Perlroth & The First (Zero-Day) Broker

I am currently reading “This Is How They Tell Me The World Ends” by Nicole Perlroth, only on page 60 in Chapter 5, so a long ways to go before completing the 471 page tome. I hit chapter 4, titled “The First Broker” and it was of specific interest to me for sure, prompting this (second) blog on the book. A broker is defined as “a person who buys and sells goods or assets for others” so I was never a vulnerability broker by that definition. I am not trying to claim to be the actual first broker of zero-days in that context at all. Instead, I would like to share a couple of my own stories that are adjacent to the topic. This is all to the best of my recollection, but my memory isn’t the best due to being a diabetic and not having it under control for several years. If anyone involved in any of these stories has a different memory please feel free to comment or reach out directly and I will update this blog accordingly.


First, I was someone who ‘brokered’ deals in the sense of trading zero-day vulnerabilities for a few years in the mid-90s. As a member of multiple hacking groups, some an actual member and some an honorary member, one of my roles in several of those groups was not writing the zero-days because I simply wasn’t a coder and did not have that skill. Instead, it was to barter and try to gain access to specific zero-days one group or member wanted and my currency was other zero-days we had. While I couldn’t code, my social network of hackers was sizable.

Some of what I was authorized to trade for was toward the goal of obtaining e.g. “any remote zero-day in $target operating system” while in other cases it was “trade anything and everything we have for $specific-zero-day“. I acted as a go-between for the groups I was in and a liaison to the general hacker scene. Many knew me to have a well-rounded vulnerability collection and we already traded more pedestrian exploits, some of which weren’t public, but definitely more circulated in such groups.

Back then it was just hackers and groups, not companies, so we didn’t have “duffel bags stuffed full of half a million dollars in cash to buy zero-day bugs” (p.49). Instead we had other zero-day bugs which were just as valuable between groups and acted as the ideal currency. Just like Perlroth describes in her book relating the story of “Jimmy Sabien” (p.43), not his real name, the vulnerabilities had serious value back then too. Some were very closely guarded, to the point of not being shared with their group. For example, Sally may have shared 99% of her exploits and zero-days with her group but held one back because it was so valuable. That one she would use sparingly herself so as not to burn it or authorize it to be traded for a vulnerability of equal value. In those rare cases I would know just enough about the vulnerability to try to arrange a trade on her behalf, sometimes never seeing the vulnerability myself.

There were rumors at the time that some hackers had sold vulnerabilities to specific agencies in European governments. There were also rumors that some were trading zero-day exploits to a European law enforcement agency as a proffer or part of a plea to avoid being charged for hacking activity. But those were just rumors at that point. To me, that was the precursor to the more financial based zero-day market.


Later in the 90s, I was one of the two founders of a startup called Repent Security Inc. (RSI or RepSec). We were three people and started trying to be a penetration testing shop. This was still early in the world of commercial penetration testing and we were going up against companies that either had an established business reputation like a couple of the ‘Big 5’ at the time, or companies that were pioneers in the game like The Wheel Group. We also created software for securely streaming logs over an encrypted tunnel so if a system was popped, you had the logs on a remote host with timestamps including your shell histories (which didn’t have timestamps natively). That software was partially outsourced to a renowned “InfoSec luminary” who had it developed by one of his interns on a compromised .edu machine and later essentially stole the software after RSI imploded. But that story is for another day because it isn’t part of the zero-day world, it’s part of the Charlatan and Errata world.

One thing RSI had of real value was the vulnerability database that I had been maintaining since 1993. It was first maintained for the hacker group I was part of (TNo) where it was originated by other members. When I took over maintaining it I worked on further organizing it, adding several points of metadata, and expanding it. After that group drifted apart I kept maintaining it while a member of w00w00 and honorary member of ADM, where I brokered some trades. I did not maintain the databases for either of those groups which were separate from mine, but I was privy to some of their exploits and shared some of what I had. Members from both groups would frequently ask me to check my database for exploits specific to an operating system or service they were targeting, as this was before Google and Yahoo! didn’t aggregate much in the big picture. Even though a majority of vulnerabilities were posted to Bugtraq, you couldn’t just skim it quickly to determine what was there that you could use for your purpose. Someone that had them all sorted in a database with metadata was fairly valuable. To this day, many friends and colleagues still ask me to do vulnerability lookups, now with VulnDB.

Throughout my hacker days I maintained that database, and then continued to as I transitioned into a career doing penetration testing. Like Perloth documents in her book about the early days of iDefense and the outfit that “Sabien” worked for, we all scoured Bugtraq for our information primarily. I had the benefit of several circles of hackers and hackers-turned-legit that still traded vulnerability intelligence (vuln intel). Essentially the grey market back when the currency was still vuln intel not those duffels of cash. By that point, the database that RSI had was unparalleled in the commercial world. This was initially created before and maintained during Fyodor’s Exploit World and Ken Williams’ Packetstorm. The RSI database came before the ISS XForce database, before BID, before NIST’s ICAT Metabase, and before MITRE’s CVE. More importantly, it was heavy on exploit code but light on proper descriptions or solutions, so it was geared toward penetration testing and compromising machines rather than mature vulnerability intelligence.

As RSI struggled to get penetration testing gigs and opted to work on the “Secure Remote Streaming” (SRS) product, we had taken a trip to Atlanta to talk to ISS about selling a copy of our database to their relatively new X-Force penetration testing team (I forgot who we met there, but I would love remember!). That deal did not happen and we soon found ourselves in talks with George Kurtz at Ernst & Young, one of the ‘Big 5’. While most or all of the ‘Big 5’ had penetration testing teams, their reputation wasn’t the best at the time. That was primarily due to their testers frequently being traditional auditors turned penetration testers, rather than being a ‘real’ tester; someone that came up through the hacking ranks.

It is also important to remind everyone that back then these companies “did not hire hackers“. They literally printed it in advertisements as a selling point that they did not hire and would not consort with so-called black hats. This was almost always an outright lie. Either the company knew the background of their team and lied, or they did not know the background and conveniently overlooked that their employees had zero experience on their resume around that skillset, yet magically were badass testers. Years of companies claiming this also led to what we see now, where many security professionals from that time still refuse to admit they used to hack illegally even 25 years later.

Anyway, back to George and E&Y. It made sense that a shop like that would want to get their hands on RSI’s database. If their testers were primarily from the auditor / bean-counter side of things they would not have had their own solid database. Even if they had hackers it didn’t mean they came with the same vuln intel we had. As best I recall, the negotiations went back and forth for a couple weeks and we settled on a one-time sale of the RSI database for $75,000 with the option to revisit selling ‘updates’ to it as we continued to maintain it. This would have become the first commercial vulnerability intelligence feed at the time I believe, in early 1999. Then, disaster.

The FBI raided the offices of RSI, which was my apartment. At the time that was a death sentence to a penetration tester’s career. Regardless of guilt, the optics were one of black hat / criminal hacking, and finding someone to trust you to break into their systems was not happening. RSI dissolved and I found myself struggling to find work of any kind. So I reached back out to George about the deal we had on the table that we were close to signing and said I was fine with the price, let’s do it. Suddenly, Kurtz had a change of heart.

