A Phishing Primer

Picture credit: Stern
I received this email today, related to some earlier blog postings on the epidemic of phishing.

Not sure what phishing is? Sure you do: it's the plethora of emails you receive asking you to reset your PayPal account information, notifying you that your CitiBank account may have been compromised, and a myriad of variations thereof. All are designed to get you to sign-in to a "false store-front" that appears to be a real financial site. But instead of logging on to a real website, your account and password data are sent directly to the crooks running the scam.

Back to the email I received. In part, it read:

We are trying to compose a short but clear guide to email to our customers and put on our site to warn our customers what to look out for - what is the customer information email you have seen? Would be great if you have some examples of the good, bad and ugly.

Here's a simple summary. The following is a typical phishing email, courtesy of Wikipedia:

From: eBay Billing Department To: xxx@yyy.com Subject: Important Notification We regret to inform you that your eBay account could be suspended if you don't re-update your account information. To resolve this problems please click here and re-enter your account information. If your problems could not be resolved your account will be suspended for a period of 3-4 days, after this period your account will be terminated. For the User Agreement, Section 9, we may immediately issue a warning, temporarily suspend, indefinitely suspend or terminate your membership and refuse to provide our services to you if we believe that your actions may cause financial loss or legal liability for you, our users or us. We may also take these actions if we are unable to verify or authenticate any information you provide to us. Due to the suspension of this account, please be advised you are prohibited from using eBay in any way. This includes the registering of a new account. Please note that this suspension does not relieve you of your agreed-upon obligation to pay any fees you may owe to eBay. Regards, Safeharbor Department eBay, Inc This is an automatic message. Please do not reply.

If you ever receive an email purporting to be from a financial website, please follow this simple step:

Never click on a link in an email to visit a sensitive website. Visit the site directly by using your browser bookmarks or by typing in the address in the browser's address bar.

That's the easiest way to be a safe surfer in the wonderful world of phishers.
 

New Scientist on the BlueTooth Vulnerability

(Picture credit http://www.tomsnetworking.com)
I wrote a bit last week on the implications of the recently discovered vulnerabilities in the BlueTooth protocol. The weaknesses, combined with hacking innovations such as the BlueSniper rifle, make it easy to sniff or even co-opt BlueTooth networks at distances in excess of a mile. New firmware, anyone?

The best description of the vulnerability I've yet read is this excerpt from an article in New Scientist:

During pairing, two Bluetooth devices establish the 128-bit secret “link key” that they then store and use to encrypt all further communication. The first step requires the legitimate users to type the same secret, four-digit PIN into both devices. The two devices then use this PIN in a complex process to arrive at the common link key. Whitehouse showed in 2004 that a hacker could arrive at this link key without knowing the PIN using a piece of equipment called a Bluetooth sniffer. This can record the exchanged messages being used to derive the link key and feed the recordings to software that knows the Bluetooth algorithms and can cycle through all 10,000 possibilities of the PIN. Once a hacker knows the link keys, Whitehouse reasoned they could hijack the device. But pairing only occurs the first time two devices communicate. Wool and Shaked have managed to force pairing by pretending to be one of the two devices and sending a message to the other claiming to have forgotten the link key. This prompts the other device to discard the link key and the two then begin a new pairing session, which the hacker can then use. In order to send a “forget” message, the hacker must simply spoof one of the devices personal IDs, which can be done because all Bluetooth devices broadcast this automatically to any Bluetooth device within range. “Having it done so easily is surprising,” says Schneier. He is also impressed by the fact that Wool and Shaked have actually implemented Whitehouse’s idea in real devices. They show that once an attacker has forced two devices to pair, they can work out the link key in just 0.06 seconds on a Pentium IV-enabled computer, and 0.3 seconds on a Pentium-III. “This is not just a theoretical break, it’s practical,” says Schneier.

