of people who would/should have classified knowledge of the program are basically implying that it will work and will give us a massive advantage give more development time. The problem is that there is so much core functionality that is so problematic that this is difficult to believe...
http://www.thedailybeast.com/articles/2014/04/28/new-u-s-stealth-jet-can-t-hide-from-russian-radar.html
http://www.thedailybeast.com/articles/2014/12/31/new-u-s-stealth-jet-can-t-fire-its-gun-until-2019.html
http://www.vanityfair.com/news/2013/09/joint-strike-fighter-lockheed-martin
https://en.wikipedia.org/wiki/Joint_Strike_Fighter_program
http://www.dailytech.com/Report+Air+Forces+Spoiled+F35+Superjet+Has+No+Code+to+Shoot+Its+Gun/article37043.htm
- the fact that pilots are being briefed not to allow for particular circumstances tells us that there are genuine problems with the JSF
- judging by the opinions in the US military many people are guarded regarding the future performance of the aircraft. We just don't know until it's deployed and see how others react from a technological perspective
- proponents of the ATF/JSF programs keep on saying that since you can't see it you can't shoot. If that's the case, I just don't understand why we don't push up development of 5.5/6th gen fighters (stealth drones basically) and run a hybrid force composed of ATF, JSF, and armed drones (some countries including France are already doing this)? Drones are somewhat of a better known quantity and without life support issues to worry about should be able to go head to head with any manned fighter even with limited AI and computing power. Look at the following videos and you'll notice that the pilot is right on the physical limit in a 4.5 gen fighter during an excercise with an F-22. A lot of stories are floating around indicating that the F-22 enjoys a big advantage but that under certain circumstance it can be mitigated. Imagine going up against a drone where you don't have to worry about the pilot blacking out, pilot training (incredibly expensive to train. Experience has also told us that pilots need genuine flight time not just simulation time to maintain their skills), a possible hybrid propulsion system (for momentary speed changes/bursts (more than that provided by afterburner systems) to avoid being hit by a weapon or being acquired by a targeting system), and has more space for weapons and sensors? I just don't understand how you would be better off with a mostly manned fleet as opposed to a hybrid fleet unless there are technological/technical issues to worry about (I find this highly unlikely given some of the prototypes and deployments that are already out there)
https://defenseissues.wordpress.com/2013/12/21/on-rafale-vs-f-22-bfm/
F22 vs Rafale dogfight video
https://www.youtube.com/watch?v=ioTTnjxNc7o
Dogfight: Rafale vs F22 (Close combat)
https://www.youtube.com/watch?v=KOswfrc7Xtg
F-22 RAPTOR vs F-15 EAGLE
https://www.youtube.com/watch?v=wr-8dSkfs8Y
https://en.wikipedia.org/wiki/Dogfight
http://www.defenseindustrydaily.com/f-22-raptor-capabilities-and-controversies-019069/
http://www.wired.com/2012/07/f-22-germans/
http://www.defensenews.com/story/defense/air-space/strike/2015/07/15/typhoon-eurofighter-aerodynamic-modifications-agility/30181011/
- if I were a near peer aggressor or looking to defend against 5th gen threats I'd just to straight to 5.5/6th gen armed drone fighter development. You wouldn't need to fulfil all the requirements and with the additional lead time you may be able to achieve not just parity but actual advantages while possibly being cheaper with regards to TCO (Total Cost of Ownership). There are added benefits going straight to 5.5/6th gen armed drone development. You don't have to compromise so much on design. The bubble shaped (or not) canopy to aide dogfighting affects aerodynamic efficiency and actually is one of the main causes of increased RCS (Radar Cross Section) on a modern fighter jet. The pilot and additional equipment (ejector sear, user interface equipment, life support systems, etc...) would surely add a large amount of weight which can now be removed. With the loss in weight and increase in aerodynamic design flexibility you could save a huge amount of money. You also have a lot more flexibility in reducing RCS. For instance, some of the biggest reflectors of RADAR signals is the canopy (a film is used to deal with this) and the pilot's helmet and one of the biggest supposed selling points of stealth aircraft are RAM coatings. They're incredibly expensive though and wear out (look up the history of the B-2 Spirit and the F-22 Raptor). If you have a smaller aicraft to begin with though you have less area to paint leading to lower costs of ownership while retaining the advantages of low observable technology
https://en.wikipedia.org/wiki/Radar-absorbent_material
https://en.wikipedia.org/wiki/Stealth_technology
https://en.wikipedia.org/wiki/Northrop_Grumman_B-2_Spirit
https://en.wikipedia.org/wiki/Lockheed_Martin_F-22_Raptor
http://www.defensenews.com/story/defense/air-space/strike/2015/01/21/northrop-6th-gen-fighter/22089857/
https://en.wikipedia.org/wiki/Sixth-generation_jet_fighter
https://en.wikipedia.org/wiki/Next_Generation_Air_Dominance
http://asia.rbth.com/science_and_tech/2013/08/30/russian_air_force_views_unmanned_fighters_as_the_future_29375.html
- the fact that it has already been speculated that 6th gen fighters may focus less on stealth and speed and more on weapons capability means that the US is aware of increasingly effective defense systems against 5th gen fighters such as the F-22 Raptor and F-35 JSF which rely heavily on low observability
https://en.wikipedia.org/wiki/Next_Generation_Air_Dominance 
- based on Wikileaks and other OSINT (Open Source Intelligence) everyone involved with the United States seems to acknowledge that they get a raw end of the deal to a certain extent but they also seem to acknowledge/imply that life is easier with them than without them. Read enough and you'll realise that even when classified as a closer partner rather than just a purchaser of their equipment you sometimes don't/won't receive much extra help
http://blogs.crikey.com.au/planetalking/2009/07/12/the-f-35-jsf-predator-or-prey/
http://larvatusprodeo.net/archives/2007/10/us-sold-us-crippled-hornets-in-80s-according-to-beazley/
http://www.darkgovernment.com/news/australia-cracked-u-s-radar-codes/
- if we had the ability I'd be looking to develop our own indigineous program defense programs. At least when we make procurements we'd be in a better position to be able to make a decision as to whether what was being presented to us was good or bad. We've been burnt on so many different programs with so many different countries... The only issue that I may see is that the US may attempt to block us from this. It has happened in the past with other supposed allies before...
https://en.wikipedia.org/wiki/Stealth_aircraft
http://www.telegraph.co.uk/news/newstopics/howaboutthat/5773358/Nazis-were-close-to-building-stealth-bomber-that-could-have-changed-course-of-history.html