He didn’t have a change of heart as far as doing the deal, his change was in the price. Instead of $75,000 he came back and said we could do the deal for $25,000 instead, just a third of what we had agreed to. He knew I was in a tight spot and needed the money and he took full advantage of that. This is someone who had a reputation of being a friend to hackers, someone that had bridged the gap between the business world and hackers to put together a reputable team at E&Y. He even had his name on a book about penetration testing, co-authored with names other hackers recognized. He was also very explicit that he knew I had no real power at that point and refused to budge on his one-third offer.

So when he had a chance to honor the deal we originally worked on, a chance to be a friend to a hacker, at no expense of his own? He opted to screw me. Since I was out of options and my limited savings were dwindling I had to accept the offer. That takes me full circle, via a meandering path I know, to likely making one of the largest vulnerability sales at the time. While it wasn’t a single exploit, a $25k deal that was originally set to be $75k is pretty impressive for the time. If RSI had made it, odds are we would have become a software (SRS) and vulnerability intelligence shop rather than a penetration testing shop.

Many aspects of how Perlroth describes the early days of iDefense and “Sabien’s” shop, we were already doing. With a lot fewer people than they claimed, but we were aggregating information from Bugtraq and other sources, writing exploits for some of the vulnerabilities, and then we began to try to sell that information. I guess it isn’t a big surprise I ended up in the vulnerability intelligence business eventually.

Zero-days: Two Questions from Perlroth

I am currently reading “This Is How They Tell Me The World Ends” by Nicole Perlroth, only on page 17 in Chapter 2, so a long ways to go before completing the 471 page tome. While only 17 pages in, there are already some annoyances to be sure, but the tone, scope, and feel of the book is enjoyable so far. I am not sure if I will do a full review at the end or perhaps write some blogs specific to topics like this one. It obviously didn’t take long at all to get to the point where I thought a quick blog with my perspective might be interesting to some.


At the end of Chapter 1, Perlroth summarizes what she sees as the long road ahead for her to tackle the subject of zero-day exploits. This follows her describing one dinner with a variety of security folks from all sides of the topic but seems to center around two zero-day exploit writers not answering some ‘basic’ questions like “who do you sell to?” She uses this to enumerate a list of questions around the topic of zero-day exploits that she would have to face to cover the topic thoroughly. Of the 28 questions she posed to herself, two stood out to me but requires two more to better set the stage:

Who did they sell their zero-days to?
To whom would they not?
How did they rationalize the sale of a zero-day to a foreign enemy? Or to governments with gross human rights violations?

Depending on who you ask, or when you ask them, you may be told these are simple questions and answers, very complex, or like an onion.


When you ask if an exploit broker will sell to governments with “gross human rights violations“, that gets complicated in today’s world of geopolitics while remaining much more simple as far as morals and ethics go. If gross human rights violations are the line in the sand, meaning regular human rights violations are acceptable (?), then it cuts out all of the biggest players in the game; United States, China, Russia, North Korea, and Iran. Before any of my European friends head straight to the comment section, I am not forgetting or neglecting you. Some of the European countries maintain teams that are extremely accomplished and arguably better than the countries I listed. Why? You don’t see their names being splashed in every other headline and attribution claim. Further, some of the most elite zero-day writers from the late 80’s and early 90’s were European. I used to be privy to a handful of some of those exploits and on occasion, brokered (traded, not sold) them between groups. Further, I don’t associate most European countries with the other five as far as gross human rights violations, at least not in recent history.

Since zero-day exploit writers do sell to some of those countries at least (US, CN, RU), and presumably some sell to the other two (IR, KP), now we’re talking shades of grey or onions, depending on your favorite analogy. You’re left trying to draw a line in the sand as to which human rights violations you can accept and at that point, does the question even have relevance? I don’t want to get into a pissing war over who is holier or more evil than the other because each of the five countries above has their long list of sordid atrocities.


Let’s jump back to the third question there, the notion of “foreign enemy”. This is peculiar since the book had already thrown around the term “mercenary” several times in the prologue, and that scenario answers the question simply. A mercenary sells their services to the highest bidder typically, ethics takes a seat in the trunk if it even comes along for the ride. So a simple summary is that some will sell to the highest bidder, end of story.

But does any of the above really matter? Long ago I heard a great quote that is both funny and sardonic, that I think has relevance to the other question:

“We refuse to join any organization that would have us as a member.”

If we’re discussing the notion of being involved with another group (country in this case), isn’t the ethics of selling a zero-day that you know will potentially be used against your own country a lesson in abject self examination? If you are willing to sell to such an organization, one that might cause a power outage, risk human life, or undermine security and privacy as only a nation-state can, is that the kind of organization you want to be a part of? If such an organization or country is willing to buy zero-day exploits from you to use for those purposes, is that the type of organization you want to be affiliated with?

If the answer is no, then Perlroth has the beginning of her answer. If the answer is yes, then we’re back to square mercenary. Pretty simple maybe?

Redscan’s Curious Comments About Vulnerabilities

As a connoisseur of vulnerability disclosures and avid vulnerability collector, I am always interested in analysis of the disclosure landscape. That typically comes in the form of reports that analyze a data set (e.g. CVE/NVD) and draw conclusions. This seems straight-forward but it isn’t. I have written about the varied problems with such analysis many times in the past and yet, companies that don’t operate in the world of vulnerability databases still decide to play in our mud puddle. This time is the company Redscan, who I don’t think I had heard of, doing analysis on NVD data for 2020. Risk Based Security wrote a commentary on their analysis, to which I contributed, but I wanted to keep the party going over here with a few more personal comments. Just my opinions here, as a more outspoken critic on the topic, and where I break from the day job.

I am going to focus on one of my favorite topics; vulnerability tourists. People that may be in the realm of Information Security, but don’t specifically operate day-to-day in the world of vulnerability disclosures, and more specifically to me, vulnerability databases (VDBs). For this blog, I am just going to focus on a few select quotes that made me double-take. Read on after waving to Tourist Lazlo!

“The NVD tracks CVEs logged by NIST since 1988, although different iterations of the NVD account for some variation when comparing like-for-like results over time.”

There’s a lot to unpack here, most of it wrong. First, the NVD doesn’t track anything; they are spoon-fed that data from MITRE, who manages the CVE project. Second, NIST didn’t even create NVD until over five years after CVE started. Third, CVE didn’t track vulnerabilities “since 1988”; they cherry-picked some disclosures from before 1999, when they started, and why CVE IDs start with ‘1999’. Fourth, there was only one different iteration of NVD, that was their ICAT “CVE Metabase” that ran the first year of CVE basically. According to Peter Mell, who created it, said that after starting as its own vulnerability website, “ICAT had become an archival tool for CVE standard vulnerabilities and was only updated every three or four weeks”. Then in 2005 the site relaunched with a new focus and timely updates from CVE. Despite this quote, later in their report they produce a chart that tries to show an even comparison from 1988 to 2020 despite saying it went through iterations and despite not understanding CVSS.

“The growth is also likely attributable to an increase in the number of CVE Numbering Authorities (CNAs) – of which there are now more than 150 worldwide with the power to create and publish CVEs.”

The growth in disclosures aggregated by CVE is a lot more complicated than that, and the increase in CNAs I doubt is a big factor. Of course, they say this and don’t cite any evidence despite CVE now showing who the assigning CNA was (e.g. CVE-2020-2000 is Palo Alto Networks). The data is there if you want to make that analysis but it isn’t that easy since it isn’t included in the NVD exports. That means it requires some real work scraping the CVE website since they don’t include it in their exports either. Making claims without backing them up when the data is public and might prove your argument is not good.