New Scientist: New hack cracks 'secure' Bluetooth devices
 

Moving men and material into space

(Picture credit http://www.thespacereview.com)
Interesting article on the challenges of transporting people and material into near-Earth orbit. Say, logistic support for a Mars colony or an interstellar mission, for instance:

"What you need is a launch system that stays on the ground"... One option is laser propulsion. Researchers at [RPI] have shown that they can propel an object weighing 5 ounces 300 feet into the air with a laser. A real-life version that could launch people in a vehicle "about the size of a Volkswagen" would require a 1,000-megawatt laser located on top of a mountain, he said... ...Another option is the Slingotron. "It is a huge slingshot affair that accelerates your payload on a spiral track and then, zoom--off to outer space," he said. It would kill humans but could be used for cargo. A third option is the space elevator, a large structure made of customized molecules that could spring people into outer space, according to proponents... Project Orion (The Space Site) Dyson himself worked on Orion, a project to land people on Mars, in the 1950s and 1960s. Orion, which would have been built by a submarine company in Connecticut, would have literally been a spaceship. "We were going to walk on Mars with our notebooks and draw pictures of everything. It would have been true 19th century exploring," he laughed. To propel it out of orbit, however, would have required exploding 3,000 atomic bombs, one every two seconds. The bombs would have been tossed out of a hole in the plate in the ship, delivered by "essentially what was a glorified coke machine," he said. Engineering prototypes and simulations showed that the project would work, and it would have cost far less than Apollo. The original plan was to get to Mars by 1965 and the moons of Saturn by 1970. "The fatal flaw of this scenario, of course, was radioactive fallout," he said, the ill-effects of which were being discovered at the time. "Technically, it worked very well, but it was political death."

Let's colonize space for fun
 

Fineman on Imus

(Picture credit http://en.wikipedia.org)
Last week, Newsweek's Howard Fineman visited the Don Imus program and had some interesting commentary regarding Watergate and the Felt affair.

Fineman noted that upon his entrance to the Columbia School of Journalism (where else?), his hero was Pulitzer Prize-winner Theodore White, who had authored the best-selling Making of the President  book series.

Upon leaving Columbia, Fineman's new heroes were Woodward and Bernstein, two journalists who transformed the art of beltway reporting. Everything that the pair stood far was not positive, according to Fineman. The key negative point?

Journalism became a de facto opposition party.

Over a period of time, this consistent anti-administration bias gave rise to the likes of Fox News chieftan Roger Ailes. Ailes and Fox News became "the opposition to the opposition party".

In this same vein, the Cassandra Report has its own take on journalism as the opposition party: MSM/DNC - a singular noun.
 

A Hike up Sandia Mountain

Picture credit: http://www.newmexicoliving.com
Brooke has a good write up -- with plenty of pictures -- on his hike up Sandia Mountain. The peak is 10,678 feet above sea level. Challenging under normal circumstances, the trek can be especially taxing for low-landers operating under a self-imposed time constraint.

Hike up Sandia
 

Bizarre, yet useful, Search Sites

I'd like to point out a couple of search sites that I found courtesy of a James Fallows article in the New York Times.

The first is a search portal called Mr. Sapo. Mr. Sapo provides instant comparative access to all major search engines using a simple button metaphor. Enter a search term, then click any of the buttons to see the results for the specified engine. Bizarre name? Check. Odd interface? Checkety check. Pretty darn useful? Check and mate, beenizzle*.

The Mr. Sapo site pointed me to a new search engine with which I was unfamiliar: Exalead. It is very, very interesting. Search on a term and you get a plethora of sidebar windows along with the traditional results. The sidebar windows provide drill-down capabilities over a variety of categories:

Related terms

Related categories

Geographic location of web site

Document type

Screen captures of each resulting site

In other words, support for down-selecting the search results using several useful criteria. Check it out.

*I am licensed to use teen/hip-hop lingo, given two teens in my current household.
 

So you want to be a phisher

Picture credit: http://tecfa.unige.ch
Like most Internet users, I've been awash in a deluge of phishing attempts of late. Unlike most users, though, I enjoy tracking down the source of the spam mails, the location of the false storefronts, and their owners. I think I've nailed down the typical modus operandi . Here's the lifecycle of a typical phishing scam, at least so far as I can tell.

