Wednesday, February 29, 2012

WEP at a doctor's office?

In light of some recent events, I'm going to do my token "Full-Disclosure" blog entry right now. I'm going to discus the dangers of using Wired Equivalent Privacy, or WEP, to secure a WiFi access point. WEP is now fully depreciated, has been for some years, and more detailed explanations are vast on the 'net. My hope is that some one will read this, and then think twice about implementing WEP.

Side note: WEP does have its place, and I'll get to that.


Imagine, if you will, a doctor's office. Now, imagine a disgruntled divorcee. (Warning, the divorcee's language is very NSFW. If you're reading this line, then the NSFW content is already visible on your screen. lol)


    "I fucking hate that bitch! She got everything in the divorce! The house... the kids... my Corvette... I even lost my job and half my friends! I want her life to be as ruined as mine! I want her to lose her job! Now, I know you can to all that 'hacker' stuff. I want you to ruin her employer's network so they go out of business or get in trouble or something. I want revenge. I'll pay you a thousand dollars!"

Not at all a far-fetched scenario. And, if I'm, hypothetically speaking, taking the place of the nefarious individual with whom the divorcee is speaking, all I heard was "...a thousand dollars".

Now lets hear from our hypothetical bad guy hacker cloak and dagger whatever.


    "Dude, it was hella easy. All I had to do was spend a few hours in the parking lot across the street. I connected a USB WiFi dongle to a USB extension cord so I could run it out my moon roof. Then booted up BackTrack and, well, I'm not some damned skiddie, but I wanted to be as fast as possible, so I used Kismet to locate their WiFi, used Gerix to crack their WEP key, and the rest was pretty easy. They thought that they were playing it safe by requiring users to authenticate to a Radius server, but not really. I just changed my MAC address to one of the devices already authenticated - I think it was a Cisco VOIP phone - to prevent the network from booting me every five minutes. Then I just did a little ARP Poisoning with Ettercap causing a copy of all network traffic to be routed to my laptop. Then I opened up Wireshark to record all of the data. Later on, at home, I reassembled that captured traffic, and actually got some fascinating stuff. Some emails, a couple phone calls, x-rays, cat scans, ultra-sound, and just a TON of transcriptions destined for patient's charts. I gave this info to my dude, who gave me the grand he promised"
"What happened next?" we  ask our shadowy fiend.

    "I gave him his info, he gave me my money... I'm not exactly sure what he did with it, since I don't really care, as long as I got paid... But... I do remember hearing something in the news about that place. Yeah, they had some 'hippa' violations, and got sued by a bunch of patients. They settled out of court, but that's not what put them out of business. I guess that after this happened, their physicians couldn't get any malpractice insurance, and had to give up their doctoism, or something. Everyone lost their jobs."

"What did you do with the money?"

    "I used to to buy a motorcycle."


See? See why WEP is a terrible idea when security is your goal? Don't use WEP, unless you want to get in trouble, and let some black-hat hacker buy a motorcycle via your hardship and woe.

Why would anyone ever want to use WEP? Well, it's kind o a psychological thing, really. Think of it as a property marker. WPA is like a chain link or wooden fence. WPA2 is that same fence, topped with electrically charged razor wire. WEP is nothing more than a few sticks with pink spray-paint, delineating where your yard begins and ends. Some one would have to knowingly "trespass" your WiFi yard. It's like saying, I'm not really going to make sure that you can't get into my WiFi, but I'm making it well known that I don't want you there, and have legal recourse if you do break in.

That's stupid, though.

The other use that I can think of would be a diversion, like a WiFi honeypot. Set up a WEP network with some computers on it doing mundane things filled with useless or false information. Hopefully, the attacker will hack into your WEP WiFi, and ignore the one you've secured with WPA2 and made "invisible".

The most important thing we can do with WEP is use it as an example of what NOT to do, and to make jokes about it.

I like to refer to WEP as "Weak Encryption Protocol".

Final Presentation

I decided to table the blog entry I was working about liars.

Last night I had the opportunity to sit in on a presentation that some students did. This presentation was sort of the final test for them to receive their degree. It was somewhat reminiscent of a review board one may encounter in any industry.

I'd  like to offer some observations, but I won't get into any detail, because I'd rather not identify the individuals in the group - I'm not trying to criticize here.

That being said, it seems that the major challenges this group faced were challenges common to any project that requires a presentation. Specifically, I saw three major flaws with the presentation itself, and one major flaw on the material presented.

