We’re on the back half of Week 3 of UC Baseline, the cybersecurity training program being given by The Undercroft, Tampa Bay’s cybersecurity guild and security-focused coworking space. We just finished three days of Linux 101, which was mostly an intro to command-line Linux, and now it’s time for two days of Windows from a security point of view.
Scenes from UC Baseline’s “Linux 101” class. Tap to see at full size.
I’m the lucky recipient of a UC Baseline scholarship (I wrote about the scholarship opportunity and then landing it a few weeks back), and I figured that I might as well use my COVID-19 downtime productively by spending five-ish weeks participating in the program.
Tap the photo to see my article from 2009 associated with this photo.
Since leaving Microsoft, I’ve stayed pretty much outside the Windows world. I call it “time off for good behavior”. I took it to the point that immediately after handing in my blue badge, I drove straight to the store and bought my first iPhone — and remember, I was a designated Windows Phone champ:
This part of the program is being taught by Michael “Turtle” Dorsey, and it’s a great refresher for a lot of material that I haven’t covered in a good long time, since none of my machines runs Windows at the moment (for the class, I’m running Windows 10 in VMWare on my primary Linux laptop).
The class opened with this slide, which I think bodes very well:
The good news: Tampa Bay is the location of one of the biggest high-tech stories of the year!
The bad news: It’s because the breach that everyone calls the “Twitter Hack,” in which several verified accounts were used to scam people out of an estimated $100,000 in a single day, has been traced to a 17 year-old Tampa resident named Graham Ivan Clark. His story has been published in the New York Times article, From Minecraft Tricks to Twitter Hack: A Florida Teen’s Troubled Online Path.
The scam
The scam involved hijacking the Twitter accounts of celebrities, politicians, businesspeople, and other “blue check” people and using them to post tweets like the one below:
It didn’t matter that offers to “double your money” from Jeff Bezos, Barack Obama, Kanye West, and Kim Kardashian were simply too good to be true, even with the appeal of “giving back” to help ameliorate the suffering caused by COVID-19. Enough people with enough disposable income to invest in cryptocurrency were fooled.
The exploit
In order to pull off the scam, he would need access to these “blue check” accounts. There are a handful of ways to do it:
With Twitter, you can log in with your username (which is publicly known) and a password. A weak password — that is, one that’s easily guessed, or one of those lazy passwords that too many people use — makes for an easy target. This might work for accessing one or two accounts, but not for a lot of them.
Exploiting some weakness in Twitter’s software or infrastructure to gain access to their system. In spite of the stories you hear about hackers, this is a high-effort, low probability-of-success scenario.
Social engineering: Fooling or intimidating the people who run, administer, or maintain a system in order to get them to let you into that system, or provide enough useful information to do so.
The Bitcoin addresses listed in the tweets turned out to be traceable to Coinbase accounts belonging to Clark’s accomplices, who registered them with their real driver’s licenses. One of them even did so from their home IP address, an amateur move that’s been a staple of computer heist movies and TV series since WarGames, and it was a key plot point in Hackers.
He is 17 years old, a recent high school graduate, and he lived by himself.
A Minecraft player since the age of 10, Clark became known as “as an adept scammer with an explosive temper who cheated people out of their money,” according to people who knew him.
A former Minecraft friend said this of Clark: “I knew he really wanted money and he was never in the right mind-set. He would do anything for some money.” Another friend describes him this way: “He’d get mad mad. He had a thin patience.”
Family life, as the NYT puts it: “Mr. Clark and his sister grew up in Tampa with their mother, Emiliya Clark, a Russian immigrant who holds certifications to work as a facialist and as a real estate broker. Reached at her home, his mother declined to comment. His father lives in Indiana, according to public documents; he did not return a request for comment. His parents divorced when he was 7.”
In 2016, he played in Hardcore Factions — Minecraft with PvP and all the baggage that goes along with it — and built a YouTube audience while doing so. He also scammed fellow Minecraft players: “One tactic used by Mr. Clark was appearing to sell desirable user names for Minecraft and then not actually providing the buyer with that user name. He also offered to sell capes for Minecraft characters, but sometimes vanished after other players sent him money.”
Under the handle “Open”, he gained a reputation for being “a scammer, a liar, a DDOSer”:
Of course, he eventually migrated to Fortnite.