“Again, this is a number that will concern security teams, since zero interaction vulnerabilities are famously difficult to detect and have the potential to cause significant damage.”

This makes me think that Redscan should invent a wall, perhaps made of fire, that could detect and prevent these attacks! Or maybe a system that is designed to detect intrusions! Or even one that can prevent intrusions! This quote is one that is truly baffling because it doesn’t really come with an explanation as to what they mean, and I hope they mean something far different than what this sounds like. I hope this isn’t a fear tactic to make readers think that their managed detection service is needed. Quite the opposite; anyone who says the above probably should not be trusted to do your attack detection.

This chart heading is one of many signs that Redscan doesn’t understand CVSS at all. For a “worst of the worst” vulnerability they got several attributes right but end up with “Confidentiality [High]”. The vulnerability they describe would only be CVSSv2 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) and CVSSv3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). That is not the worst. If it ‘highly’ impacts confidentiality, integrity, and availability then that becomes the worst of the worst, becoming CVSSv2 10.0 and CVSSv3.1 9.8 or 10.0 depending on scope. It’s hard to understand how a security company gets this wrong until you read a bit further where they say they “selected the very ‘worst’ option for every available metric.” My gut tells me they didn’t realize you could toggle ‘High’ for more than one impact and confidentiality is the first listed.

“It is also important to note that these numbers may have been artificially reduced. Tech giants such as Google and Microsoft have to do a lot to maintain their products and services day-to-day. It is common for them to discover vulnerabilities that are not being exploited in the wild and release a quick patch instead of assigning a CVE. This may account for fewer CVEs with a network attack vector in recent years.”

This is where general vulnerability tourism comes in as there is a lot wrong here. Even if you don’t run a VDB you should be passingly familiar with Microsoft advisories, as an example. Ever notice how they don’t have an advisory with a low severity rating? That’s because they don’t publish them. Their advisories only cover vulnerabilities at a certain threshold of risk. So that means that the statement above is partially right, but for the wrong reason. It isn’t about assigning a CVE, it is about not even publishing the vulnerability in the first place. Because they only release advisories for more serious issues, it actually skews their numbers to include more remote vulnerabilities, not less, primarily on the back of “remote” issues that require user interaction such as browser issues or file parsing vulnerabilities in Office.

This quote also suggests that exploitation in the wild is a bar for assigning a CVE, when it absolutely is not. It might also be a surprise to a company like Redscan, but there are vulnerabilities that are disclosed that never receive a CVE ID.

“Smart devices designed for the mass market often contain a worrying number of vulnerabilities due to manufacturer oversight. Firmware within devices is often used by multiple vendors, meaning that any vulnerabilities in this software has the potential to result in lots of CVEs.”

Wrong again, sometimes. If it is known to be the same firmware used in multiple devices, it gets one CVE ID. The only time there are additional IDs assigned is when multiple disclosures don’t positively ID the root cause. When three disclosures attribute the same vulnerability to three different products, it stands to reason there will be three IDs. But it isn’t how CVE is designed because it artificially inflates numbers, and that is the game of others.

“The prevalence of low complexity vulnerabilities in recent years means that sophisticated adversaries do not need to ‘burn’ their high complexity zero days on their targets and have the luxury of saving them for future attacks instead.”
-vs-
“It is also encouraging that the proportion of vulnerabilities requiring high-level privileges has been on the increase since 2016. This trend means that cybercriminals need to work harder to conduct their attacks.”

So which is it? When providing buzz-quote conclusions such as these, that are designed to support the data analysis, they shouldn’t contradict each other. This goes back to what I have been saying for a long time; vulnerability statistics need qualifications, caveats, and explanations.

“Just because a vulnerability is listed in the NVD as hard to exploit doesn’t mean that attackers aren’t developing PoC code to exploit it. The key is to keep up with what’s happening in the threat landscape and respond accordingly.”

I’ll end here since this is a glowing endorsement for why vulnerability intelligence has to be more evolved than what CVE and NVD are offering. Part of the CVSS specifications include Temporal scoring and one of those attributes is Exploit Code Maturity. This is designed to specifically address the problem above; that knowing the capability of potential attackers matters. With over 21,000 vulnerabilities disclosed last year, organizations are finding that just patching based on the CVSSv3 base score isn’t enough. Sure, you patch the 10.0 / 9.8 since those are truly the worst-of-the-worst, and you patch the 9.3 / 8.8 since any random email might carry a payload. Then what? If all things are equal between vulnerabilities that impact your organization you should look to see if a patch is available (also covered by Temporal score) and if an exploit is available.

Numeric scores are not enough, you have to understand the context behind them. That CVSSv2 remote information disclosure that partially affects confidentiality by disclosing an admin password is only a 5.0. Score it under CVSSv3 and you are looking at a 9.8 because it immediately leads to privilege escalation which is factored in under that system. Heartbleed was a CVSSv2 5.0 with a functional exploit and available patch; look what hell that brought upon us. If you aren’t getting that type of metadata, reconsider your choice of vulnerability intelligence.

January 2021 Reviews

[A summary of my movie and TV reviews from last month, posted to Attrition.org, mixed in with other reviews.]


Soul (2020)
Medium: Movie (Disney)
Rating: 5/5 movie and music magic
Reference(s): IMDB Listing || Disney
Disney knows how to do modern cartoons and this is no exception. The story follows Joe, a school band teacher who seems to have lost his way. As he sees a spark of passion in one student’s musical ability and then lands the gig of his life, he has a mishap and finds himself at the pearly gates but refuses to accept that fate. In limbo Joe runs into an odd one known as “22” and finds himself on an adventure to help 22 find a spark so that they can live a life on earth. The movie has a great stride and flows very well with an amazing cast of vocal talent as well as some incredible music by an unlikely trio, Trent Reznor and Atticus Ross for the original score and John Batiste with original jazz songs. The movie brings the laughs and the feels and is perfect for all ages.


Kajillionaire (2020)
Medium: Movie (Netflix)
Rating: 4.5/5 stick with it
Reference(s): IMDB Listing || Amazon
This quirky movie is billed as a Crime/Drama but as far as modern movies go, that is about the farthest thing from what it really is. It’s more of a slow-play dry commentary on the nature of humans and how odd we can be, with a splash of low-end grifting, wrapped into a family-dynamic sleeper hit that also moonlights as a love-story. For me, it started out slow and confused as I couldn’t figure out what type of movie it was. About half-way through I was hooked as I realized it wasn’t trying to be any specific genre; it just did its thing with Evan Rachel Wood stealing the show. If you dig on off-the-beaten-path flicks, this one is worth a go.


Greenland (2020)
Medium: Movie (Multiple)
Rating: 2/5 the title is the most redeeming quality
Reference(s): IMDB Listing || Amazon
It must have been a few years since the last earth-snuffing porn, as we tend to get one movie like that every so often, although more recently in the form of plagues and zombies. Gerard Butler and end of the world, pretty much tells you what you need to know about this movie. All the stereotypical things from this genre of movie too; poorly manufactured explosions to tide you over before the real city-snuffing comes, impromptu gangs that make no sense, cell service outages for plot advancement, and really bad dialogue snippets. I definitely like I watched this so you wouldn’t have to.