Phisher uses IRC or similar means to surreptitiously meet with other blackhats and trade, purchase or otherwise acquire stolen credit-card data

Phisher uses stolen credit-card to purchase domain name (optional)

Phisher uses stolen credit-card to open a shared web hosting account

Phisher creates false storefront on new site

Phisher uses IRC or similar means to acquire list of open mail-servers or spamming accounts that can be used to send phishing emails

Phisher uses mass-mailing software to dispatch thousands or millions of phishing emails to direct victims to the bogus site

Phisher waits for the dough to roll in

After enough complaints arrive, the web hosting provider will inevitably determine that the bogus site needs to be shut down. At this point the phishing scam -- at least temporarily -- comes to a screeching halt.

Can we learn anything from this lifecycle?

I think we can. Hosting providers need to implement a little bit of technology: call it an anti-phishing package (APP). The package would be a process running on each shared server. Using the server's log files, APP would perform the following tasks:

Detect any new site (i.e., less than 90 days old) that receives a sudden burst of traffic

Examine the traffic for form submissions (GETs or POSTs)

Examine the traffic for pages named login, auth, etc.

In the event that any or all of these criteria are met, APP sends an automatic email to system administrators. They can then examine the suspect site and shut it down if necessary.

I would hope that the major shared hosting providers are already running a process like APP.
 

Do you know where your teens are and where they’ve been?

If you worry about where your teens are going, or where they've been, this gadget's for you.

"I'm staying overnight at Sara's house," your daughter tells you. Now there's a way to verify that everything's on the up-and-up. Hey, we all trust our kids. But, as Ronald Reagan used to say: trust... but verify.

SkyTel's new SkyGuard provides real-time location data, trip information, and location reports for up to 45 days. All of this is available through a web application.

You can even set up allowed and denied zones, areas where a family member shouldn't leave or a region they shouldn't enter. Real-time alerts can be sent to your pager, email account or a mobile phone. SMS text messaging is also supported.

If you're the paranoid type, this sort of technology can help set your mind at ease.

SkyTel: SkyGuard Features
 

The Littlest Big Man

The senior hoops writer at SportsLine, Gregg Doyel, tells us what's happening at the NBA draft camps. Will Bynum, a 5'10" guard from Georgia Tech, is wreaking havoc on the mock draft: dunking on players and even getting called for defensive goaltending...

Will Bynum isn't supposed to be here, much less be the most impressive player after one game of the 2005 NBA pre-draft camp. But that was Bynum out there Wednesday, dunking on bigger players, blocking shots and getting to the rim whenever he wanted... ...Matched against Marquette's Travis Diener or Utah Valley State's Ronnie Price at the Moody Bible Institute, Bynum did as he pleased offensively and showed his ridiculous hops by getting called for defensive goaltending. The only thing Bynum didn't show was a jump shot, and the way he was getting to the rim, why bother? On one fast break, he broke down Price so severely, using a behind-the-back dribble, that a European scout broke into applause...

Doyel: 5-10 Bynum works on elevating draft status at camp
 

Protecting Consumer Data

Picture credit: http://www.perspectivemr.co.uk
The hits just keep on coming at Citigroup:

In February last year, a magnetic tape with information on about 120,000 Japanese customers of its Citibank division disappeared while being shipped by truck from a data management center in Singapore. The tape held names, addresses, account numbers and balances. It has never turned up. And this week the company revealed that it had happened again--this time the loss of an entire box of tapes in the care of the United Parcel Service, with personal information on nearly 4 million American customers.

Here are some random thoughts on what every company should strive for when handling consumer data:

Catalog - catalog all sensitive data flowing through your systems, SSNs, dates-of-birth, credit-card and account numbers, etc. Know the fields that you hold and categorize any privacy fields as 'sensitive'.

Encrypt - sensitive data 'at rest' (meaning, on disk) should always be encrypted. Always. If a truck driver loses a backup tape, at least force any blackhat into a massive brute-force attack against it. Shipping around sensitive data in the clear makes about as much sense as handing the keys to a bulldozer and a six-pack to a 16-year old boy.

Key management - when applications or subsystems need access to sensitive data, force them to retrieve keys from another subsystem managed by another department or team. After decryption, force them to purge the keys (i.e., keys are never stored on disk). Log all key access attempts. This division of labor provides checks and balances in terms of access to sensitive data.