Around the same time, he joined the OGUsers forum. The NYT: “His OGUsers account was registered from the same internet protocol address in Tampa that had been attached to his Minecraft accounts, according to research done for The Times by the online forensics firm Echosec.” On OGUsers, he also disappointed customers by failing to meet his end of the bargain after being paid.
Want to guess where in Tampa he lives? The NYT posted this photo of his apartment. Let’s see if any of you have good satellite image/map image search-fu:
Clark’s apartment. Tap to see at full size.
(My guess is Wesley Chapel, judging from the architecture, artificial lake, and the availability of “stroads” in which to open up the throttle on his BMW. What do you think?)
He moved from Minecraft to Bitcoin.
He was also into SIM swapping, again to relieve victims of their cryptocurrency. Last year, he was involved in the theft of almost $900K worth of Bitcoin, when hackers SIM swapped the phone of a Seattle tech investor. By doing so, they gained access to several of the investor’s accounts. Clark was one of them. Despite being caught by the Secret Service, he wasn’t arrested because he was a minor.
He made enough money to live in an apartment by himself, drive a BMW 3 series, maintain an expensive gaming setup, and own a gem-encrusted Rolex.
Local news could use some local techie help
In my old home town of Toronto, whenever a story like this broke out, the local news stations went to the tech community to get background information. I was often one of those community members consulted:
Unfortunately, there isn’t such an arrangement here in Tampa, so local news’ coverage has had me rolling my eyes. I suppose it made for some good entertainment:
Maybe we Tampa Bay techies need to get on their radar and become go-to people for information when stories like this arise.
At the very least, local news should have The Undercroft on speed dial to provide some much-need background info and context when the story’s about a system being compromised.
Hello, Tampa Bay techies, entrepreneurs, and nerds! Welcome to the weekly list of online-only events for techies, entrepreneurs, and nerds based in an around the Tampa Bay area.
Keep an eye on this post; I update it when I hear about new events, it’s always changing. Stay safe, stay connected, and #MakeItTampaBay!
No tech, entrepreneur, or nerd events have been listed for this date…yet!
Do you have an upcoming event that you’d like to see on this list?
If you know of an upcoming event that you think should appear on this list, please let me know!
Join the mailing list!
If you’d like to get this list in your email inbox every week, enter your email address below. You’ll only be emailed once a week, and the email will contain this list, plus links to any interesting news, upcoming events, and tech articles.
Join the Tampa Bay Tech Events list and always be informed of what’s coming up in Tampa Bay!
Me and Microsoft’s then-CEO Steve Ballmer at the Canadian Windows 7 launch in Toronto, 2009.
Today marks the end of the second week of The Undercroft’s 5-week cybersecurity training program, UC Baseline. This week was a quick but in-depth (we each had a Cisco switch to configure) introduction to networking. Next week, we look at Windows and Linux from a security perspective.
I have some familiarity with the operating systems in question.
Me and Linux creator Linus Torvalds at LinuxWorld Expo NYC 2000.GNU/Free Software Foundation founder Richard M. Stallman and me at the CUSEC Conference in Montreal, 2009.
If you’re bored: When I was a Microsoft developer evangelist (they hired me from the open source/free software world), I won Stallman’s auction for a plush GNU gnu — and paid for it with my Microsoft corporate card. Here’s the story, titled Winning the GNU.
The conference will be made of bite-size (15 minutes or shorter!) presentations by Tampa Bay techies and demos of capstone projects by Suncoast Developers Guild alums. Here’s the schedule, which is subject to update:
Time
Presentation
10:00 a.m.
Opening ceremony
(Suncoast Developers Guild)
Badges? We don’t need no stinkin’ badges!
(Jason L Perry)
Will it Scale?
(Robert Bieber)
11:00 a.m.
Demo: Smash Bros Combo
(Kento Kawakami)
Your Friendly Neighborhood Type System
(Dylan Sprague)
Demo: Evolution X
(Cody Banks & Abtahee Ali)
The Rubber Duck Pal Program
(Daniel Demerin)
12:00 p.m.
Furry Friends
(Colter Lena)
Demo
(Trent Costa)
Don’t Crash! CSS-Modules in React
(Dylan Attal)
How to start your own Coding Podcast 101
(Vincent Tang)
1:00 p.m.