The first flaw was something inherent to public speaking, and is a difficult skill to develop if it's not something that comes to you naturally. A good deal of this group stuttered, stammered, and just plain froze-up. It happens to the best of us. However, this project was to simulate a company getting a contract. If I'm considering hiring a company to do a job, and the people sent to my office to present all seem scared and grasping for replies to my questions... yeah, they're not getting my contract.

REHEARSE! 
Rehearsing your presentation is an absolute necessity. I'm not saying that this group didn't rehearse, but they definitely stood to benefit from MORE rehearsing.

The second flaw was with their documentation. The cadre on the review board, as well as some of the spectators, brought up a couple of good points on this. One slide dealt with a particular technology. The next slide dealt with a wholly different technology, but because not the title, nor the bullet items, but the subtitle from the previous slide was erroneously carried over to the next slide, this group misrepresented two of the products involved in their service. It was clarified, but no doubt, points were taken off. It was a minor error, but the next error was not so minor. One of the other people sitting on the review board noticed a discrepancy on the cost-breakdown, one that would cost the client around $7,000. To a choosy CEO, that's possibly enough to Kibosh the entire show.

Make sure your documentation is 100% accurate!
Seems like kind of a no-brainier, and perhaps an insurmountable task, but it could be the difference between winning or losing a contract. Lose the contract, lose money. No money, no food. No food, you dead! The financial error really surprised me. The group used Microsoft Excel to make this part of their presentation. Why then, I wonder, did they not utilize the calculation features of Excel? The error occurred when certain items were removed from the list, and the total costs were updated erroneously, or not at all. When used correctly, Excel takes care of all of that for you!

Finally, there were questions asked of the group, and no answers were given, other than "Oh, I'd have to look into that and get back to you." After about the third or fourth one of these, one of the cadre replied "Yeah, I'll be expecting that answer next quarter." which is funny, because those students were supposed to be graduating this quarter.

Be an EXPERT!
There were five people in this group. While no one person could be an expert on everything in it, there should have, given the information presented, and keeping with common current affairs in their particular discipline, been zero questions that went unanswered. Again, this may seem harsh, or even impossible, but allow me to explain.

Remember that fourth error I mentioned? The one dealing with the presentation itself? Well, it had to do with security. Since network security (and compliance with HIPPA) is a huge facet of building a network from the ground up, at least one person in that group needed to become an "expert".  I'm using the word expert loosely, here. At least one person should have been able to explain what their honeypot actually does, or how they plan on defending against a DDoS, a very very common form of cyber attack. And finally, some one should have been able to defend their choice of using, of all things, WEP, to secure their WiFi.

It was clear to me that not one person in the group was an expert on security (or even knowledgeable). I'm not saying that everyone should be as focused on, *ahem* hacking, as I am, but if I'm told to present a topic on something, I had damn well better figure it out. If anyone of these people had Googles 'WEP', they would have made a better choice.

Again, I'm not trying to criticize, I'm simply stating that there were things that should have been done better - things that are not specific to anyone presentation, and are, in fact, common to all presentations.

Rehearse | Become knowledgeable (or expert) in what's being presented | Eliminate typos!


On the flip-side, the groups information that was correctly presented was pretty spot on! I'm sure that they had passed their review, and will be cleared to get those lovely pieces of paper that say "Gradamatated!" on it.

Again, while this was an IT presentation, these faux pas are common to any type of presentation. Regardless of what you're presenting, make sure not to make those basic mistakes!

Friday, February 17, 2012

High School Mischief

As I thought about how funny these two stories are (to me, anyway), I kept remembering more and more details. I thought about adding them in, and then having to clarify and stating my moral stance on things like ethics and hacking and school kids doing things on the computer that the adults don't want them to (the same adults who only knew the difference between Microsoft Works and Claris Works, and tying meccpro on the older computers would bring up WordMuncher, yadda-yadda-yadda®, and decided to just say "fuck it" and write the damn blog.

Have whatever opinions you want. I don't care what they are.

In my freshman year, I had decided that my high school, and everything in it was really out dated. I'm not going to mention the school's name, because, truth be told, it's a lot better now. There's a five and ten year gap between my younger siblings and I, and from what they've told me, the school has improved vastly. When my little brother graduated (early, w00t), they even had their own robotics and programming teams. Not too shabby.

But back in 1999, when I was 15, the only computer related classes were Intro to Computers and Intro to C++. Boring classes, but computers where one of my hobbies, so I took them. And this was before I knew anything about hacking.
  • Hacking:(computing) Playful solving of technical work that requires deep understanding, especially of a computer system.
    From hacker: "A person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular."


