Internet Storm Center Infocon Status

Are DDoS Attacks Being Scheduled?

Last week I noticed a spike of 15,000 hits.  This is probably a DDoS attack against some PHP code as WordPress is a huge target for such attacks.  As long as you keep systems patched, it usually isn’t an issue.  However, I find this follow up attack very interesting.  The hits match almost perfect (and could actually be the exact same hit count).


The second attack, exactly seven days after the original attack, may indicate that these DDoS attacks are following a schedule.

update:  More of the same today (12/05/2016)), except I’m at 25,000+ hits from a suspicious address (

Did you find this post helpful?  Consider voting for on
Vote for

Also, please consider sharing this article with others!

Could This Be The World’s BEST CODEBOOK?

pocketnewtestamentOver a year ago I was asked by PrepperRecon to join in on an interview regarding secure email systems.  In the interview I gave an overview of email servers in Israel, Switzerland, and Norway.  One of my recent favorites is ProtonMail (Switzerland).  I love that you can send a secure email message and password that message so that the recipient must know the password in order to see the contents.  Of course, this raises the question, “How do I come up with a password method that I can share?”

This is a problem as old as espionage.  Even Israelites used a password in the Old Testament, when a word was used which was difficult for Israel’s enemies to pronounce.  The word was Shibboleth (see Judges 12 and wikipedia:

Over the course of history, various methods have been developed to share passwords.  The most secure method of encryption is OTP (or One Time Pad) – see this link.  Basically, two one time pads are created.  Each one time pad can be used to send or receive a message.  In order to maintain security, each one time pad must be destroyed after use.  One time pads are typically only used for very short messages.  (Note: One time pads are still in use today.  Broadcasts can be heard over various frequencies saying things like, “alpha, alpha, juliet, bravo, etc., etc.”  Agents in the field can receive the messages using receivers which are pretty much undetectable, thereby maintaining good security).

One time pads come with a slew of problems.  Creating messages can be time consuming.  If a one time pad booklet is lost, there is no way to recreate it.  Messages are short, so you are limited by what you can communicate with a limited amount of characters.  The one time pad booklets would need replacing when they run out, which means contact might need to be reestablished anyways (and that could breach security).

What if instead of a one time pad you simply used a codebook?  The codebook would need to be small.  It would need to be common enough that it can be obtained easily by all team members.  It would also need enough pages to keep passwords fresh.  I think a pocket New Testament would be ideal.  Of course, everyone in your group would need to obtain the very same version so that all the letters fall in the same place on every page.

The problem remains about developing a password method that can be shared.  So, here are some ideas.

First, identify a page.  This could be done in a multitude of ways, but basic ways include:

  • simply giving a Book, chapter, and verse.
  • use a page number
  • reference a verse that others would know where to find (this also enforces the value of knowing scripture)

Second, coordinate a pattern.  The pattern will give you the code.  There are thousands, or millions, of patterns that could be used.  Here are some ideas:

  • the letter on the top right corner of every page over the next 20 pages
  • the third line from the bottom backwards for 20 characters (be sure to confirm whether or not spaces should be used)
  • use a column of letters down or up (like the right column of characters moving up from the bottom)
  • every other character of a specified line
  • use the page number to develop a pattern (like page 143, could be the first character, then skip four characters, then skip 3 characters).
  • keep it easy enough that you can remember and use it easy!

When using a system like ProtonMail, you may just need to put a verse, or page number, in the subject line.  As long as the person you communicate with has the code book and knows the proper pattern, then they can use the password to decrypt your message.

Never ever use the same page twice unless you are using a new and unique pattern.  But, the good news is that you never need to destroy your pages like a one time pad.  You simply need to communicate a new pattern.

Besides all this stuff about codebooks, having access to God’s Word is most important.  In the pages we find strength, encouragement, and salvation.  It’s just smart to have access to the Word anywhere you go.

Did you find this post helpful?  Consider voting for on
Vote for

Also, please consider sharing this article with others!

Does Your Phone/Laptop Have a KILL SWITCH? Probably.