Lupin, Part 1 (2020)
Medium: TV (Netflix)
Rating: 3.9/5 pas une série de braquages
Reference(s): IMDB Listing || Netflix
This 10 episode series is described as “inspired by the adventures of Arsène Lupin, gentleman thief Assane Diop sets out to avenge his father for an injustice inflicted by a wealthy family”. The first episode of five in part one sets the stage of a master thief and the heist of a 20-million dollar piece of jewelry. Unfortunately, we quickly learn that the main character is not really a master thief. While he has skill in makeup, blending in, and pickpocketing, there are no other grand heists involved. Instead, it becomes more of a drama around avenging his father’s death with the thief / con man / grifter components as a side piece to facilitate the main story. Overall it is fairly entertaining but entirely too predictable and not very thought-provoking. Great for falling asleep to.


News of the World (2020)
Medium: Movie (Multiple)
Rating: 3.5/5 bit of a slow read
Reference(s): IMDB Listing || Amazon
We follow Captain Kidd (Tom Hanks) as he travels from town to town reading the “news of the world”. Along the way he encounters a young girl, Johanna, played by Helena Zengel, who has grown up in an Indian tribe that was decimated by whites and speaks no English. Kidd decides to take her to the family she was going to before becoming stranded, and the story progresses. Given the movie stars Hanks and is a period piece, I expected an amazing movie. Unfortunately it just didn’t come together and became disjointed the farther it went. At almost two hours it still felt like parts ended up on the cutting room floor that might have tied some of the beginning to the end better. Worth a watch, wait for it to hit Netflix.


Freaks (2018)
Medium: Movie (Netflix)
Rating: 4/5 every single character is a freak
Reference(s): IMDB Listing || Netflix
This Canadian-made super-(anti)-hero movie is a different style than many movies of the genre. It starts out a bit slow and leaves you wondering what is happening and some of those questions go unanswered until very late in the movie. But it has a good slow buildup, good casting, a simple premise, and a solid conclusion. Slightly dystopian where anyone with any power is labeled a ‘freak’ and hunted by the government. This movie doesn’t spoon feed you a simple person with powers like most mainstream films of the sort. Worth a watch.


Joker (2019)
Medium: Movie (HBO Max)
Rating: 5/5 he’ll laugh, you’ll laugh
Reference(s): IMDB Listing || Amazon
I saw this in theaters, you know, just before the society-crippling pandemic robbed us of basic joys. I left the theater confused, not sure if I really liked the movie or really didn’t. By that night, after a discussion with Lyger, I realized that I really liked it. I re-watched it recently and still really enjoy it. The biggest factor is that it is a complete break from the DC universe as far as style goes. While we have seen Batman’s origin story, in one form or another, many times over, the villain’s origin stories are often relegated to fairly quick scenes (Suicide Squad) or not explored (The Dark Knight). Having an entire movie to see how Todd Phillips’ envisioned this iconic villain’s origin was worth the adventure. This movie leans a bit toward Nolan’s Batman trilogy as far as feel and is the polar opposite of other DC offerings like Superman, Wonder Woman, or Aquaman. Forget the DC universe when you go into this, just focus on this movie and Phoenix’s incredible portrayal of Joker.


Aquaman (2018)
Medium: Movie (Multiple)
Rating: 0.5/5 this movie s(t)inks
Reference(s): IMDB Listing || Amazon
For some reason, DC Comics has a problem making good movies with few exceptions, and this isn’t Nolan’s Batman or Wonder Woman. Instead, Aquaman had the feel of a franchise desperate to create the feel of a Marvel Universe movie. Every single thing was predictable, cliché, and boring. “There’s too many casualties!” But let’s stop for a sloppy wet kiss of course. Seriously, we need a new word for “overdone movie cliché”. They tried to make this by loading it with big names but as we often see, put that many big names together and they still can’t save a movie. Skip this, take a bath instead.


Prospect (2018)
Medium: Movie (Netflix)
Rating: 4.5/5 I dig it
Reference(s): IMDB Listing || Netflix
A sci-fi movie I hadn’t heard of that turned out pretty damn good, what gives? Oh, Pedro Pascal is in it and he has enjoyed a little attention recently. This movie has a small cast set on some distant world where brave adventurers go to prospect a part of an alien life form that requires some skill and finesse rather than brute strength. When a father / daughter duo touch down chasing the ultimate score, things go sideways. The movie is more of a thriller and sci-fi a vehicle to deliver the underlying story, which is compelling and well-done. If you can look past a few simple plot holes, you may find this movie really enjoyable like I did.


Rememory (2017)
Medium: Movie (Netflix)
Rating: 3.5/5 A bit forgettable
Reference(s): IMDB Listing || Amazon
Sam, the main character played by Peter Dinklage, injects himself into the life of a brilliant scientist who is brilliant, and the movie makes sure you know he is brilliant. The science is being able to record and playback memories, ala Strange Days. But for some reason Sam plays back mostly on a tiny screen in a briefcase that is the device. Anyway, he ends up in the middle of the life and murder of this scientist and decides to find out who did it, with this new technology being the central piece of the story. Ultimately, the movie has some neat ideas, good acting, but just falls short as it all doesn’t fully come together. It’s the kind where you can’t quite put your finger on it but just know something was lacking.

The Misery (Index) Data

The Misery Index is a game on TBS hosted by Jameela Jamil, starring The Tenderloins, better known as the Impractical Jokers (Joe Gatto, Brian Quinn, James Murray, Sal Vulcano). You can read more about the format and style of the game on its Wikipedia page. They bring humor to the game to augment the humor of the subject matter; “miserable” events depicted in news, text, or video.

Each miserable incident is scored by a team of psychologists based on the “three pillars of misery” which are “physical pain, emotional trauma, and long-term psychological impact“. That boils it down to a numeric score between 0 and 100. After watching a few episodes I was curious how they compared… so I made a spreadsheet. Big surprise there, I know. The more I watched, the more metadata I started tracking ultimately having to re-watch some past episodes to pick out data I hadn’t originally collected. In doing so it brought fun rewards quickly.

For example, in S02E09, contesting Katherine says that Sal helped win the most money during first season (10 episodes) and Brian ‘Q’ Quinn came in second. In reality, Sal helped win $64,000 while Q helped bring in $71,000. Either way, sound choice as they bring in the most by a good margin over the other two Jokers up to that point. Even better that she watched the first 10 episodes with that data point in mind. But… how about getting to that final stage where the big money is? Knowing how miserable events are scored is what it takes. That’s where this data comes in.

If you want to get on this game show you now have everything you need to better understand scoring and be ready for events. Even knowing, for example, that no event has been scored lower than 11 can help immensely in the final stage. The data:

Tab 1, “Ep Metadata” includes the season/episode number, air date, contestants, the two Jokers paired with each, winner, winner’s gender, final stage Joker assistant, total won, and notes. By the end of the second season there were four “perfect games” where the contestant won the maximum amount ($33,000 during a normal game, $50,000 during the Christmas special). Finally, it includes a running total of the prize money to date, $607,500 by the end of season two.