I didn't know it at the time, but by definition, I, and many of my friends, were already "hackers". Neat.

Lots of good fun that is funny!
So the school network, back in the day, ran on a network operating system called Novell. Novell sucked then, and kinda sucks now. I had heard a rumor that a student was able to get what the rumor mill was calling "admin" or "super user" access to the network. Immediately I imagined Mathew Broderick in WarGames changing his love intrest's biology grade from an F to an A. I personally would never do that (an A would be suspicious... maybe a C...) but I bet there was some fun to be had.

I thought in reverse, something that has proved invaluable to me. I went to a search engine (probably Yahoo, since I hadn't yet decided Google was right for me), and searched "How do I stop users from getting admin?" That's when I discovered The Net Plug exploit. It ran like this: I intentionally screw up my log in three times to get locked out of my account, reboot the computer, and press 'del' to get into the BIOS menu. Then I tell the teacher that my computer's messed up. The IT guy comes and boots the conmputer into Windows. At the log in prompt, I tell him I'm logged out. I tell him my username, and then run to the bathroom holding my tummy and ass. Then I have some one... we'll call him P---, run interference. He laughs and yells as run out "I told you not to eat that chili!" The IT guy logs into his account on my workstation and resets my password. I spend at least 20 minutes in the can. IT guy gets impatient, writes my temporary password down, gives it to the teacher, and tells him it is very important that I change my password as soon as I log in. As soon as the IT guy leaves, P--- unplugs the network cable to my workstation. I return, with only a few minutes of class time left, and reboot the machine. With the network cable unplugged, I select the option that allows me to  - without a password or user name - log in to the local machine. Then I plug the cable back in. Confused, Windows asks Novell what user I  am. Just as confused, Novell tells Windows that I'm the IT guy. And in true retard fashion, Novell asks Windows who I am, and Windows tells Novell that I'm the IT guy.

Guess what? Now I'm the IT guy.

Using the IT guy's account, I created several student accounts that had admin level access, and used them to create users that had teacher level access. The I changed my password, and never logged into any of those accounts I created, out of fear of being caught. They were all set to expire in December of 2003. And so it goes.

But I did use this "thinking backwards" method for more fun. In stead of searching for "How do I bypass Bessie Content Filter?", I searched "How do I prevent users from bypassing Bessie Content Filter?" And I did the same thing for Novell Messenger. These searches led me to regedit.exe, which allowed me to disable the content filter, and enable the messenger. Cool, I guess. I looked at boobs and paint ball guns and IMed other students.

"What a slacker!"

Sure, why not. Call me a slacker. Other shenanigans involved pranking some of my friends. Let's call one of them E---. It was my turn to prank E---, and I knew that the teacher of Intro to Computers has a pet-peeve; he hated when kids wrote on his dry-erase board. He also had a habit of yelling really loudly, and suffering from halitosis. So, naturally, when he wasn't looking, I wrote on the board.

I wrote: E---HAS NO WIENER!!

Then I pointed to the board and said "E---! Look what I, Tony, have done!"

He retaliated by erasing his name, and writing Tony, except before he got finished with the 'n', I yelled "MR. S----, LOOK WHAT E--- IS DOING!" And E--- had to smell Mr. S----'s perpetual fish breathe.

Then, when I became a high school upper classmen, I went to the local vocational school to study computers even more. (Better than burying my face in a history book from 1976, right?)

At the vocational school, we learned about Net Send, something more useful than Novell Messenger, since it didn't require us to change anything. Our computer teacher actually encouraged us to use it when working on assignments that allowed collaboration, as it would keep the noise down. We found a little utility that used a GUI, and everyone downloaded it. Then, the school's head IT guy discovered it on my computer, and threatened to have me expelled. The teacher threw me under the bus, claiming she had never condoned the use of Net Send. (Italicized because you know who you are). I was facing a suspension, and being prhibited from touching a computer on school grounds, meaning I would have to drop out of my computer classes, and return to the high school I had just escaped. Luckily for me, my nerd like qualities had me in places of power in a ton of student organisations, and was actually an intern on the school's marketing/PR department (and later IT department. Go figure). I pulled some strings, and got out of it. Politics are the devil, BTW.

Anyway, I kept the whole Novell messenger thing a secret until there were only two weeks left of our senior year. I told some students who where in some other computer classes. (I was in networking, there was also the Cisco class that I was supposed to have been in, a business class, electronics, and programming & web design.