Pull Requests, and the Developers Who Love Them
(Michele Cynowicz)
Demo: Rollerblade Buyers Guide
(Abe Eveland)
Post Bootcamp Reflections: Rebuilding my capstone in React Native
(Liz Tiller)
Create games, visual novels, and fast food dating sims (and learn programming) with Ren’Py!
(Joey deVilla)
2:00 p.m.
Demo
(Rob Mack)
“You do belong here” and other affirmations and ways to beat imposter syndrome.
(Michael Traverso)
A Taste Of Docs As Code
(Kat Batuigas)
Once again, it’s free-as-in-beer (and not free-as-in-mattress) to attend, and all you need is an internet connection! Register here.
In another life, I was a developer evangelist who travelled across North America and I saw tech scenes from Palo Alto to Peoria. I can tell you that one of the signs of a healthy tech community in a small- to medium-sized city is a coding school that acts as a social/technical/gathering place. If your city had one, things were looking up for local techies. If not, it was a safe bet that the place was experiencing a brain drain.
Here in Tampa Bay, Suncoast Developers Guild fills that vital role, and it does so spectacularly. They’re a key part of the heart and soul of tech in the area, and it shows in their efforts, such as events like this.
Thanks, Suncoast Developers Guild! I’ll see you on Saturday!
What: An online workshop where Tampa Bay’s best-known tech lawyer and IP attorney, Brent C.J. Britton, will talk about the intellectual property issues surrounding hackathons.
When: Tonight! As in Thursday, July 30th, 2020, from 6:00 to 7:30 p.m.
Let’s face it: The purpose of many (but not all) hackathons — even if it’s not the primary purpose — is to promote one or more tech company’s wares or services, or to act as a scouting exercise to find new talent. This is especially true when a hackathon is organized or sponsored by a for-profit company and especially when they encourage or require you to use one of their products, services, or APIs.
What if you participate in a hackathon held by a for-profit company and your idea is a really good one? Who owns it?
This workshop will be led by Brent C.J. Britton, local IP/techie lawyer, and generally the first guy I run to when I face some kind of intellectual property issue (and yes, I have, when a copyright troll was getting up in my business).
Check it out tonight!
Here’s Brent’s bio:
Brent Britton is the only graduate of the prestigious MIT Media Lab to become a lawyer. Brent holds degrees from the University of Maine, the The Media Lab at the Massachusetts Institute of Technology, and Boston University School of Law. He is Managing Partner for the Tampa office at De La Pena & Holiday LLP, where he advises companies on emerging business and technology law, intellectual property, complex commercial transactions.
Brent is the author of Ownability, How Intellectual Property Works and one of the most interesting and entertaining speakers in the Tampa Bay area on Startups, IP and related matters. He is recommended on Linkedin by a futurist as: “Visionary, pragmatic, insightful and full of life with a capital L”.
Here’s my daily view for seven hours a day for the next little while, as I’m part of the inaugural cohort of UC Baseline, the 5-week cybersecurity training program from Tampa bay’s security guild, The Undercroft:
Tap to see at full size.
Last week was devoted entirely to the “Hardware 101” part of the program. Here’s a video summary of what happened that week, and Yours Truly’s in a fair bit of it:
This week is “Networking 101”, which is all about how the bits gets transferred across wires and air to our hardware.
One of the exercises is making our own Ethernet cables. I can do it — just, very, very slowly…
Tap to see at full size.
We spent a good chunk of time setting up virtual LANs on our individually-assigned Cisco Catalyst 3750 programmable 48-port switches (alas, we don’t get to keep them), hooking up our Raspberry Pi 4 boxes (which we do get to keep) to them, and wiring our VLANs together via trunks:
Tap to see at full size.
It’s a strange world, where IOS doesn’t Apple’s refer to “iPhone Operating System” — part of my usual stomping grounds as a developer — but in the world of network administration, it’s Cisco’s Internetwork Operating System:
Tap to see at full size.
This is way outside my normal experience with networking, which I do at the application level, where I deal with data structures like arrays, dictionaries, base64-encoded data, and maybe the occasional data stream. This is the world of packets, frames, switching, and routing. I would still probably ruin a server room if left in charge of it, but after this course, I’d ruin it less.
I do have a refreshed generalized concept of what happens at the lower levels of the network, and that’s the important thing for me and the sort of work that I do.