Tab 2, “Misery Data” is the meat of it while containing relatively few columns, but representing the most work. It includes the episode number, the miserable incident as listed on the game board, the score, a VNTO designation, the reward, if the contestant won the money, and comments. The VNTO designation indicates the format of the event which is a video, news article, text, or ‘other’. The column with the reward is color coded green or red to indicate if they won or lost that money. The time-consuming part is in column B, that lists the miserable incident but also links to it. I actually spent the time finding the exact news article or video in most cases. More on that in a bit.

Tab 3, “Statistics” is where we get the fun digestible information and the bigger take-aways like there being a single miserable incident scored at 100 or the average score of all incidents across two seasons is 56.0. It also has joker pairings, types of media totals, contestant breakdowns, and more.

Tab 4, “Charts” is a set of visual representations of the statistics, because people like colors and shapes!

Jumping back to finding the exact news article or video, that effort made it very clear early on that the news article headlines they show are often not real. The show will take the headline and make minor edits to it presumably for readability and to convey the relevant points. That’s fine, I get it. But… the problem is that on rare occasion they actually leave out something specific that might drastically alter the misery score. What isn’t clear is if the panel that scored knew that detail. Let’s look at the biggest example:

In a video clip from ABC News, the show includes some of the audio recording and transcription as seen above. The contestants are asked to then score “Your Doctor Disses You During Surgery“. OK, based on that info you consider the three pillars and make your guess and maybe you got it right (51) or maybe you guessed lower because some people said mean things behind your back. The real question is, did the panelists score based on that or did they have knowledge that it resulted in a malpractice suit that yielded $500,000 for the victim? Pretty sure that would drop the misery quite a bit. These little omissions are interesting since they can impact the game, but a contestant has no way of knowing the missing details or if it was factored in on a score.

So, there we have it! Going into season three, hopefully contestants choose Sal (213k) or Q (190k) in the final round instead of Joe (144k) or Murr (60.5k). I know it seems like Murr doesn’t do well but he has only been selected four times as compared to Sal who was selected 11 times. With that factored in, that means Sal only averages $19,363 and Murr $15,125. But when you are playing for that kind of money, every dollar matters.

Hopefully this data will help future contestants! If you notice any errors in my data please leave a comment so I can fix it up. As time permits, I will continue to update the sheet if the show for future episodes. Enjoy!

The Misery Index Data

A critique of the summary of “Latent Feature Vulnerability Rankings of CVSS Vectors”

What do you think of this?” It always starts out simple. A friend asked this question of an article titled Summary of “Latent Feature Vulnerability Rankings of CVSS Vectors”. This study is math heavy and that is not my jam. But vulnerability databases are, and that includes the CVE ecosystem which encompasses NVD. I am also pretty familiar with limitations of the CVSS scoring system and colleagues at RBS have written extensively on them.

I really don’t have the time or desire to dig into this too heavily, but my response to the friend was “immediately problematic“. I’ll cliff notes some of the things that stand out to me, starting with the first graphic included which she specifically asked me about.

  • The header graphic displays the metrics for the CVSSv3 scoring system, but is just labeled “CVSS”. Not only is this sloppy, it belies an important point of this summary that the paper’s work is based on CVSSv2 scores, not CVSSv3. They even qualify that just below: “We should note the analysis conducted by Ross et al. is based upon the CVSS Version 2 scoring system…
  • Ross et al. note that many exploits exist without associated CVE-IDs. For example, only 9% of the Symantec data is associated with a CVE-ID. The authors offered additional caveats related to their probability calculation.” That sounds odd, but it is readily explained above when they summarize what that data is: “Symantec’s Threat Database (SYM): A database extracted from Symantec by Allodi and Massacci that contains references to over 1000 vulnerabilities.” First, that data set contains a lot more than vulnerabilities. Second, if Symantec is really sitting on over 900 vulnerabilities that don’t have a CVE ID, then as a CNA they should either assign them an ID or work with MITRE to get an ID assigned. Isn’t that the purpose of CVE?
  • Ross et al. use four datasets reporting data on vulnerabilities and CVSS scores…” and then we see one dataset is “Exploit Database (Exploit-DB): A robust database containing a large collection of vulnerabilities and their corresponding public exploit(s).” Sorry, EDB doesn’t assign CVSS scores so the only ones that would be present are ones given by the people disclosing the vulnerabilities via EDB, some of whom are notoriously unreliable. While EDB is valuable in the disclosure landscape, serving as a dataset of CVSS scores is not one of them.
  • About 2.7% of the CVE entries in the dataset have an associated exploit, regardless of the CVSS V2 score.” This single sentence is either very poorly written, or it is all the evidence you need that the authors of the paper simply don’t understand vulnerabilities and disclosures. With a simple search of VulnDB, I can tell you at least 55,280 vulnerabilities have a CVE and a public exploit. There were 147,490 live CVE IDs as of last night meaning that is almost 38% that have a public exploit. Not sure how they arrived at 2.7% but that number should have been immediately suspect.
  • In other words, less than half of the available CVSS V2 vector space had been explored despite thousands of entries…” Well sure, this statement doesn’t qualify one major reason for that. Enumerate all the possible CVSSv2 metric combinations and derive their scores, then look at which numbers don’t show up on that list. A score of 0.1 through 0.7 is not possible for example. Then weed out the combinations that are extremely unlikely to appear in the wild, which is most that have “Au:M” as an example, and it weeds out a lot of possible values.
  • Only 17 unique CVSS vectors described 80% of the NVD.” Congrats on figuring out a serious flaw in CVSSv2! Based on the 2.7% figure above, I would immediately question the 80% here too. That said, there is a serious weighting of scores primarily in web application vulnerabilities where e.g. an XSS, SQLi, RFI, LFI, and limited code execution could all overlap heavily.
  • Input: Vulnerabilities (e.g., NVD), exploit existence, (e.g., Exploit-DB), the number of clusters k” This is yet another point where they are introducing a dataset they don’t understand and make serious assumptions about. Just because something is posted to EDB does not mean it is a public exploit. Another quick search of VulnDB tells us there are at least 733 EDB entries that are actually not a vulnerability. This goes back to the reliability of the people submitting content to the site.
  • The authors note their approach outperforms CVSS scoring when compared to Exploit-DB.” What does this even mean? Exploit-DB does not do CVSS scoring! How can you compare their approach to a site that doesn’t do it in the first place?

Perhaps this summary is not well written and the paper actually has more merit? I doubt it, the summary seems like it is comprehensive and captures key points, but I don’t think the summary author works with this content either. Stats and math yes. Vulnerabilities no.

Search Speak for Automaton

Alternate titles for this blog could be “Doodle Transition for Machina” perhaps! For at least a decade I have thought about just such an application and today I have Google Translate for Android. Load, aim, and it will process the text and translate on screen for you. Given the state of technology you would think it would be amazing by now, and it sometimes is.

The success largely depends on the language and that can also be seen in using translate.google.com, where some languages will translate fairly cleanly and others are very rough. One language I have to translate frequently is Chinese (simplified) and it is problematic for many things including company names and technical terms. With that in mind, I would expect it to translate with the same issues via the Google Translate app, and more specifically, do so consistently.

Since I am writing this, you know what’s coming…

This is the result of holding the phone up to a mail label from Japan. That’s all! Just moving the phone ever so slightly by tilting it or moving it half an inch closer / farther will make it change the translation. I think it finally got it a bit correct on that last one since the envelope didn’t contain anything living.