Some how word of my dry-erase board trick spread to a student in the electronic class. A student named C----. C---- was good friends with E---, and thought that was hilarious. He also thought, during a project that involved all of the classes, that it would be funny to send E--- the message "E--- HAS NO WIENER!!" during class. But he didn't stop there. When selecting the recipient of the message, he clicked on EVERY SINGLE USER NAME IN THE SYSTEM.

Let me explain that a little better. Novell Messenger is an administration utility for admins to send messages to users, so the sender is presented with a convenient list of every single user account. That's teachers, students, other IT personnel, the secretary, public relations (yes, we had a PR department), principle, vice  principles, the janitor, EVERYONE! Now, let me explain why, in addition to users, servers were included in this list. If a specific server needed to be rebooted, for whatever reason, an admin could message that server, and the server would in turn forward that message to every user on that server. Student server needs rebooting? Send this message to student.server:

    Attention users, please log out within five minutes and do not log back in until an announcement stating that it's okay to log in or all your progress will be lost.

You get the idea now, right? Anyway, he selected the servers too, so after the shock set in, and the student or teacher selected "OK", they were presented with the message again. 


Suffice it to say, the entire school came to a screeching halt. The cherry on top was when the loud speakers, throughout the school, rang out with "C----- T-----, please report to the office. C----- T-----, please report to the office, IMMEDIATELY!"

But wait, there's more!

Allow me to explain the vocational school's relationship with the highschools in the county (and one in a neighboring county). Students who's grades were high enough had the option, in 11th and 12th grade, to either spend the entire day at their high school, half at their high school and half at the vocational school, or the entire day at the vocational school.

While I spent my entire day at the vocational school, many did not. So, naturally word spread to the seven high schools that feed into the vocational school, but it happened faster than you might think. That's because the principles and vice principles were connected, probably via a VPN, to the vocational school's network, so they got this pop-up message as well!

Aaaaaaaaaaand

Then there were the students at the vocational school who weren't in a computer class, and there for didn't use a school computer every day. But those students all had reports due before finals week. Whether it was an entire English class using a computer lab, or a couple of cosmetology or mechanics students in the library, all students would eventually log in. And one by one, they were all greeted with:
    E--- HAS NO WIENER!!

"Who the hell is E---?" they'd ask each other. "Who is C.T----?" and "E--- has no wiener!" they'd shout!

It left a legacy. Years after my departure, they were still talking about the user C.T----- and the alleged eunuch  named E---.


Epilogue:


'Hackers', MFW
 Does screwing around on the computer mean that s student is bad and won't amount to anything? During middle school, I was involved in a group called Civil Air Patrol. CAP is the civilian auxiliary of the United States Air Force. Although many saw it as a weird Boy Scouts clone, CAP is actually responsible for over 90% of all inland search and rescue operations in the United States. In addition to learning about aeronautics & aerospace, flying a single-engine aircraft (with instructor pilot), learning about and using two-way radio communication, building model rockets and flying them in competitions, learning basic survival skills, and training for search and rescue with CAP and other organizations, such as the USAF, Air National Guard, Air Force Reserve, local, state, and county law enforcement, and becoming acclimated to a military way of life, we actually went on search and rescue sorties and found downed aircraft.

Later, in high school, I was the president of our local chapter of Key Club, the secretary (then later vice-president) of our school's Business Professionals of America chapter, a tour-guide for groups of prospective students that would come see the school, and a school representative that would go to the local high schools, and give a presentation to the students there. I was a journalist in our schools chapter of the CNN Student-Bureau. I also interned for the school's IT department, and the IT department of one of the other high schools. I also had a full time job,and bills, the entire time.

And then how did this SLACKER do at graduation time? I'll let my two honors diplomas speak for themselves.

I went on to study aeronautics and spent some time in the Air Force Reserve Officer Training Corps. I am now an FAA licensed pilot, and I am currently studying computer forensics and network security at the collegiate level.

I'm not trying to brag, just trying to preemptively address some of the "kids shouldn't screw around at school or they'll spend their life flipping burgers and America will degrade and be invaded by Canada and Mexico in a hundred years." rhetoric that fucking morons always spew when they encounter anything involving students "screwing around" with computers. I guess they forgot about the students who lit stink bombs and stuff when they were kids. Or maybe those pranksters didn't do as well in life as the "hackers" did? I don't know.