Last week I finished reading Tiger Trap by David Wise.  The book was good, but I’m not going to delve into a full review here.  However, I will mention that I was a bit disappointed that the book only barely mentioned “kill switch” technology that the Chinese may be putting into technology.  If the Chinese possessed the ability to kill our tech, they would probably do it.

The Chinese aren’t the only ones we need worry about killing our tech.  We can look to our own government and industry for additional concerns.  Laptops and phones are being built in a nearly unrepairable manufacturing process.  When you purchase your tech now-a-days, you purchase devices that cannot even have batteries replaced without sending it to the factory.  More than likely, when even just a battery needs replacing, you will receive a replacement device instead of actually having your phone repaired.

Devices are becoming more expensive, yet unrepairable.  Does that even make sense?  Security is even being built in using the “throw away” mentality as well.  Government has the ability, in many cases, to disable a cell phone (PoliceOne article here).  We simply value data security more than the device itself, which is logical.

That’s all fine and good, right?  I mean, we all know that no one else could possibly figure out how to kill your cell phone.  Well, that’s not really true.  Past experience tells us that building things like this into technology come back to bite us when the hackers figure them out.  Figuring out challenges like “killing” someone’s phone is part of the hacker’s playground.  Such a project could even be funded by state actors.

It would make much more sense to me that we would make better attempts at securing our data rather than just relying on a chip to do it for us, but people want everything easy.  Thus, we have chips that can make our phones and laptops inoperable.

Does your device have a KILL SWITCH?

Intel Processors?  Probably – Starting with Sandy Bridge in 2010 processors can be disabled using 3G cellular network even if the laptop isn’t powered.

AMD Processor?  Inconclusive – Could not find information verifying whether or not AMD uses kill switch technology.  It looks like they are not using it.

Apple iPhone?  Yes – Beginning in iOS 8.

Google Phones?  At least some, Qualcomm Snapdragon 810 does, but you have to check your specific model

One question you may be asking right now is “What can I do about this?”  Probably nothing.  It is part of the way the world thinks about security right now.  If you don’t need a powerhouse of a computer, then maybe you will think about researching AMD processors and pick one of those in your next laptop.  As for smartphones, you are pretty much stuck.

Did you find this post helpful?  Consider voting for on
Vote for

Also, please consider sharing this article with others!

Baofeng DM-5R – Should You Go Digital? (Digital DM-5R Instead of Analog UV-5R)

Those of us that are lucky enough to be surrounded by HDTV stations enjoy the benefits of a beautiful and mostly uninterrupted HD picture on our televisions.  The same technology was introduced in radio form many years before we ever saw an HDTV picture.  Sending digital instead of analog has a great benefit as you either have a fantastic copy of the audio or no audio.  So, if a signal is properly received, it should not just be copyable, it should be crystal clear.

Without a doubt, the Baofeng UV-5R has been the most popular radio for preppers.  It is cheap and it is rugged.  Four UV-5R’s can be purchased at the same price as a single Yaesu or Icom.  But, all this means you use easily readable analog.  Anyone can just tap into your signal.

However, those serious about communications may want to consider a step up into digital mode.  But digital is typically more expensive.  Should you invest in more than double the cost to obtain DM-5R’s from Amazon at $79.99?  That’s for you to decide, but here is some information and comparisons.

The DM-5R is nearly identical in appearance to the UV-5R, however the DM-5R delivers crisp clean audio at 1.5 miles whereas the same audio on the UV-5R would barely be readable.  This first video is a demonstration from HamRadioConcepts on YouTube.

Going digital isn’t the only thing you need to consider.  You also have to strongly weigh in compatibility.  The second video focuses in on the digital aspects of the DM-5R and shows how it may not be compatible with “all things digital.”

Quite honestly, you shouldn’t expect the DM-5R, at its cheap price point, to satisfy compatibility requirements.  However, at just 80 bucks a radio, the DM-5R is super cheap, appears to be built with the same ruggedness of the UV-5R and can help you move into the digital realm on a budget.

ADDED NOTE:  I found this web post giving some more information about the compatibility of the DM-5R:

Did you find this post helpful?  Consider voting for on
Vote for

Also, please consider sharing this article with others!