Log analysis - analyze the log files. Who has been requesting keys? How often? Do their usage patterns make sense given their roles - or are their statistical anomalies when compared to similar types of users? These are the types of questions that, say, a ChoicePoint should be asking. Oops, I forgot, those issues aren't ChoicePoint CISO Rich Baich's problem.

Processes - are documented processes in place for verifying the categorization of sensitive data, ensuring data at rest is encrypted, managing keys, and analyzing logs? If not, ensure that processes are put in place and that they are followed on a regular basis to ensure the safety of sensitive data.

Audit - is the audit team reviewing the process documents to ensure that the processes are being followed on predetermined schedules?

In short, we're not talking rocket science here. We're describing a relatively simple set of processes and the functional discipline to follow them. Given the financial risks of disclosing consumer data (i.e., check the graph of ChoicePoint's market capitalization), the time has never been better. Or you could simply risk having your organization highlighted on the front page of USA Today - in a non-flattering story.

The scramble to protect personal data
 

Book Review: Ken Follett's Hammer of Eden

I just submitted this review to Amazon.

Plot holes big enough to drive a seismic vibrator through

The idea, at first blush, is bold and captivating. A fringe, cult-like group is determined to protect their Northern California commune from developers. To do so, they need a credible means to force the state government to cease their incessant land-grabs. With the help of a geologist who's joined the commune, the cult leader (Priest) determines there may be a way to trigger earthquakes using a sonic mapping device known as a seismic vibrator. Priest intends to blackmail the state using the threat of earthquakes.

Follett's talent is prodigious. He's almost capable of making us believe that this preposterous scenario is remotely plausible. But even his immense talent isn't enough to make up for the succession of plot holes big enough to drive a seismic vibrator through.

Example: At one point, Michael seems to be the only one in the state who hasn't seen Priest's picture on television. Because Michael encountered Priest early on in the story, he should have recognized him on TV and the entire FBI dragnet should have ended a lot sooner.

The puzzle pieces are all there, in formulaic fashion: The cute, female FBI agent. The cute, divorced male geologist Michael. The Manson-like cult leader Priest who, though illiterate, is able to evade the FBI repeatedly while driving a giant seismic vibrator that tops out at about 40 mph. I'm sure you can guess what happens.

If you're stuck inside on a rainy day and you happen to have this laying around (and nothing else to do), certainly go ahead and read it. Otherwise, learn macrame or origami. You'll drive yourself crazy second-guessing the characters and the author in this all-too-predictable bore-fest. Mr. Follett is far too talented to be producing works of this caliber.
 

The Pledge Class

Picture credit: Boston Globe
In conjunction with the Boston Globe's release of John Kerry's college records, the following transcript was recently discovered. It records the conversations that took place at the fraternity house in which various pledge candidates were discussed.

Okay, the kid is a zero. It's true. But think back to when you were freshmen. Boone, you had a face like a pizza with anchovies, right? Everyone thought Stork here was brain-damaged... I myself was so obnoxious the seniors used to beat me up at least once a week. So this kid... is a total loser. Well, let me tell you the story of another loser...

At which point the place erupts into derisory moans, boos and flying glasses.

Who dumped a whole truckload of fizzies into the swim meet? Who delivered the medical school cadavers to the alumni dinner? Every Halloween, the trees are filled with underwear. Every spring, the toilets explode...

Boston Globe: Yale grades portray Kerry as a lackluster student
 

Least Loved Bedtime Stories

In the spirit of James Taranto at Best of the Web (Least-Loved Bedtime Stories - "Harry Potter and 'Deep Throat' " -- headline, CNN.com, June 7), herein the reader may find a list of bedtime stories that they should not read to their kids:

The Grinch That Got Tasered While Shoplifting at K-Mart

Why Timmy's Parents Stopped Loving Him

A Child's First Book of Assault Rifles

Puff, the Crack-Addled Dragon

One Elvis Two Elvis Skinny Elvis Fat Elvis

There's a Rocket in my Pocket!