I've rambled.

tl;dr Hackers, FTW. Old people are teh lulz

Sunday, February 12, 2012

Lowe's Wants You to FAX a Signed Form to LINK TO THEIR SITE!

I just read over at&
nbsp;Ars Technica that Lowe's thinks that it has the legal authority to make people download a form, sign it, fax it to Lowe's, and then wait for Lowe's to grant permission before anyone can post a link to Lowe's website!

This is what happens when, in business, the people you put in charge of internet things don't know shit about the internet! The experts are the people that old people (like congress) call "nerds".

To keep it short, Robert Downy Jr. said it best. Lowe's, are you listening?



http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com http://www.lowes.com

Thursday, February 9, 2012

Are You Ready To Get Your Geek On?

Are you geek chic?

The WOPR (War Operation Plan Response) is a (fictional?) machine that calculates all of the possible outcomes of various types of warfare, and if the nuclear football is activated, and The Button is pressed, it bypasses those guys with their keys in the missile silos and...

Anyway, I've only been able to find it in one place. http://wopr.adelphos.org/ But if you wan't to talk to "Joshua", you'll need telnet. It's an included utility on most Windows, Linux, and Mac computers. (Hehe. Mac 'computer')

Get to a command line.

In Windows, do:

  color 0a
  telnet
  open
  wopr.adlephos.org


It's essentially the same for Linux, except that for each version, there are different ways to change the display color. I'm old school, so I like green (or amber) on black.

For Macs... I don't know. Google it. 98% chance that all Mac users are hipsters, or geriatrics. I made that up.

How about an Android phone? If it's rooted, install a terminal emulator (change it to green on black, punk!)

It's a little trickier, but let's work through it.

In a terminal emulator on Android do:

  ping wopr.adelphos.org



Once the hostname has been resolved to an IPv4 IP address, press your escape key, and make note of the IP! (Your escape key is probably the Volume Down buttone, and the 'c' key, at the same time.

It will look something like this:

 Pinging wopr.adlephos.org [216.146.35.99] with 32 bytes of data:
 Control-C
 ^C


Now that you know the IP, you can continue.

In a terminal emulator on Android do:

  Su
  busybox telnet 216.146.35.99


YOU'RE IN THE MAINFRAME!
Greetings Professor Falcon. Would you like to play a game?









The firmware update is in the coffee machine.



There are a lot of fun things that you can do with telnet, if you're geek enough. Here's a good place to start: http://telnet.org/htm/places.htm One of my favorites is Blinkenlights.

Try towel.blinkenlights.nl for an ASCII version of Star Wars: A New Hope. Need an excuse?

The Bastard Operator from Hell has got your back! Try towel.blinkenlights.nl:666 for your custom excuse!


Addendum:

Microsoft is far from perfect, and they really screwed up when the left Telnet out of Vista and 7!

Users of Windows 7 or Windows Vista (lol) may need to add Telnet to their machine. http://technet.microsoft.com/en-us/library/cc771275(WS.10).aspx says to go to a command prompt, and do:
  /iu:"TelnetClient";

It worked for me, but I also had to follow the steps on this page: http://technet.microsoft.com/en-us/library/cc771275(WS.10).aspx#bkmk_installVista

To install Telnet Client on Windows 7 or Windows Vista
Click Start, and then click Control Panel.

On the Control Panel Home page, click Programs.

In the Programs and Features section, click Turn Windows features on or off.

If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

In the Windows Features list, select Telnet Client, and then click OK.


Good Luck!

Parenting is a lot like watching the TV show COPS

A few weeks ago, I was minding my own business, when my freshly-turned-two-years-old daughter expertly threw my cellphone, from across the room into the only remaining cup of Tang® left in the house. (I can't drink orange juice daily, or I might get cancer. Long story) Huddled over the mess of sticky orange carpet and citrus scented malfunctioning cellphone, I remained there, motionless, whimpering like a defeated wus. And as she did her happy dance, I could tell that, in her mind, she was saying: "Ha-ha! Ha-ha! Look at Daddy cry! Hahaha!"

Kids! am I right, fellas?

One spiffy little day in February, I was sitting at this very desk, and realized that I was the only one in the room watching SpongeBob SquarePants. Not a big deal, really, because I enjoy the "grown-up" jokes, like The Six Million Dollar Man sound effects, and the actors Ernest Borgnine & Tim Conway and Adam West and Burt Ward playing young and old Mermaid Man and Barnacle Boy, respectively.

But where was little Miss Julie?