Is Tor Still Safe?

duckduckgo-is-tor-still-safeJust moments ago, I searched for the phrase “2016 is Tor still safe” on the anonymous search engine Duck Duck Go and I got the results in this screenshot (link to search here).  What was remarkable to me about the search is that the first 10+ links were all from articles more than a year old.  The average article was more than two years old.

So, this begs the question, “is Tor still valid in 2016?”  Additionally, this makes me question whether or not TailsOS still meets its promises of web surfing anonymity.

Tor has not gone without significant woes in 2016.  On May 25th of this year, Jacob Applebaum quit Tor “amid ‘sex misconduct’ accusations” according to The Register (link to source here).  Though Applebaum has been a significant voice for Tor advocates, he wasn’t the only bad news for web anonymity.  Further piling on problems is the fact that Lucky Green left in July, later pulling the plugs at the end of August of this year on his Tor nodes (link to Dark Web News source here).  In their article, “Dark Web News” refers to this as “matter of great concern.”

The Dark Web News article further points a response from Tor by “Appoint[ing] a new board of directors” (link to source here).  As you think about any company that has undergone a major board changeover, you think either one of two things will happen.  Either, the new board will drive the project/company into the ground, or the change will mean positive changes will occur.  Hardly ever do things just continue at the status quo.

Have things gotten better or worse for Tor?  I would have to emphatically say that they have improved and improved greatly!  Here are some observations:

  1. The Tor Project seems to have undergone a major website revamp in recent months which now clearly shows the connections between the Tor and community projects
  2. Improvements are being made on the messaging front by way of a Tor messenger (still in Beta)
  3. Involvement in Tor projects seems to be easier than ever with an incredible list of project ideas and promoting of volunteerism (which I think is critical to keeping a project like this moving ahead)
  4. Links to Tails and Copperhead (and other open source projects) pepper the website

Of course, not all these positives can likely be attributed to the board alone, but these are welcome changes.  It is great to see up to date information on their website.

Is TailsOS moving in the right direction as well?  Though hasn’t undergone any major revamp of the website, there has been significant improvements.  In particular, there is much better information about how to build your own TailsOS bootable USB.  The project also continues to take security holes very seriously and the most recent update is marked 11/15/2016.  This continues to keep me very positive.

Many of you have noticed that we have pulled our inventory of TailsOS in the past few months.  There are mixed reasons for this.  First of all, the updates for TailsOS comes fast and it is important to me to always ship the latest version.  Sometimes that is hard to do.  Second, with concerns about Tor’s sustainability, I wanted to make sure that I was shipping a product that would continue to hold value.  With the recent research regarding Tor, TailsOS, and Copperhead, I am considering re-offering TailsOS bootable USB drives.  In addition, I am currently researching whether or not I can even provide phones loaded with Copperhead OS.  Please stay tuned!

If you are one of those that have been waiting for a TailsOS to reappear in our online store, please feel free to comment below, your comments will be kept private unless you request otherwise.

Did you find this post helpful?  Consider voting for on
Vote for

Also, please consider sharing this article with others!

5 Things that Freedom of Speech is Not

american flag

5 Things that Freedom of Speech is NOT…

1 – receiving a payment so you will be motivated to become involved in a protest

2 – spraying your message in the form of graffiti

3 – violent

4 – an excuse for unlawful behavior

5 – a means to protest the US Constitution (which enables your freedom)

Did you find this post helpful?  Consider voting for on
Vote for

Also, please consider sharing this article with others!

Ham Radio and the Prepper – the good and bad of ham radio operation

Here’s a little history… Though interested in ham radio for much of my life, it wasn’t until 2005 that my interest really piqued.  It was through helping a small community get connected to the intenet where I met Stan.  Stan, now a “silent key” (a term used to refer to those hams that have passed on), had gear lying all over the place.  At an age of 80-plus Stan had an intentness about him and a eagerness to learn new things.

Stan and his wife Mary had three phones lines.  They each had their own voice line as well as a modem line since both liked to stay connected online with email and such.  The broadband at the time was only 3Mbits, but was a welcome change from 56Kbit dialup (which often connected lower than 40Kbit).

Stan and his wife were full of stories.  Stan in particular talked much about his time in the merchant marines and various projects he worked on for a government agency, of which I will not mention since both he and his wife worked for this agency.