- I just don't get it sometimes. Most of the operations and deployments that US and allied countries engage in are counter-insurgency and CAS significant parts of our operations involving mostly un-manned drones (armed or not). 5th gen fighters help but they're overkill. Based on some of what I've seen the only two genuine near peer threats are China and Russia both of whom have known limitations in their hardware (RAM coatings/films, engine performance/endurance, materials design and manufacturing, etc...). Sometimes it feels as though the US looks for enemies that mightn't even exist. Even a former Australian Prime-Ministerial advister said that China doesn't want to lead the world, "China will get in the way or get out of the way." The only thing I can possibly think of is that the US has intelligence that may suggest that China intends to project force further outwards (which it has done) or else they're overly paranoid. Russia is a slightly different story though... I'm guessing it would be interesting reading up more about how the US (overall) interprets Russian and Chinese actions behinds the scenes (lookup training manuals for allied intelligence officers for an idea of what our interpretation of what their intelligence services are like)
https://en.wikipedia.org/wiki/Russian_Air_Force
https://en.wikipedia.org/wiki/People%27s_Liberation_Army_Air_Force
http://www.smh.com.au/federal-politics/political-news/china-not-fit-for-global-leadership-says-top-canberra-official-michael-thawley-20150630-gi1o1f.html
http://thediplomat.com/2015/07/china-wants-to-develop-a-new-long-range-strategic-bomber/
http://www.defenceaviation.com/2008/07/pakda-a-russian-stealth-bomber.html
http://theaviationist.com/2013/10/30/usaf-lrs/
http://hamptonroads.com/2015/07/stealthy-f22-jet-serves-escort-ensures-other-warfighting-aircraft-survive
http://www.washingtonpost.com/blogs/post-politics/wp/2015/07/21/obama-defends-iran-deal-decries-over-reliance-on-military-force/
http://warontherocks.com/2015/07/chinas-new-intelligence-war-against-the-united-states/?singlepage=1
http://nationalinterest.org/feature/gun-hire-5-russian-weapons-war-sale-13411
http://www.forbes.com/sites/lorenthompson/2015/07/23/f-35-fighter-engines-how-the-pentagon-will-make-sure-pratt-whitney-performs/
- sometimes people say that the F-111 was a great plane but in reality there was no great use of it in combat. It could be the exact same circumstance with the F-35
http://australianaviation.com.au/2014/07/f-35-rollout-highlights-raafs-greatest-opportunity-for-evolutionary-change/
https://en.wikipedia.org/wiki/General_Dynamics_F-111_Aardvark
- there could be a chance the aircraft could become like the B-2 and the F-22. Seldom used because the actual true, cost of running it is horribly high. Also imagine the ramifications/blowback of losing such an expensive piece of machinery should there be a chance that it can be avoided
- defending against 5th gen fighters isn't easy but it isn't impossible. Sensor upgrades, sensor blinding/jamming technology, integrated networks, artificial manipulation of weather (increased condensation levels increases RCS), faster and more effective weapons, layered defense (with strategic use of disposable (and non-disposable) decoys so that you can hunt down departing basically, unarmed fighters), experimentation with cloud seeing with substances that may help to speed up RAM coating removal or else reduce the effectiveness of stealth technology (the less you have to deal with the easier your battles will be), forcing the battle into unfavourable conditions, etc... Interestingly, there have been some accounts/leaks of being able to detect US stealth bombers (B-1) lifting off from some US air bases from Australia using long range RADAR. Obviously, it's one thing to be able to detect and track versus achieving a weapons quality lock on a possible target
http://news.usni.org/2014/05/14/can-chinas-new-destroyer-find-u-s-stealth-fighters
RUSSIAN RADAR CAN NOW SEE F-22 AND F-35 Says top US Aircraft designer
https://www.youtube.com/watch?v=Z_vXqtCkVy8
https://en.wikipedia.org/wiki/Jindalee_Operational_Radar_Network
https://en.wikipedia.org/wiki/Over-the-horizon_radar
- following are rough estimate on RCS of various modern defense aircraft. It's clear that while Chinese and Russian technology aren't entirely on par they make the contest unconfortably close. Estimates on the PAK-FA/T-50 indicate RCS of about somewhere between the F-35 and F-22. Ultiamtely this comes back down to a sensor game. Rough estimates seem to indicate a slight edge to the F-22 in most areas. Part me thinks that the RCS of the PAK-FA/T-50 must be propoganda, the other part leads me to believe that there is no way countries would consider purchase of the aircraft if it didn't offer a competitive RCS
http://www.globalsecurity.org/military/world/stealth-aircraft-rcs.htm
http://www.ausairpower.net/APA-NOTAM-300309-1.html
http://www.f-16.net/forum/viewtopic.php?t=4408
https://www.youtube.com/watch?v=Z_vXqtCkVy8
http://www.ausairpower.net/APA-2011-03.html
http://www.flightglobal.com/blogs/the-dewline/2009/02/growler-power-ea-18g-boasts-f-/
http://www.theage.com.au/technology/technology-news/revolutionary-f35-joint-strike-fighter-pilots-smart-helmet-will-cost-a-bomb-20150224-13ko9d.html
http://www.news.com.au/technology/the-1-trillion-f35-tries-to-be-all-things-but-succeeds-at-few-say-critics-but-is-australias-new-weapon-now-too-big-to-fail/story-e6frfrnr-1226950254330
http://in.rbth.com/blogs/2013/04/08/why_australia_should_scratch_the_f-35_and_fly_sukhois_23629.html
http://ozzyblizzard.blogspot.com.au/2008/12/air-power-australia-flanker-analysis.html
https://www.facebook.com/notes/f-22-raptor/t-50-advantages-over-f22-and-why-f22-is-the-only-fighter-which-can-match-its-cou/10151667295298040?_fb_noscript=1
- it's somehwat bemusing that that you can't take pictures/videos from certain angles of the JSF in some of the videos mentioned here and yet there are heaps of pictures online of LOAN systems online including high resolution images of the back end of the F-35 and F-22
http://www.f-16.net/f-16_versions_article20.html
http://air-attack.com/images/single/740/The-F-35B-Lightning-II-rotates-its-engine-nozzle.html
http://defence.pk/threads/low-observable-nozzles-exhausts-on-stealth-aircraft.328253/
F 22 Raptor F 35 real shoot super clear
https://www.youtube.com/watch?v=FmLa-5R6TrI
- people keep on saying that if you can't see and you can't lock on to stealth aircraft they'll basically be gone by the time. The converse is true. Without some form of targeting system the fighter in question can't lock on to his target. Once you understand how AESA RADAR works you also understand that given sufficient computing power, good implementation skills, etc... it's also subject to the same issue that faces the other side. You shoot what you can't see and by targeting you give away your position. My guess is that detection of tracking by RADAR is somewhat similar to a lot of de-cluttering/de-noising algorithms (while making use of wireless communication/encryption & information theories as well) but much more complex... which is why there has been such heavy investment and interest in more passive systems (infra-red, light, sound, etc...)
https://en.wikipedia.org/wiki/Active_electronically_scanned_array
https://en.wikipedia.org/wiki/Dassault_Rafale
https://en.wikipedia.org/wiki/Euroradar_CAPTOR
https://en.wikipedia.org/wiki/Infra-red_search_and_track
https://en.wikipedia.org/wiki/Optronique_secteur_frontal
https://en.wikipedia.org/wiki/Targeting_pod
https://en.wikipedia.org/wiki/Forward_looking_infrared
http://aviationweek.com/defense/opinion-joint-strike-fighter-debate-enters-new-phase
F-35 JSF Distributed Aperture System (EO DAS)
https://www.youtube.com/watch?v=9fm5vfGW5RY

