6 ms·

The Burglar with His Very Own Mac Attack

110 points by kposehn 11y ago

BWStearns 11y ago
It's always interesting to see the systems that get engineered (engineer themselves? abiogenerate?) as externalities. It's like a scaled up pathological version of https://xkcd.com/1172/ https://xkcd.com/1172/ I don't think this is common enough to justify having pentesters think about your corporate procedures' exposure to such behavior but it's definitely an interesting thing to think about when designing sensitive human or mixed human/computer systems. Edit: word building fix
HoopleHead 11y ago
I know it was just a taster, trying to interest us in a forthcoming book. But, nevertheless, I thought that story was very long on hyperbole and very short on detail.
- egjerlow 11y ago
  Exactly. In what way did roofman engineer the toys-r-us store? What kind of regularities did he exploit in his burglaries?
andkon 11y ago
This reminds me a lot of BLDGBLG's post about Die Hard's architecture[1], especially this line: his dream house included a maze of trap-doors and what Sergeant Scheimreif called “escape holes.” It was everything he seemed to want a building to be—with near-infinite ways of getting from one room to another and no upper limit on the places he could hide. This stuff is a weird obsession of mine, probably stemming from being a skateboarder for my whole life. Eventually, you realize that all space is something you can rearrange. [1] http://www.bldgblog.com/2010/01/nakatomi-space/ http://www.bldgblog.com/2010/01/nakatomi-space/
- detaro 11y ago
  It is by the same author, Geoff Manaugh. I find his writings work best in collection, e.g. if you read a lot of BLDGBLOG. In the individual pieces the meta-level ideas are kind of strange, if you read more and find the same aspects over and over again it makes more sense.
- SixSigma 11y ago
  Reminded me more of H. H. Holmes' Murder Castle Some victims were taken to one of the rooms on the second floor, called the "secret hanging chamber", where Holmes hanged them. Other victims were locked in a huge soundproof bank vault near his office, where they were left to suffocate. There was also a secret room that was completely sealed by solid brick that could only be entered through a trapdoor in the ceiling; Holmes would lock his victims in this room for days to die of hunger and thirst. https://en.wikipedia.org/wiki/H._H._Holmes https://en.wikipedia.org/wiki/H._H._Holmes
- percept 11y ago
  Interesting seeing both the architecture of the building in the movie and the movie itself differently. It wasn't featured quite as prominently in the film, but I wonder if the use of "The Carter" (and its real-life counterpart) in New Jack City isn't similar. Other examples?
- chiph 11y ago
  I'm surprised there wasn't a mention of Brazil, where the hapless apartment dweller Buttle was incorrectly arrested by Information Retrieval forces descending from the floor above.
beejiu 11y ago
This page has download 20MB of content in about 20 seconds. Despite having a top of the range iMac, I can barely scroll the page without lag.
- yetihehe 11y ago
  Get adBlock. 3 year old laptop plus firefox and I didn't see any slowdowns.
- wtbob 11y ago
  Hey, you need to download 20MB (much of that executable code) in order to read 10,349 characters! It only makes sense that it would take 2,026 bytes to deliver each character you read. Quit hating on JavaScript. It's the future of the web. The Future of the Web.
- techdragon 11y ago
  Worked pretty good on my iPhone 6 Plus.
marincounty 11y ago
When I was in college, I had a security job. I literally watched a huge building on the weekends. It was in a bad part of town, so walking around that big, dark building was nerve wracking. I had a time clock, and had to punch 15 keys per hour. For two years, I made my rounds on the hour. Ten minutes of running around that place. Then back to the janitorial closet, and my homework. After two years, my boss asked me to mix up my rounds. When I mixed up my rounds, I saw a lot of people doing things in that building they shouldn't have. Did I care? No! It was nothing life, or death, and I wasen't going to die over $7.49/hr. Nor, would I ruin some guys life. No--I wasen't a good security guard, but the patrons always got their lost purse/wallet back, if I found their items. People don't like to hear this, but so much theft is internal. Entities like to blame professional criminals, drug addicts, etc., but so much theft is internal. The people higher up in the organization stole the most. It was then middle management. And then Cops stole--wow, it was staggering, but they were pretty slick. And the thefts were always blamed on gangs, the homeless, or that new janitor. I stayed quiet, and watched their behavior. I can usually