Hopefully the translation technology from Google will advance more quickly on Asian languages. Until then, I am just glad I didn’t get any “Sunrise Holy Poop” in that envelope.

Commentary on Radware’s Top Web Exploits of 2020

At the close of each year we see at least one article covering the top vulnerabilities / exploits from the prior year. This is usually written on the back of having large detection networks across the Internet that get a comprehensive view of exploitation. It’s a great way to get real intelligence for criminal hacking activity. Unfortunately, we often see a breakdown when it comes to conveying that information in a useful manner. I know there is an argument to be made that the companies releasing such blogs are primarily after PR, sure. But they also have an opportunity to help their clients and the rest of the world by ensuring the blogs contain more useful and actionable information.

For this commentary, I’ll examine Radware’s blog, “The Top Web Service Exploits in 2020” published December 23, 2020 and covered almost verbatim by Security Magazine on January 5, 2021. I don’t have a view into exploit activity itself, but I do have a good view into the vulnerability disclosure landscape that is a cornerstone of this commentary.

We’ll start by setting a few basic ideas for mutual understanding for any such blog. First, each exploit should be tied to a unique vulnerability or it should explain it is an exploit chain and clearly delineate each vulnerability in the chain or explain what it represents if not a pure vulnerability. Second, it should provide at least one external reference for each vulnerability; either a CVE ID, vendor advisory, or commonly accepted third-party advisory such as US-CERT or another similar body. This is what allows the reader to quickly determine if their organization has patched against the vulnerability or not. If I have to spend considerable time trying to determine which vulnerability is being described, many organizations may be at a complete loss trying to figure it out.

With that, let’s look at the top 10 exploited vulnerabilities in 2020, according to Radware, and try to figure out some additional information for perspective. I will also be very clear that Radware’s blog is extremely frustrating and not immediately helpful, instead requiring a lot of extra work. The fact that they only attributed three exploits to a CVE ID is a dismal commentary on the CVE ecosystem. This analysis of their analysis will server as a reminder that comprehensive vulnerability intelligence is the foundation of any good security program.


Service Exploit #1: /ws/v1/cluster/apps/new-application

Based on their description, this appears to match VulnDB 184750 “Apache Hadoop YARN ResourceManager REST API Request Handling Remote Command Execution“. The first thing of interest is it was disclosed on October 19, 2016 and does not have a CVE assignment over four years later. No wonder many organizations aren’t aware of this vulnerability and have not sought out their own remediation strategy.

Service Exploit #2: /manager/html

This is summarized as “Apache Tomcat Manager Application Upload Authenticated Code Execution” and goes on to describe it as “This module can be used to execute a payload on Apache Tomcat servers that have an exposed “manager” application. The payload is uploaded as a WAR archive containing a JSP application using a POST request against the /manager/html/upload component.

Despite this description, that does not cleanly map to any vulnerability in VulnDB. The closest matches are CVE-2017-12615 and CVE-2017-12617 which is an abstraction for different platforms, but fundamentally “Apache Tomcat HTTP PUT Method JSP File Upload Remote Code Execution“. On the surface this is a match with Apache Tomcat, JSP application, and POST request to achieve code execution. However, those two CVEs cover a JSP file upload, not a WAR archive, and do not mention the /manager/html/upload component. So we’re left wondering if the exploit described is simply a misconfiguration scenario (i.e. intended functionality not secured) or an actual disclosed vulnerability.

Service Exploit #3: /level/15/exec/-/sh/run/CR

Based on the description, this is a misconfiguration scenario where an administrator sets up a Cisco router with the HTTP admin interface enabled, but without password protection. This allows an attacker to use the legitimate functionality to run arbitrary commands.

Service Exploit #4: /admin/assets/js/views/login.js

Radware says this “resource belongs to Sangoma FreePBX code and it looks like the attackers are trying to detect vulnerable FreePBX servers and exploit one of the known vulnerabilities.” The first issue is that script doesn’t immediately track to a VulnDB entry based on titles, which reflect the script name typically. However, let’s consider the URL being seen: … login.js. Rather than attempting to exploit “one of the known vulnerabilities“, I would suggest instead they are trying default credentials. At least back around 2000, the tried-and-true default credentials of admin/admin were all you needed to access the interface.

This one is curious to me because presumably a company that was detecting exploit traffic and could see e.g. POST requests as demonstrated in Service Exploit #2, would also see that the attackers were trying the default credentials. So we’re left with Service Exploit #4 being of little help and only creating confusion over what is being exploited.

Service Exploit #5: /ftptest.cgi?loginuse=&loginpas=

Radware attributes this to “many cheap Wireless IP web cameras use the same genetic code based on the GoAhead code (the tiny, embedded web server).” This tracks cleanly with VulnDB 181032 “Axis Multiple Products axis-cgi/ftptest.cgi Multiple Parameters Remote Command Execution Weakness“. This is actually a fun rabbit hole as this disclosure originally comes from an audit of a AXIS A1001 Network Door Controller and exploitation of this issue requires privileged access to the management interface. With that in mind, we’re back to a default credential scenario that may be the actual issue. Back in 2001, defaults for Axis network cameras were covered by CVE-2001-1543.

[Update: Z Balazs points out that this finding is likely due to Persirai botnet activity and links to more information.]

Service Exploit #6: /service/extdirect

This is the only one of the ten exploits covered that they include a CVE ID for. CVE-2019-7238 maps to VulnDB 198437 “Nexus Repository Manager /service/extdirect Insufficient Access Control Request Handling Remote Code Execution“. But, is that really the right ID? If we look at CVE-2020-10204 we are given a very brief summary of “Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution” and a link to the vendor advisory. However, VulnDB 226228 also maps to this and is summarized as “Nexus Repository Manager /service/extdirect Request Handling Remote Command Execution“. We immediately see the /service/extdirect from Radware’s finding in both titles. The vendor’s advisory does not include this endpoint though, but we find it in this exploit published on GitHub that tracks with the CVE-2020-10204 and we see it in a different exploit for CVE-2019-7238.

CVE-2019-7238 was fixed in Nexus Repository Manager version 3.15.0 and CVE-2020-10204 was fixed in version 3.21.2. Due to the vague vendor advisories it difficult to tell if this was a regression situation or something else. But, the CVE-2020-10204 vendor advisory gives us the interesting bit in the context of exploitation: “The vulnerability allows for an attacker with an administrative account on NXRM to execute arbitrary code by crafting a malicious request to NXRM.” That is an important distinction! So this is likely CVE-2019-7238 as Radware says, unless there are default credentials which would allow for exploiting CVE-2020-10204 as well.

Looking at the NVD entry for CVE-2020-10204 we also see that they scored this incorrectly for their CVSSv3 score, as ‘Privileges Required‘ should be ‘High‘, notLow‘ as they have it.

Service Exploit #7: /solr/admin/info/system?wt=json

For this one, we get an Apache Bug ID (SOLR-4882) and CVE-2013-6397 as references which is great. That said, it would be very helpful if Radware would link to these resources to make it easier for their readers.

Service Exploit #8: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

This is the third exploit they match to an ID, CVE-2017-9841 and it was disclosed June 27, 2017. Another good reminder that software with disclosed vulnerabilities and vendor solutions are not being applied, causing many organizations to become low-hanging fruit in the exploit world.