Lockheed Martin F-35 Lightning II- The Joint Strike Fighter- Full Documentary.
https://www.youtube.com/watch?v=AA2nvhHG6y4
4195: The Final F-22 Raptor
https://www.youtube.com/watch?v=fYEx9BiJNfE
https://en.wikipedia.org/wiki/Joint_Strike_Fighter_program
http://theaviationist.com/2015/07/13/f-35-pilot-about-flight-helmet/
http://www.wesh.com/politics/the-f35-is-it-worth-the-cost/34194708
http://forums.bharat-rakshak.com/viewtopic.php?f=3&t=5400&start=320
http://www.vanityfair.com/news/2013/09/joint-strike-fighter-lockheed-martin
http://www.f-16.net/forum/viewtopic.php?p=94991
http://forum.keypublishing.com/archive/index.php/t-81329-p-2.html
http://aviationweek.com/blog/read-f-35-accident-report
Rafale beats F 35 & F 22 in Flight International
https://www.youtube.com/watch?v=Bq4-TxgE8iU
Eurofighter Typhoon fighter jet Full Documentary
https://www.youtube.com/watch?v=WkBHpSBNnM4
Eurofighter Typhoon vs Dassault Rafale
https://www.youtube.com/watch?v=2wWkHKYcvos
DOCUMENTARY - SUKHOI Fighter Jet Aircrafts Family History - From Su-27 to PAK FA 50
https://www.youtube.com/watch?v=CYAw-FhTxHw
Green Lantern : F35 v/s UCAVs
https://www.youtube.com/watch?v=XtXPQNW2HqE