walk through any store, and spot which employee is stealing. I have found they are usually overly enthusiastic, care too much about following exact procedure, and they are usually the last person in the organization you would expect would have a dark side, and never complain. In other words, the person who gets the managent promotion. (I don't want to argue. I won't be back. If you do have a problem with stealing, really try to stop. If you can't stop, be smart. Don't steal enough to rack up a felony. I believe it's over $500? Don't ever walk into a establishment with no money. I forget what it's called, but it racks up big charges. If you are stealing because of the thrill it brings, take up intence exercise, or see a therapist. And try to take on Robin Hood morality; Never take from the poor. Don't let the innocent guy take the fall. Be a stand up guy?)
- mlvljr 11y ago
  You mean you literally witnessed cop gangs stealing stuff in a slick fashion overnights?? May I ask, what state and year that was?
  - deleted 11y ago
    [deleted]
SFJulie 11y ago
So by organizing people by routine franchise open the door to a new type of crime. Imagine if an organized mob decided to mutualize the analysis and then stroke at the same time 100 shops? Imagine if banks do the same as mc do?
y7 11y ago
> But there was more to it than that. Hidden inside the repetitive floor plans and the daily schedules of these franchised businesses, Roofman had found the parameters of a kind of criminal Groundhog Day: a burglary that could be performed over and over in different towns, cities, and states—probably even different countries, if he’d tried—and his skills would only get better with each outing. In a very real sense, he was breaking into the same building again and again, endlessly duplicating the original crime. > For Roofman, it was as if each McDonald’s with its streamlined timetable and centrally controlled managerial regime was an identical crystal world: a corporate mandala of polished countertops, cash registers, supply closets, money boxes, and safes into which he could drop from above as if teleported there. Everything would be in similar locations, down to the actions taking place within each restaurant. At more or less the same time of day—whether it was a branch in California or in rural North Carolina—employees would be following a mandated sequence of events, a prescribed routine, and it must have felt as if he had found some sort of crack in space-time, a quantum filmloop stuttering without cease, an endless present moment always waiting to be robbed. It was the perfect crime—and he could do it over and over again. > For Roofman, it must have looked as if the rest of the world were locked in a trance, doing the exact same things at the exact same times of day—in the same kinds of buildings, no less—and not just in one state, but everywhere. It’s no real surprise, then, that he would become greedy, ambitious, overconfident, stepping up to larger and larger businesses—but still targeting franchises and big-box stores. They would all have their own spatial formulas and repeating events, he knew; they would all be run according to predictable loops inside identical layouts all over the country. Personally, I got a bit bored with the author's style of continuously seeking bold metaphors for the same thing, but I'm curious: do people consider this interesting writing, or does this style detract from the content?
- sb8244 11y ago
  At the risk of looking simpleton, I tend to get sucked into a story and then I don't focus on the exact writing style. Thus, I found this interesting. The exception is horribly bad grammar and misspellings. I can handle one or two instances, but things start to pop out after awhile in prose with too many errors.
- munin 11y ago
cm3 11y ago
Who else thought this was about a Mac OS exploit?
- Drdrdrq 11y ago
  I thought it had to do with MAC addresses...
svantana 11y ago
This is reminiscent of the dichotomy of well structured software versus copy protection/cracking -- software development thrives in clear organization and separation of concerns, but so does cracking (i.e. having a single function take care of all license management will make it crackable in minutes). So software devs who want good DRM are forced to employ arcane obfuscation and back-handed tactics, sometimes at the detriment of the functionality and repairability of the software. I guess that's part of why we can't have good things...
nxzero 11y ago
>> "without fail described as polite—in one oft-repeated example, even insisting that his victims put on their winter coats so that they could stay warm after he locked them all in a walk-in freezer." Sorry, but if someone tried to lock me in a freezer last thought would be how polite they were.