One little nitpick is that the full path they include is likely not how this would manifest on a server. Everything after “src” would be the endpoint being scanned presumably: /Util/PHP/eval-stdin.php

Service Exploit #9: /hudson

With this, we run into another mess and rabbit hole. Radware summarizes this as “Hudson continuous integration tool – multiple vulnerabilities” and further describes Hudson as “a continuous integration tool written in Java, which runs in a servlet container, such as Apache Tomcat or the GlassFish application server. Over the years the project was replaced by Jenkins. The final release. 3.3.3 was on February 15, 2016. Today Hudson is no longer maintained and was announced as obsolete in February 2017.

Based on this description, this could be any one of at least 50 vulnerabilities going back to February, 2014, one of which does not have a CVE ID. 41 of these are in Jenkins software which is mentioned above.

Other Service Exploits

This is a curious conclusion to the “top 10” list, as it states “In addition to the new items that we covered in this list, we have also seen items that we already saw and covered in our previous blog Top 10 Web Service Exploits in 2019 such as /ctrlt/DeviceUpgrade_1, /TP/public/index.php and /nice%20ports%2C/Tri%6Eity.txt%2ebak.

That isn’t exactly a #10 on this list, rather a catch-all for “other stuff we saw including…“. The first listed tracks with VulnDB 170573 “Huawei HG532 Routers /ctrlt/DeviceUpgrade_1 NewStatusURL Element Remote Command Execution (Satori)” which is notable as it is used in Satori, a Mirai botnet variant.

The second tracks with VulnDB 194379 “ThinkPHP /public/index.php call_user_func_array() Function vars[1][] Parameter Remote Code Execution“. Note the different exploit path and we see it can actually be exploited via several endpoints according to analysis of the vulnerability by Knownsec 404 Team.

The third doesn’t immediately track with an entry in VulnDB. Radware gives us “/nice%20ports%2C/Tri%6Eity.txt%2ebak” which we can decode to a more friendly “/nice ports,/Trinity.txt.bak“. A quick Google for that request finds a blog from Dragos titled “Threat Hunting With Python Part 2: Detecting Nmap Behavior with Bro HTTP Logs” explaining this request:

The request for “/nice ports,/Trinity.txt.bak” comes from Nmap’s service detection routine testing how a server handles escape characters within a URI. The actual request is “GET /nice%20ports%2C/Tri%6Eity.txt%2ebak HTTP/1.0\r\n\r\n”.

So this isn’t an actual exploit, rather, it indicates that attackers are using the Nmap port scanner. This is a good reminder that “exploit scanning” doesn’t always cleanly map to a specific vulnerability.


Detecting exploitation is critical for every organization. Doesn’t matter if it is on-premises devices or a managed service-based detection. What is more critical is having comprehensive and timely vulnerability intelligence that can turn what you detect into actionable information. This is how you not only detect, but evaluate and remediate, assuming of course the vulnerability is known to the vendor or a mitigation can be enacted.

December 2020 Reviews

[A summary of my movie and TV reviews from last month, posted to Attrition.org, mixed in with other reviews.]


The Queen’s Gambit (2020)
Rating: 5/5 check it out mate
Reference(s): IMDB Listing || Netflix
This miniseries, based on a 1983 book with the same name, is a fictional story about a chess prodigy turned master. It has the feeling of a real story and the producing, sets, and acting strongly lend to this. The main character, played by Anya Taylor-Joy, does an epic job playing a character who has personality quirks and addiction issues. The story is set many decades ago and gives a good reminder of the expectations about women in society. While chess may not seem to be a good basis for a fast-pace drama, the series does a wonderful job maintaining a good pace. I highly recommend this series for everyone.


Tenet (2020)
Rating: 5/5 – Action-packed mind-fuck
Reference(s): IMDB Listing
OK, you have to see Tenet. I think i liked it a lot? But I won’t be sure until I see it a second time. At least. Maybe a third time? It is a very cerebral movie and it makes Inception look like a cartoon in some ways. There are several layers and I think on a second watch I will probably notice a lot of things that would have helped keep up / understand along the way the first time through. Things that are better revealed toward the end as the movie progresses and evolves that will potentially make it more enjoyable the second time around. Very neat movie; great casting, great acting, and it really draws you in.


Ted Lasso (2020) [Apple TV]
Rating: 5/5 better than a biscuit, which is a cookie
Reference(s): IMDB Listing || Apple
This comedy from Apple TV stars Jason Sudeikis as “Ted Lasso”, an American football coach recruited to coach a British football (soccer) team. It’s basically Gomer Pyle (Lasso) meets Major League (plot) to start and it delivers. Sudeikis does a wonderful job playing the always upbeat transplant assisted by coach Beard (Brendan Hunt) as they are immersed in a new culture and new sport at the same time. It’s not a sports show at all, it’s just about the people and interactions with goofy analogies and quick wit. Very light and well-done comedy, worth the watch.


Devs (2020) [Hulu]
Rating: 4.9/5 I have seen what perfection has wrought
Reference(s): IMDB Listing || Amazon
You think you have seen interesting or compelling tech company drama? You haven’t until you watch this, and you will. You will understand the concept of quantum computing before you start the show and you will embrace the many-worlds theory. You find this review confusing now but it will become clear, until it doesn’t again. And then you will find yourself the god in the machine while you ponder the implications of when computing power goes too far. You will then enjoy your new state of enlightenment and make better choices.

Described as a drama/thriller when mindfuck is more apt. This show does a great job of making you think about serious implications that quantum computing could bring. While it is certainly sci-fi in the level of computing power suggested, it creates a nice vehicle to let us have a glimpse into what “quantum supremacy” might mean.


Marauders (2016)
Rating: 4.5/5 But i’m a sucker for heist flicks
Reference(s): IMDB Listing || Amazon
Bruce Willis, Christopher Meloni, and Dave Bautista in a cops and robbers movie and somehow I completely missed this movie existed until I saw it on a Netflix scroll?! As a fan of the genre and generally not too critical of such movies, this one was surprisingly good. None of the acting stood out particularly but none of it was bad. A couple extra decent actors and the movie came together pretty well. Until halfway through I was wondering which way it would go as far as the “who done it” goes. The ending? Not how I would have played it out. If you like the genre, it’s worth a watch.


Fatman (2020)
Rating: 4/5 who let him make movies again?
This movie is a light-hearted take on Christmas and the failures of Santa, at least through the eyes of Walter Goggins’ character. This is kind of a comeback movie for Mel Gibson after his numerous personal failures, some that make it ironic with him playing a very Christian character while personally being a drunk and hating Jews / black people. Gibson’s last bit makes it all the more surprising that the amazing Marianne Jean-Baptiste would sign on to play his wife giving a modern interracial Claus family. Really surprising that despite his history that his career freeze has “thawed” as they say in the industry and that he is being given a second chance. While he can be a great actor, essentially bringing the same character “Porter” from Payback (1999) to play Santa, I have to wonder is Hollywood so hurting for actors that they would accept him back after his sordid history?

Oh sorry, enough of that shitbag that can act well. Fun movie, two great actors as main characters, fun and simple story, it really brings the true spirit of Christmas in my eyes. Think [generic assassin movie] + Toys + [cynical Christmas movie] and you know what are you in for. Worth a watch, but don’t pay for it which shows support for Gibson. Find another way to watch it for free and then find a way to support Baptiste and Goggins directly instead. Did I mention fuck Gibson?