Friday, July 17, 2015

Selling Software Online, Installer, Packaging, and Packing Software, Desktop Automation, and More

Selling software online is deceptively simple. Actually making money out of it can be much more difficult.
http://www.cio.com/article/2388308/enterprise-software/14-tips-for-selling-software-and-services-online.html
http://www.quora.com/What-is-best-way-to-sell-software-online
http://www.softwarecasa.com/sell-software-i-4.html?ModPagespeed=noscript
http://www.forbes.com/sites/kathycaprino/2013/05/21/why-your-online-program-just-wont-sell/
http://www.fastspring.com/selling-software-online

Heaps of packaging/installer programs out there. Some cross platform solutions out there as well. Interestingly, just like a lot of businesses out there (even a restaurant that I frequent will offer you a free drink if you 'Like' them via Facebook) now they make use of guerilla style marketing techniques. Write a blog article for them and they may provide you with a free license.
https://en.wikipedia.org/wiki/List_of_installation_software
http://www.techrepublic.com/blog/five-apps/five-apps-for-creating-installation-packages/
http://www.advancedinstaller.com/free-license.html
http://www.jrsoftware.org/isinfo.php
https://en.wikipedia.org/wiki/List_of_software_package_management_systems
http://www.flexerasoftware.com/producer/products/software-installation/installshield-software-installer/
http://www.flexerasoftware.com/producer/resources/free-trials/#installshield