110 points by kposehn 11y ago

It's always interesting to see the systems that get engineered (engineer themselves? abiogenerate?) as externalities. It's like a scaled up pathological version of https://xkcd.com/1172/ https://xkcd.com/1172/ I don't think this is common enough to justify having pentesters think about your corporate procedures' exposure to such behavior but it's definitely an interesting thing to think about when designing sensitive human or mixed human/computer systems. Edit: word building fix

HoopleHead 11y ago

I know it was just a taster, trying to interest us in a forthcoming book. But, nevertheless, I thought that story was very long on hyperbole and very short on detail.

egjerlow 11y ago
Exactly. In what way did roofman engineer the toys-r-us store? What kind of regularities did he exploit in his burglaries?

andkon 11y ago

This reminds me a lot of BLDGBLG's post about Die Hard's architecture[1], especially this line: his dream house included a maze of trap-doors and what Sergeant Scheimreif called “escape holes.” It was everything he seemed to want a building to be—with near-infinite ways of getting from one room to another and no upper limit on the places he could hide. This stuff is a weird obsession of mine, probably stemming from being a skateboarder for my whole life. Eventually, you realize that all space is something you can rearrange. [1] http://www.bldgblog.com/2010/01/nakatomi-space/ http://www.bldgblog.com/2010/01/nakatomi-space/

detaro 11y ago
It is by the same author, Geoff Manaugh. I find his writings work best in collection, e.g. if you read a lot of BLDGBLOG. In the individual pieces the meta-level ideas are kind of strange, if you read more and find the same aspects over and over again it makes more sense.
SixSigma 11y ago
Reminded me more of H. H. Holmes' Murder Castle Some victims were taken to one of the rooms on the second floor, called the "secret hanging chamber", where Holmes hanged them. Other victims were locked in a huge soundproof bank vault near his office, where they were left to suffocate. There was also a secret room that was completely sealed by solid brick that could only be entered through a trapdoor in the ceiling; Holmes would lock his victims in this room for days to die of hunger and thirst. https://en.wikipedia.org/wiki/H._H._Holmes https://en.wikipedia.org/wiki/H._H._Holmes
percept 11y ago
Interesting seeing both the architecture of the building in the movie and the movie itself differently. It wasn't featured quite as prominently in the film, but I wonder if the use of "The Carter" (and its real-life counterpart) in New Jack City isn't similar. Other examples?
chiph 11y ago
I'm surprised there wasn't a mention of Brazil, where the hapless apartment dweller Buttle was incorrectly arrested by Information Retrieval forces descending from the floor above.

beejiu 11y ago

This page has download 20MB of content in about 20 seconds. Despite having a top of the range iMac, I can barely scroll the page without lag.

yetihehe 11y ago
Get adBlock. 3 year old laptop plus firefox and I didn't see any slowdowns.
wtbob 11y ago
Hey, you need to download 20MB (much of that executable code) in order to read 10,349 characters! It only makes sense that it would take 2,026 bytes to deliver each character you read. Quit hating on JavaScript. It's the future of the web. The Future of the Web.
techdragon 11y ago
Worked pretty good on my iPhone 6 Plus.