I peeked into the kitchen to see a shirtless toddle sitting under the table. If there's one thing I've learned from watching COPS, it's that if you are shirtless when the authorities arrive, you ARE GOING TO GO TO JAIL.

She spotted me, hurriedly put something in her mouth, and looked away, hiding her face from me.

"Julie?" I asked. Nothing. "Julie..." I said, more sternly this time. She immediately stood up, scrambled toward the living room, and some how pranced around me, evading my grasp, and panting like a mad-man all the way. And as she passed, I heard an all-too-familiar clanking noise coming from her mouth. A PENNY! 


"JULIE! COME HERE!" I shouted, as I tried to catch her. I don't know how a kid can be that fast! By the time I got into the living room, she was already half-way up the stairs. "Julie, STOP!" I yelled.

"NYO NYO NYO NYOOOO!" she replied, as she hurried into her room. I finally grabbed her, and she started wrestling away from me.

"Spit it out." I said, in my most authoritative dad voice. "Spit it out! Get that out of your mouth! Don't swallow it! Spit it out!" Sound familiar? Come to think of it, not only was this like an episode of COPS, it was a lot like my old job. (security/private police)

"Spit it out, Julie!" Finally, she complied, by spitting the penny into her hand. She then flung herself to the floor, laying on her hands.

"Julie!" again with the dad voice. "Julie, give me your hand.... Julie... Gimmie your hand, Julie! Get your hands out. Gimmie your hands! Julie! GET YOUR HANDS OUT WHERE I CAN SEE THEM! STOP RESISTING! STOP RESISTING!" She threw the evidence. She threw the penny underneath her bed, like oh so many crims have done before... running from the police... throwing their bag of wee or crack out the car window, or into some shrubbery. She. Threw. The Evidence.

And that's not the only time, either. I swear she's never once seen an episode of COPS, and yet she knows, almost everytime she has something she's not supposed to, that if she THROWS AND HIDES THE EVIDENCE, mom and dad won't be able to prove anything!

But, lucky for me, parents don't need proof of penny consumption to place an offender in time out. After that particular penny incident, I gave her a harsh, 30 second sentence in the corner. Sadly, she didn't learn her lesson. Yesterday afternoon, I heard some papers rustling, and found her with my math notebook in her hands. All I said was "Julie?" in a normal, not dad sounding voice, and she tossed the notebook under the desk.

Gee Whiz!

#################################################################################
UPDATE: Just now, she was struggling with her pink, pint-sized folding chair, so I put it upright for her. She screamed "Nyoooooo!", whimpered, and melted to the floor like a fun-sized puddle of depression and angst.

"I'm sorry, did I ruin your life?" I asked her, "I'll never do it again. Except, every day, probably, because I'm a dad, and that's just how we roll."

Then she chased both cats with my replica phaser screaming "DIE DIE DIE!"

I'm scared.

Extrinsic in Ohio (Things that are here because they don't know any better)

Perhaps some of you who will read this are somewhat familiar with this story.

If I were to consider the total waking hours of time that made up my early childhood, I would imagine more than half of those would have been spent in the city of North Royalton, Ohio. For those of you not familiar, North Royalton is a city near Cleveland, Ohio, in Cuyahoga County, and in close proximity to the Cleveland Metro Parks. It is on the b order of what some older Clevelanders refer to as The Emerald Necklace - that is, the rural area surrounding the metropolitan area of Cleveland.

My hometown of Westfield Township is located in the southern portion of Medina County in Ohio, which is a decidedly rural area. Ironically, I have encountered much  more wildlife in Royalton than Westfeild. And my most recent encounter was a year or two ago in the basement of a house in a suburban area in Royalton. It was a Hogna Wolf Spider. A terrifying experience for an arachnophobe, such as my self, especially considering I had only a damp bathrobe to defend my self with.

This spider was, including the legs, a good four to five inches across. It was highly aggressive. As soon as I entered the room, it turned towards me and we both froze, staring eye to eye (to eye to eye to eye etc.) Every side stepping move I made was matched by the rapidly approaching spider. I'll spare the details of how I killed it, because this isn't a snuff website. A small part of me felt bad for killing it, but I felt like killing it was the only way to be sure it wasn't going to bite one of us.

So anyway, this generated some discussion in the break room at work. I had no idea what kind of spider it was. I described the apperance and description of the spider, and everyone told me it was a Brown Recluse. Okay, sure. I thought. But when I got home, and did some Google-ing, I learned that the Brown Recluse is very RECLUSIVE, hence the name. They're also very small, and have a different body shape than that of Wolf Spiders. Okay, so, not a dangerous - and potentially deadly -  Brown Recluse. Just a Wolf Spider, who's bite won't kill me, or put me in the hospital (unless I'm allergic), but will still hurt really REALLY bad.