In one story, Stan told me about how he was the radio operator on a ship.  Stan told a fellow technician that he could hammer out a SOS even if the ship’s radios were down simply by using an ohmmeter and the ships existing antenna.  Word got to the captain who insisted Stan give him a demonstration.  Stan intially refused saying that sending an SOS would not be a wise idea, however, the captain continued to insist and said that it was impossible.  Stan sent a brief SOS and an audible response to the SOS could clearly be heard from the captain’s radio.  Stan told me he quickly disconnected from the antenna and was worried about reprocussions (which never happened), but Stan won his bet with the captain!

Stan had gear all over the place, ham transceivers, large amplifiers, antennas, homebrew projects, and he was showing a fascination with SDR (software defined radio, which was in its infancy).

With some encouragement from Stan, I tested into a General Class ham license and Stan helped me get set up with my first SDR rig (a SDR-1000 by Flex Radio).  Once I had the rig, I had to get it online, which meant setting up an antenna.  So, I built a 135 foot OCF (off-center-fed) dipole with legs of 90 and 45 feet.  My first contact on the radio was a voice contact using SSB on 20 meters over 1,000 miles away on just 1 watt of power.  I was blown away!  Of course, much of that success had to do with Stan investing some time and energy into helping me understand low power and antennas.

So what does all this have to do with prepping?  Ham radio operation can be a great addition to any prepper’s toolbox (given that one goes through the process of acquiring a ham radio license).  But, one of the biggest problems with ham radio communication is that it cannot legally be secured.

Every transmission must be able to be read.  It is read using readily available standards like SSB, CW (morse code), RTTY, packet data, AM, FM, etc.  The ability of fellow hams and the FCC to read any given transmission is a legal boundary of accepting a ham radio operator’s license.  Encryption cannot be used.  Speaking in code is a violation of the license.  Additionally, focusing conversation on political or controversial issues is a “no no.”  The purpose of ham radio isn’t to protect one’s freedom of speech and it is to provide a playground for like-minded techies to discover radio technology and learn.  The good is that ham radio does that last part very well, it does provide an excellent learning playground.

Adding more good onto this is that ham radio bands open up in the event of an emergency.  But, that doesn’t mean anyone with a radio should use it (with or without a license).  In fact, the morons out there that have radios and don’t have licenses will probably have very little understanding about how to conduct proper radio communications in an emergency because they have no experience.  They’ve bought radios, check their charge every once in a while, maybe turn them on and listen in a little, then turn them back off and put them in storage.

Aggravating the emergency situation will be the multitudes of ham wanna-bees that have bought the crazy cheap Baofeng radios.  Note:  I’m not saying there is anything wrong with the Baofeng UV-5R or other Baofeng radio, I’m just saying it is like getting a really cheap gun and hoping it works well when you need it.  In a disaster, the airwaves could get flooded with traffic from people who don’t know what frequencies they should or shouldn’t be operating on and potentially disrupt police, emergency services, paging and other systems.

But, more good is the fact that since there are ham radio standards like SSB, CW, and RTTY, one can easily, and with a minimum amount of gear, start tuning in.  In fact, I think this is the most ideal way to use ham radio is simply by listening.  One can gather information without shining a spotlight on their own location.  When you tune in your TV on local stations, you bypass online streaming, your are not logged, you simply receive what is already available.  It can be discreet.  But, when you go online, your traffic is logged, Roku/Netflix/Amazon know exactly what you are watching or listening to.

Going beyond ham, listening in on shortwave can provide one of the best spectrums of information.  Certainly there are garbage broadcasts out there, but there is also a wealth of news that is free for your listening pleasure.  Over-the-air transmissions are probably the worst with regard to security, but could be the best with regard to anonymity.  So, dig out that Beofeng and do some listening.  Tune your Tecsun in, get a good antenna, and see what kind of range you can receive.  Find your local repeaters on the 2-meter Baofeng and just tune in.  Of course, if you have a license, then join the local banter and learn more about your gear.

Did you find this post helpful?  Consider voting for on
Vote for

Also, please consider sharing this article with others!