Skip to content

Forging a Chest Handle


As my work on the Mästermyr-like chest is slowly coming to completion, I noticed that due to thicker planks, the chest is getting too heavy to carry comfortably without handles. Although, the original chest did not have any handles, I decided to forge handles anyway. None of the books in my library had good illustrations of Viking-age handles but the simple design above is going to fit with the hardware I have forged so far.

This handle was forged from a 7in long piece of 3/4in round steel. I isolated a 1in piece in the middle by fullering with a spring fuller at 3in and 4in from the end. After the middle piece was isolated, I tapered both sides to 1/4in so that each end was about 6in in length. The transitions were square, octagon and then round as usual. Each end was bend at 3in over the horn of the anvil.

The loops were forged from 1/4in thick and 1in wide rectangular steel. I used a butcher to get a tenon that could be forged down to 1/4in round and then drilled a 1/2in hole for the eye where the handle is going to fit through.

To make the handle stop rotating at 90 degrees, i.e. to avoid squeezing the hands, I put each end of the handle in the vise and used a set hammer to bend a stop that is going to engage with the plate, see the picture. The base plate is 1/8in thick and the loops where riveted to it with the handle in place. The whole process took about 5 hours.

Surprisingly, aside from a couple blacksmithing books, I could not find any article on the web that shows how to forge a chest handle.
Categories: Hacking
Defined tags for this entry: , , ,

Lizamoon SQL Injection Campaign Compared

Malware infections such as SQL injection are a well known security problem. Over the past two years we have seen several large-scale infections on the web, e.g. Gumblar.cn and Martuz.cn. Recently, a new SQL injection campaign called Lizamoon has gained a lot of attention. I had expected web sites would become more secure over time and less susceptible to simple security problems, so it is surprising that SQL injection is still a prevalent problem. That let me to wonder: Was Lizamoon as successful as previous infections? In a discussion about this problem, my colleague Panayiotis Mavrommatis suggested that comparing the size of campaigns via search engine result estimates might not be very accurate measurement.

That begs the question of how to assess the impact of infections. While the number of infected URLs is one possible measure, it is skewed by many different factors, e.g. a single vulnerable site contributes a large fraction of the infected URLs and overstates the impact. Instead, counting the number of infected sites might be a better metric. Even so, to judge the relative scale of an infection campaign, it might be helpful to compare it to previous incidents.

Below is a comparison of the Gumblar.cn/, Martuz.cn/ and Lizamoon infections based on Google's Safe Browsing data. The graph shows the number of unique infected sites over a 30 day sliding window.

For this analysis, I counted the sites that had a functioning reference to it, e.g. a script src=. Sites that escaped the script tag rendering it harmless were not counted. For Lizamoon, I aggregated the sites provided by the websense blog into a single measure:

hxxp://lizamoon.com/
hxxp://tadygus.com/
hxxp://alexblane.com/
hxxp://alisa-carter.com/
hxxp://online-stats201.info/
hxxp://stats-master111.info/
hxxp://agasi-story.info/
hxxp://general-st.info/
hxxp://extra-service.info/
hxxp://t6ryt56.info/
hxxp://sol-stats.info/
hxxp://google-stats49.info/
hxxp://google-stats45.info/
hxxp://google-stats50.info/
hxxp://stats-master88.info/
hxxp://eva-marine.info/
hxxp://stats-master99.info/
hxxp://worid-of-books.com/
hxxp://google-server43.info/
hxxp://tzv-stats.info/
hxxp://milapop.com/
hxxp://pop-stats.info/
hxxp://star-stats.info/
hxxp://multi-stats.info/
hxxp://google-stats44.info/
hxxp://books-loader.info/
hxxp://google-stats73.info/
hxxp://google-stats47.info/
hxxp://google-stats50.info/

The graph shows two interesting facts.
  • The Lizamoon campaign started around September 2010 and actually peaked in October 2010 with ~5600 infected sites. At the moment, it seems to be undergoing a revival.
  • If we compare the number of infected sites, Gumblar.cn/ is still clearly the winner with ~62,000 sites, followed closely by Martuz.cn/.
For future studies of malware infections, I suggest taking the number of infected sites as a more reliable measure than counting the number of infected URLs.

Update 2011-04-04:
The blog post incorrectly referred to Gumblar.cn and Martuz.cn/ as SQL injection attacks. These attacks used stolen FTP credentials.
Categories: Hacking, Malware, News, Security, SpyBye
Defined tags for this entry: , ,

Honeyd.org running with phpBB3

Despite being incredibly busy at work, and purusing many extra curricular activities, I finally managed to update www.honeyd.org to phpBB3. Unfortunately, the spammers were slowly taking over the forum and phpBB2 did not provide adquate tools for managing spam. phpBB3 on the other hand supports recaptcha and other nice spam managing features. I also hope to release a new version of honeyd including bug fixes and support for libevent2.
Categories: News

Profile Story On Me :-)

CNet's Ellinor Mills wrote a nice security profile on me with the catching title: Google's Niels Provos battles malware on the Web. Blacksmithing, security, martial arts, etc, it's all there.

Categories: News

HotSec'11 CFP Out: Singular emphasis on new ideas and problems!

The HotSec 2011 CFP is out:

http://www.usenix.org/events/hotsec11/cfp/

Important Dates
  • Submissions due: May 5, 2011, 11:59 p.m. EST
  • Notification of acceptance: June 14, 2011
  • Electronic files of final papers due: July 5, 2011


HotSec is renewing its focus by placing singular emphasis on new ideas and problems. Works reflecting incremental ideas or well understood problems will not be accepted. Cross-discipline papers identifying new security problems or exploring approaches not previously applied to security will be given special consideration. All submissions should propose new directions of research, advocate non-traditional approaches, report on noteworthy experience in an emerging area, or generate lively discussion around an important topic.
Categories: News

Virtual Nudity at Airports

Recently, I had the pleasure of flying from the new terminal at the San Jose Airport. The building is quite nice from the inside and even has some cool futuristic moving statues. With all the good stuff comes also a set of virtual nudity machines at the security screening point. The virtual nudity machines also known as backscatter x-ray screening promise increased privacy since the naked images of passengers are viewed at a remote location and there is no requirement of a physical examination. As the sign states these machines are optional but whoever refuses must subject themselves to a thorough physical pat down. I already had one really bad experience with the virtual nudity machines at another airport - I was told I was not allowed to wear my watch or any necklaces. Well, this time I chose the metal detector and walked through without any further hassles. However, I had the pleasure of watching every single person who was shepherded through the virtual nudity machines being patted down. One woman had her breast touched - perhaps she dared to wear an underwire bra? The next guy got patted down around his legs. His offense was a chap stick hidden in his pocket. What really amused me was the guy after him who was patted down because he had not removed his handkerchief from his pocket. At the end of the day, anyone going through the backscatter x-ray machines got patted down and spent a significantly longer time at the security checkpoint. This seems like an overly expensive experiment that hopefully will be abandoned soon.
Categories: Security
Defined tags for this entry: ,