But this bring me to the topic at hand. As I said, everyone one in the break room and at the office told me that it sounded like I was describing a Brown Recluse, and they were all 100% wrong. Except one guy. He told me that it didn't sound at all like a Brown Recluse, and that it could not be a Brown Recluse, because they do not live in Ohio! This is where I have a problem.

Wikipedia indicates that the Brown Recluse's habitat does not include Ohio. Wikipedia: Brown Recluse Spider Also from Wikipedia, is the definition of the word habitat.
habitat (which is Latin for "it inhabits") is an ecological or environmental area that is inhabited by a particular species of animalplant or other type of organismWikipedia: Habitat

So, in Ohio, the local ecology and/or environment is not suitable for the Brown Recluse. Maybe it's not warm enough for her. Or maybe it's not humid enough. Or maybe there aren't enough of whatever they eat to keep them fed. But consider this: The environment - the climate - changes from time to time. Whatever your feelings of gloabl warming, any almanac will tell you that some summers are warmer and more humid than others. I remember a few years ago we had a very mild summer, with temperatures in the mid 60's to low 80's every week. This summer, by far not the worst in recent Ohio history, has seen upper 90's. 

So let me pose to you this little though experiment: For one summer in Ohio, it's warm enough and humid enough for not only the Brown Recluse to hang out in our lovely forests, but also whatever little bugs these things eat. Is the Brown Recluse going to walk up to the border of Ohio, stop, check it's National Audubon Society Field Guide, and say 'Oh snap! I'm not supposed to be here! Later ya'll!" and run away? No, it will just continue to where ever it's stomach takes it.

So what indication do I have that this has ever happened? Firstly, only anecdotal evidence. A very good friend of my father's was bit, while sitting on his porch in northeastern Ohio, by a Brown Recluse, and nearly died. Now, for  less anecdotal evidence, are the toxicology peeps over at Medina General Hospital. I happen to have some connections at Medina General, and I asked if any one had ever been treated there for such a bite. Not only was the answer "Yes", but I was told that it was around A DOZEN BROWN RECLUSE BITES PER YEAR! What floored me even more was the news that there were just as many BLACK WIDOW BITES per year!  OH SNAP!

Now, if you're reading this blog, have I proved to you that the Brown Recluse, and Black Widow, live in Ohio, even though all the textbooks out there say that they don't? No. But I invite you to ask around. Go to a hospital's website, and contact the appropriate people. Email them and ask them if any one has ever come in with a Brown Recluse or Black Widow spider bite. 

Well, as far as I'm concerned, the myth of Ohio being free of the Brown Recluse and Black Widow spiders has been disproved. But wait, there's more!

If you're an Ohioan, you may have heard some one tell you that there

########################################################################################
This is another post that I did not finish. I started it some time ago, and decided that it was little more than a rant, and didn't really need to be published. When I came across it today, however, I decided I would publish it for this simple fact: Despite what you have heard, there are deadly animals in Ohio. I've now encountered one Brown Recluse, One Black Widow, and one Black Widow Killer (a less dangerous cousin of the Black Widow), and one Eastern Massasauga Rattlesnake. I've also had nearly close encounters with Cougars (not just the old lady kinds, but the Puma (a.k.a. Mountain Lion) kind) and Black Bear.

These animals were not brought here by humans. They got here all on their own.

I would like to point out that one time, in highschool, I was in the wrong place at the wrong time, and witnessed some PETA wanna-be types releasing a Black Panther into the woods of Lodi, Ohio. It was recaptured after a few days. Made the most terrifying shriek I've ever heard. Worse than the noises that rabbits (they're VERY loud) and deer make at night, and louder than a Bobcat. These, BTW, all also live in Ohio.

I've never encountered a wolf in Ohio, but there are (very rare) roving packs of wild dogs that are pretty dangerous, as well as coyote. As for me, the only hazard I've ever had from a coyote is that in Stow, Ohio, they get the size of Labradors, and like to hang out on the runway at the Kent State University Airport (K1G3). I've had to abort many landings because of their obnoxious "I own the airport" attitude, not unlike many of the human residents of Stow.

KTHXBAI

Halloween PhotoShop

FIRST: If you have questions, GOOGLE! If Google doesn't help you, ask me. I'll answer any questions, but I'll know whether or not you Google'd first.