Oh, the Places You'll Go (after a Felony Conviction)

How the Littlest Bear Found Out He Was a Mistake

Horton Hears a Ho

The Cat in the Hat Gets Capped

 

Firefox Flaw

Picture credit: http://www.detstar.com
Though the odds of an exploit appear low, this vulnerability in the Mozilla and Firefox browsers just resurfaced after a seven-year hiatus:

...For a spoofing attempt to work, a surfer would need to have both the attacker's Web site and a trusted Web site open in different windows. A click on a link on the malicious site would then display the attacker's content in a frame on the trusted Web site, Secunia said. The company advised people not to visit trusted and untrusted Web sites at the same time...

Here's one way a phisher could exploit this weakness:

User visits a malicious site, via emailed hyperlink or equivalent means

Cross-site scripting (XSS) could used to expose one or more financial sites that victim has visited

Malicious site opens financial website, perhaps as a background window

Malicious site feeds bogus sign-in form into financial website

User visits financial site window (perhaps later on) and authenticates

Authentication data sent to phisher

Nefarious, but feasible.

News.com: Spoofing flaw resurfaces in Mozilla browsers
 

This summary is not available. Please click here to view the post.

DomainKeys

The DomainKeys initiative is designed to dramatically reduce spam. In March, Yahoo! submitted a DomainKeys memo to the IETF in order to spur discussion. Yahoo! has been signing its emails with DomainKeys headers since 2004.

The goal? To dramatically reduce spoofing of sender email addresses. How many bogus phishing emails from "PayPal" are sent out each day? How many from Bank of America? There's little question that something needs to about the proliferation of spoofed spam messages.

Just how does DomainKeys work? It relies upon a combination of PKI and DNS. First, a hash is created of the email message contents (using SHA-1 by default). The hash is encrypted using a private-key unique to the sending domain (e.g., "yahoo.com"). The encrypted hash is then converted to ASCII printable characters using base-64. This value is then tacked on to the message headers (under the new SMTP header "DomainKey-Signature").

The receiving server uses the claimed sending domain to perform a DNS lookup. The returned data now would include the domain's public key. The recipient server may now decrypt the hash value and compare it to its own generated hash of the message content to validate the message. This ensures two things: the message truly was sent by the domain that claimed to have sent it; and the message has not been tampered with en route.

DomainKeys is covered by a U.S. patent owned by Yahoo! However, the company has released it under a royalty-free patent license designed to be interoperable with a variety of software implementations including freeware and open-source.

At present, DomainKeys is many things - but one thing it isn't is cheap. BusinessWeek reports:

...an e-mail security system with DomainKeys for a mass e-mailer costs $500,000, on average, says IronPort. For a big company, that's not much to stymie forged e-mails that can damage reputations and clog up millions of e-mail accounts...

The costs are sure to diminish as mailers swarm to this open-source-friendly approach.

Yahoo! DomainKeys
 

Inspiration

Picture credit: http://academic.scranton.edu
The greatest inspirational speech since Knute Rockne's 'Win one for the Gipper':

D-Day: War's over, man. Wormer dropped the big one. Bluto: Over? Did you say "over"? Nothing is over until we decide it is! Was it over when the Germans bombed Pearl Harbor? Hell no! Otter: Germans? Boon: Forget it, he's rolling. Bluto: And it ain't over now. 'Cause when the goin' gets tough... [thinks hard] Bluto: the tough get goin'! Who's with me? Let's go! [runs out, alone; then returns] Bluto: What the f**k happened to the Delta I used to know? Where's the spirit? Where's the guts, huh? "Ooh, we're afraid to go with you Bluto, we might get in trouble." Well just kiss my ass from now on! Not me! I'm not gonna take this. Wormer, he's a dead man! Marmalard, dead! Niedermeyer... Otter: Dead! Bluto's right. Psychotic, but absolutely right. We gotta take these bastards. Now we could do it with conventional weapons, but that could take years and cost millions of lives. No, I think we have to go all out. I think that this situation absolutely requires a really futile and stupid gesture be done on somebody's part. Bluto: We're just the guys to do it. D-Day: Let's do it. Bluto: LET'S DO IT!