The Midnight Sky (2020)
Rating: 2.5/5 The movie belongs on a fiery earth
Reference(s): IMDB Listing || Netflix
Based on a book I didn’t read, this movie adaptation brings some star power with Felicity Jones and George Clooney. Without spoiling, the movie screamed “this is not what it seems” from the beginning so the ending was not as impactful as it could have been. Earth on fire and nearly uninhabitable? Sure! A two (?!) year voyage to the nearest habitable planet outside the solar system? OK! Man losing supplies then falling into arctic water and surviving? Prepare to suspend disbelief in the worst way. Overall, I suspect this is a case where the movie just didn’t do the book justice and fell short.

[Update: @_pronto_ pointed out they traveled to a moon of Jupiter, not outside the solar system. But still, a new moon of Jupiter that we didn’t know about is a viable alternative to Earth and Mars apparently isn’t?]


2067 (2020)
Rating: 2.5 / 5 – Science friction is more like it
Reference(s): IMDB Listing
For fans of the sci-fi genre, I don’t know if I should recommend 2067 or not. On one hand I like near-term sci-fi and I like dystopian films, which this offers both of. On the other, there are quite a few annoying bits about this, primarily the cast. I didn’t give two shits about anyone and most were annoying enough that I wanted them to die. Throw in a couple completely illogical things to advance the plot, a sign of bad writing in my opinion, and it just didn’t mesh well. It was good enough that, a ways in, I was willing to stick with it just to see how it ended. Recommend for watching while working, doing a puzzle, or falling asleep to.


The Jesus Rolls (2019)
Rating: 2/5 between 7-10p split, don’t watch
Reference(s): IMDB Listing || Amazon
Did you know there was a spin-off to The Big Lebowski? Neither did I until recently. It follows a brief part of Jesus’ life, but not really his life bowling unfortunately. This is basically the story of two hapless and idiot guys on the lowest-end crime spree you can imagine. The humor is also some of the lowest-end too; there wasn’t that much to laugh about as the bit comedy was lacking overall. I’d pass on this and re-watch the dude. On the upside, we do learn the story behind the sex offender registry.


War Inc (2008)
Rating: 1/5 Disown the “spiritual cousin”
Reference(s): IMDB Listing || Amazon
John Cusack plays an assassin in this movie co-starring Joan Cusack and Dan Aykroyd … no, he does in this movie too. According to Wikipedia, Joan Cusack said, “.. in a way, it was a Grosse Pointe Blank 2” while John Cusack said it was a “spiritual cousin to Grosse Pointe Blank”. Sure, I can see that but it isn’t nearly as amusing. Intended to be political comedy & commentary (comedary?) it comes across as a cliché to other cliché films while borrowing from characters from the prior film. Rather than go with more subdued humor around a military presence in a fictional Middle Eastern country, they opted to go over-the-top and it really detracted from the potential. Skip this, (re)watch GPB instead.

Dystopia Arrives

The dystopia genre has enjoyed a lot of attention the last decade with hits like The Hunger Games, Blade Runner 2049, and Automata as a few examples. To me, a dystopian film is set in the near future with a focus on society more than technology. In my late teens and early 20s I loved reading the cyberpunk genre which often was a dystopian view but also focused on technology as a carrier of the film, like the more recent Ready Player One does. So dystopian and cyberpunk often blend to me and is more about the focus and story that may set them apart.

One thing common in dystopian movies is the breakdown of society, typically at the hands of a tyrannical government that does not see all citizens as equal. In The Hunger Games, society was segregated into districts that enjoyed more or less comfort. Soldiers from the capitol enforced the rules and made sure that impoverished districts stayed that way while demanding their citizens provide resources and play in games to the death, for the entertainment of the wealthy. Even the trip to the capitol in a train showed the gap with extensive platters of food, the likes of which some contestants had never seen in their life. Their homes were in a district surrounded by fences with the penalty of death for escaping. Medical care was basically non-existent in some districts and there was no way to challenge the system as democracy and voting were a thing of the past.

Similar elements can be seen in many movies including Equilibrium, Divergent, Elysium, Code 8, and the classic Fahrenheit 451 which was recently remade. We see aspects of these fictional societies in our own and it makes the movies more compelling.

We see governments becoming more authoritarian, the wealth gap widen, and millions of people being left behind. Little bits here and there keep adding up and we don’t notice the slow boil until it is too late. But I have to wonder, when does our own society reach the point that it can be considered dystopian?

I think dystopia has arrived.


During the last year, the political climate has reached critical levels as tens of millions have become disenfranchised in one manner or another. With COVID-19 devastating the entire world, even so-called “first-world” countries like the United States have seen record levels of unemployment, over-burdened food banks, over-populated prisons rocked by the pandemic, disenfranchised voters waiting half a day to vote, hospitals over capacity and turning away patients, freezer trucks used as temporary morgues due to overflow, and record levels of eviction and unhoused families. I can’t think of a book or movie that portrays it, but the “homeless sweeps” enacted in many cities are straight out of a dystopian nightmare.

The rapidly growing ad-hoc homeless encampments we see in cities are growing steadily which can increase risk to residents and businesses. Home-owners perceive their risk of becoming a victim of crime increasing and lobby to have them removed from their neighborhood. As the homeless are forced to live in tents set up in the right-of-way in front of half a million dollar homes, resentment grows. If this continues we will see a boiling point happen and there might be a homeless uprising. What do they have to lose? Jail or prison isn’t ideal by any means but it does give them shelter and food which are jeopardized every day.

Protests rocked the United States leading many cities to have government buildings and businesses boarding up windows, hiring security, while many are going out of business as the uncontrolled pandemic ravages communities. We’ve seen more fences going up in protest areas, around public space, and even around police stations.

The central element to dystopian literature and film is the tyrannical government that looks out for the upper class and has little to no concern for the rest of society. That can certainly be increasingly seen in U.S. politics the last decade and even now, congress is arguing about giving citizens a $2000 stimulus after struggling to pass a $600 payment. Meanwhile the bills are bundled with other legislation and proposals that do everything but help citizens. As certain elements of the government seek to consolidate power the level of resentment and protest increases significantly, as we saw. This has led to stand-offs and clashes between angry tax-payers and disreputable police.

This becomes cyclical as protesters become more organized and police become more militarized. The methods of law enforcement began blending with military tactics long ago and in many cases local police have become almost indistinguishable from soldiers. Police departments have been purchasing military equipment for years, giving them both offensive and defensive gear including vehicles that are overkill.

Even without gear that is considerably overpowered, police departments have the outward appearance of not taking their oaths to heart. Thousands of videos of incidents in which police used excessive force on protesters and journalists flooded Twitter in 2020. The disproportionate and indiscriminate killing of minorities have added a level of anger and contempt we haven’t seen before. Demands range from simple reform to accountability changes to the total abolition of police departments.

Think about your favorite dystopian book or movie and what aspects of that society make it dystopian in the first place. Compare those same attributes to what we have seen in the United States in the last twelve months. When you do, you might reach the same conclusion that our society has crossed the line and we live in the dystopia we have paid to enjoy through fiction until now.

So again, I think dystopia has arrived.