marincounty 11y ago

When I was in college, I had a security job. I literally watched a huge building on the weekends. It was in a bad part of town, so walking around that big, dark building was nerve wracking. I had a time clock, and had to punch 15 keys per hour. For two years, I made my rounds on the hour. Ten minutes of running around that place. Then back to the janitorial closet, and my homework. After two years, my boss asked me to mix up my rounds. When I mixed up my rounds, I saw a lot of people doing things in that building they shouldn't have. Did I care? No! It was nothing life, or death, and I wasen't going to die over $7.49/hr. Nor, would I ruin some guys life. No--I wasen't a good security guard, but the patrons always got their lost purse/wallet back, if I found their items. People don't like to hear this, but so much theft is internal. Entities like to blame professional criminals, drug addicts, etc., but so much theft is internal. The people higher up in the organization stole the most. It was then middle management. And then Cops stole--wow, it was staggering, but they were pretty slick. And the thefts were always blamed on gangs, the homeless, or that new janitor. I stayed quiet, and watched their behavior. I can usually walk through any store, and spot which employee is stealing. I have found they are usually overly enthusiastic, care too much about following exact procedure, and they are usually the last person in the organization you would expect would have a dark side, and never complain. In other words, the person who gets the managent promotion. (I don't want to argue. I won't be back. If you do have a problem with stealing, really try to stop. If you can't stop, be smart. Don't steal enough to rack up a felony. I believe it's over $500? Don't ever walk into a establishment with no money. I forget what it's called, but it racks up big charges. If you are stealing because of the thrill it brings, take up intence exercise, or see a therapist. And try to take on Robin Hood morality; Never take from the poor. Don't let the innocent guy take the fall. Be a stand up guy?)

mlvljr 11y ago
You mean you literally witnessed cop gangs stealing stuff in a slick fashion overnights?? May I ask, what state and year that was?
- deleted 11y ago
  [deleted]

SFJulie 11y ago

So by organizing people by routine franchise open the door to a new type of crime. Imagine if an organized mob decided to mutualize the analysis and then stroke at the same time 100 shops? Imagine if banks do the same as mc do?

y7 11y ago

> But there was more to it than that. Hidden inside the repetitive floor plans and the daily schedules of these franchised businesses, Roofman had found the parameters of a kind of criminal Groundhog Day: a burglary that could be performed over and over in different towns, cities, and states—probably even different countries, if he’d tried—and his skills would only get better with each outing. In a very real sense, he was breaking into the same building again and again, endlessly duplicating the original crime. > For Roofman, it was as if each McDonald’s with its streamlined timetable and centrally controlled managerial regime was an identical crystal world: a corporate mandala of polished countertops, cash registers, supply closets, money boxes, and safes into which he could drop from above as if teleported there. Everything would be in similar locations, down to the actions taking place within each restaurant. At more or less the same time of day—whether it was a branch in California or in rural North Carolina—employees would be following a mandated sequence of events, a prescribed routine, and it must have felt as if he had found some sort of crack in space-time, a quantum filmloop stuttering without cease, an endless present moment always waiting to be robbed. It was the perfect crime—and he could do it over and over again. > For Roofman, it must have looked as if the rest of the world were locked in a trance, doing the exact same things at the exact same times of day—in the same kinds of buildings, no less—and not just in one state, but everywhere. It’s no real surprise, then, that he would become greedy, ambitious, overconfident, stepping up to larger and larger businesses—but still targeting franchises and big-box stores. They would all have their own spatial formulas and repeating events, he knew; they would all be run according to predictable loops inside identical layouts all over the country. Personally, I got a bit bored with the author's style of continuously seeking bold metaphors for the same thing, but I'm curious: do people consider this interesting writing, or does this style detract from the content?

sb8244 11y ago
At the risk of looking simpleton, I tend to get sucked into a story and then I don't focus on the exact writing style. Thus, I found this interesting. The exception is horribly bad grammar and misspellings. I can handle one or two instances, but things start to pop out after awhile in prose with too many errors.
munin 11y ago

cm3 11y ago

Who else thought this was about a Mac OS exploit?

Drdrdrq 11y ago
I thought it had to do with MAC addresses...

svantana 11y ago

This is reminiscent of the dichotomy of well structured software versus copy protection/cracking -- software development thrives in clear organization and separation of concerns, but so does cracking (i.e. having a single function take care of all license management will make it crackable in minutes). So software devs who want good DRM are forced to employ arcane obfuscation and back-handed tactics, sometimes at the detriment of the functionality and repairability of the software. I guess that's part of why we can't have good things...

nxzero 11y ago

>> "without fail described as polite—in one oft-repeated example, even insisting that his victims put on their winter coats so that they could stay warm after he locked them all in a walk-in freezer." Sorry, but if someone tried to lock me in a freezer last thought would be how polite they were.