My wife (http://jubeescraftbox.blogspot.com/ and http://craftygsquared.blogspot.com/) suggested to me today that I might share some of my "spooky" images on my blog with a little instruction on how to do these. Well, the first challenge was finding spooky or scary images. I've had an over active imagination my entire life, and have become somewhat immune to things that are supposed to be scary. I'm frightened by things like global security and the ever nearer specter of nuclear warfare, not ghouls, ghosts, and goblins. But I have done some PhotoShop-ping that one could consider spooky. I'll put them up here and talk about them.

Adobe PhotoShop CS4 64-bit is my current weapon of choice, but I am in no way endorsing that product. There are many many alternatives, usually inexpensive or free, to PhotoShop. There are even web-based alternatives ( http://www.lifeclever.com/10-free-web-based-alternatives-to-photoshop/ ), as well as some powerful apps for iOS, Google Android, and Google Chrome. And there are limitations to PhotoShop. I'll still use an old, old program called Macromedia Flash MX for certain tasks, as well as good ol' Microsoft Paint.

Since I'm most well versed in PhotoShop, that's what my instructions will be tailored to. I'm not going to discuss Windows vs. Linux vs. Mac. If you don't know, I can't help you. You'll notice that I'm talking about keyboard keys that aren't stupid, so you know I'm not using Mac. Does PhotoShop exist in Linux? I don't know. (No, WINE doesn't count as Linux) I'm not talking about GiMP, so it's a safe bet that I'm using Windows.

When editing images like this to create digital visual art, PhotoShop, or Shopping becomes a verb when discussing the act of creating such work, and another noun, when describing the finished product. And, around the internet, people also use these words to describe works that haven't been created with PhotoShop. Shop got changed to shoop. Shoop got changed to sh00p. So until Webster's has a better term, I'll refer to these works as either shoops, or more annoyingly, sh00ps. (That's two zeros, not O's)

The key to a good sh00p is subtlety. I'll usually start with a base image, and make a duplicate layer to backup the original image. I'll make another layer, and add in the desired effect. usually, I only want a certain part of the image to have this effect, so I'll apply a layer mask.

After I've added in the layer mask, I'll select it and press [ shift↑ + F5] to bring up the "Fill" window. Select the color "black" (#000000) and now the layer you just edited will vanish. You'll make that layer show up only in the spots you want with the Brush tool. Select the Brush tool, and use settings that will allow you to remain subtle. Remember when I said that was important? My favorite settings for this are a hardness of 0, opacity of 50%, and a flow of 16%. These are not the best settings for everything, they're just where I start out, so give it a try and experiment. So now with your brush settings, set the color "white" (#ffffff), select the layer mask, and now color over the areas of the image you want to have your effect. You'll probably have to go over areas more than once, and you'll see the effect coming through.

This layer masking is the most common tool I use, but not the only one.
Leaving Purgatory

Now we'll look at some examples. Leaving Purgatory is the picture you see to the right. It's really a very simple sh00p made up of a few basic effects, and lots of layering. The base image was duplicated, of course, and then I inverted the color mapping by pressing [ctrl+i]. I added a layer on top of that, and with the same brush settings I talked about before, gradually  blacked out the eyes. Another layer on top of that, and I blacked out the areas around the figure in the image. Took all of ten minutes, and it's one of my favorite examples.
For Brandi

For Brandi is another very basic sh00p. I took image of the skull, duplicated the layer, and used the Hue/Saturation (image -> Adjustments) tool to get the desired effect of the glowing eye sockets. Of course, this effect is applied to the entire image, so I had to use a layer mask and the paint brush to get it only where I wanted it. I made another duplicate of the base image, and used the Smudge tool to drag those fangs down and make them all vampirey. And then some other minor effects for the background, etc.












Spooky was a a celebrity's head-shot that I blurred and distorted with the Smudge tool,  Liquify tool [ctrl + shift↑ + x] and the Gaussian Blur tool (Filter -> Blur -> Gaussian Blur) And then some layers for shading and the red eyes, again made with the brush tool.




I see a TON of messed up stuff in my dreams. Leaving Purgatory was from a dream. These next few are just really weird and abstract things that I dreamed about.

###############################################################################

I didn't get around to finishing this, and as you can see, it's well past Halloween. I'm going to publish this anyway, but if you have any questions, or want to see more, leave me a comment here, or find me on Twitter, or G+, or something like that.