I've always wondered how much money software manufacturers make from bloatware and other advertising... It can vary drastically. Something that to watch for are silent/delayed installs though. Namely, installation of software even though it doesn't show up the Window's 'Control Panel'.
http://www.lifehacker.com.au/2015/05/crapware-is-a-horrible-problem-and-its-all-our-fault/
http://www.howtogeek.com/168691/how-to-avoid-installing-junk-programs-when-downloading-free-software/?PageSpeed=noscript
http://www.lifehacker.com.au/2013/11/unchecky-ensures-you-never-accidentally-install-bundleware-again/
http://unchecky.com/
http://www.makeuseof.com/tag/fight-toolbar-installer-bloatware-opinion/
https://www.google.com/admob/monetize.html
http://www.mobyaffiliates.com/blog/how-to-make-more-money-from-your-app-monetization-tips-from-appflood/
http://www.codefuel.com/developers
http://www.incomediary.com/7-best-plugins-for-monetization
http://www.amonetize.com/
http://installmonetizer.com/
http://www.sterkly.com/installer-monetization/
https://unityads.unity3d.com/help/Frequently%20Asked%20Questions/faq
http://www.revenyou.com/
http://www.buzinga.com.au/buzz/how-to-make-money-from-apps/

Even though product activation/DRM can be simple to implement (depending on the solution), cost can vary drastically depending on the company and solution that is involved.
https://en.wikipedia.org/wiki/Product_activation
http://stackoverflow.com/questions/3481594/how-to-program-a-super-simple-software-activation-system
https://activatar.codeplex.com/
https://www.fingoo.net/lib/asp/packages.asp
http://stackoverflow.com/questions/822468/is-there-an-open-source-drm-solution
http://www.fatbit.com/fab/launch-best-gaana-clone-script-features-website-details-confirm/
http://www.fileopen.com/
https://en.wikipedia.org/wiki/Digital_rights_management
https://en.wikipedia.org/wiki/Copy_protection

Sometimes you just want to know what packers and obfuscation a company may have used to protect/compress their program. It's been a while since I looked at this and it looks like things were just like last time. A highly specialised tool with few genuinely good, quality candidates...
https://en.wikibooks.org/wiki/Reverse_Engineering/File_Formats
http://stackoverflow.com/questions/1271550/how-to-detect-what-was-the-pe-packer-used-on-the-given-exe
http://www.woodmann.com/collaborative/tools/index.php/Category:Packer_Identifiers
http://reverseengineering.stackexchange.com/questions/3184/packers-protectors-for-linux
http://ntinfo.biz/
https://www.digitalocean.com/community/tutorials/how-to-install-and-get-started-with-packer-on-an-ubuntu-12-04-vps
https://en.wikipedia.org/wiki/Executable_compression
http://upx.sourceforge.net/
https://malwr.com

A nice way of earning some extra/bonus (and legal) income if you have a history being able to spot software bugs.
https://bugcrowd.com/list-of-bug-bounty-programs
http://www.businessinsider.com.au/twitter-hackerone-bounty-program-2014-9
http://www.siteslike.com/similar/vupen.com
https://en.wikipedia.org/wiki/Pwn2Own

If you've never used screen/desktop automation software before there are actually quiet a few options out there. Think of it as 'Macros' for the Windows desktop. The good thing is that a lot of them may use a scripting language for the backend and have other unexpected functionality as well opening up further opportunities for productivity and automation gains.
http://alternativeto.net/software/sikuli/
http://stackoverflow.com/questions/11497613/what-better-tool-than-sikuli-to-use-for-screen-automation-on-windows-7-or-prefe
https://answers.launchpad.net/sikuli/+question/141373
http://stackoverflow.com/questions/6337629/how-to-send-ctrl-c-in-sikuli
https://answers.launchpad.net/sikuli/+question/185777
https://answers.launchpad.net/sikuli/+question/232900

A lot of partition management software claim to be able to basically handle all circumstances. The strange thing is that disk cloning to an external drive doesn't seem to be handled as well. The easiest/simplest way seems to be just using a caddy/internal in combination with whatever software you may be using.
http://forum.easeus.com/viewtopic.php?t=20183
http://kb.easeus.com/art.php?id=10039
http://www.partition-tool.com/easeus-partition-manager/disk-copy.htm

There are some free Australian accounting solutions out there. A bit lacking feature wise though.
http://www.flyingsolo.com.au/forums/index.php?threads/free-accounting-software-australia-recommendations.29338/
http://www.bit.com.au/Review/344651,7-accounting-packages-for-australian-small-businesses-compared-including-myob-quickbooks-online-reckon-xero.aspx
http://bas-i.com.au/
http://l-lists.com/en/lists/rn52ao.html

Every once in a while someone sends you an email in a 'eml' format which can't be decoded by your local mail client. Try using 'ripmime'...
http://superuser.com/questions/187106/extract-save-a-mail-attachment-using-bash