Animal House
 

BlueTooth Troubles

Picture credit: http://www.tomsnetworking.com
Israeli researchers have found a major flaw in many common BlueTooth implementations. Bruce Schneier notes:

I can't be sure, but I believe it would allow an attacker to take control of someone's Bluetooth devices. Certainly it allows an attacker to eavesdrop on someone's Bluetooth network.

That's certainly how it appears. At its heart, the vulnerability appears to have two primary causes: (a) device manufacturers' use of a four-digit PIN instead of eight digits; and (b) a quirk in the protocol that allows one device to tell the other that it "forgot" the link key. The combination of these two weaknesses? Some serious security deficiencies.

Treo 650 (News.com)

Where's BlueTooth deployed these days? Lots of places. For instance, Acura automobiles use BlueTooth to provide handsfree integration with certain mobile phones (e.g., Treo phones/PDAs). And the protocol is used in a wide variety of other devices with many, many applications.

For instance, the HP DeskJet 650 is positioned in the market as a "mobile printer" that can be moved around a SOHO environment. It uses BlueTooth to establish a link with various computers in the home or office.

BlueTooth is also used in Toshiba's home appliances: microwaves, refrigerators, and washer-dryers. And in medical devices such as the Avant 4000 Digital Pulse Oximetry System. This device relays pulse and oxygen data from a wrist-worn sensor to a central monitor.

All, told BlueTooth is used in a host of office, home, medical, consumer, and related applications that require close-proximity device connectivity.

Now consider advanced hacking tools like the BlueSniper Rifle, pictured above. The rifle, a device that can be assembled from a couple of hundred dollars worth of parts, can scan and attack BlueTooth devices from distances exceeding a mile. In fact, when the crew at Flexilis used BlueSniper, they came to some interesting conclusions:

...John pointed the BlueSniper at the AON building, which was 0.6 miles (just about 1 km) from our position (this distance was verified by GPS after the shoot). It didn't take long for the MAC address of Bluetooth devices to appear on the laptop's screen. After a few seconds, John pointed the gun at the Library Tower / US Bank Building, which is the tallest building in Los Angeles. The building was .75 miles (a little over 1 km) from our position. As more Bluetooth devices started appearing, John said, "This building is full of Bluetooth! Look we got some Blackberries!" He also explained that, with multiple guns, it would be possible to track a single Bluetooth device as the person walked around. In less than a few minutes, twenty devices were detected—all at distances over a half mile away!

When we combine this newly discovered vulnerability, the popularity of BT-enabled devices, and powerful hacking tools like BlueSniper... well, you get the picture. At best, bad guys can wreak havoc -- remotely -- with home, automobile, office, and medical devices. At worst, who yet knows?

The key question: have device manufacturers considered the necessity of patching their implementations of BlueTooth to address ongoing security issues? My guess, in most cases, is no. I hope I'm surprised to find that they have considered these possibilities.

Schneier: Attack on BlueTooth
 

The Modern Slave Trade

Picture credit: http://www.ishr.org
If you strip away Microsoft Word-generated Air National Guard memos, the bogus comparisons of Gitmo to mass-murdering Gulags, the fake but accurate Quran-flushing reports... if you strip away almost all of what passes for news these days, what are we left with?

The real stories. The important stories. The stories that CBS, Newsweek, and the Gray Lady should be covering. But don't.

No, it's left up to the Bush State Department, vilified for lo these many years, to expose the vast scope of the modern slave trade. Perhaps the mainstream media hasn't had enough time to research this "real news". After all, this is only the fifth annual Trafficking In Persons Report.

Look, only about 800,000 people are bought and sold each year, so I suppose Abu Graib, Halliburton, and the occasional, TV-friendly car bomb detonation should have top priority. Surely you don't expect the likes of Maureen Dowd to hoist themselves off their derrieres, do some real investigation, and write about true evil and injustice?

And, look, it only involves sexual slavery, child beggars, forced domestication, starvation, unreported rapes, beatings, and deaths, so I suppose these miserable souls (who number well under a million) don't deserve any investigative reporting. Leave it up to the State Department! The mainstream media has fake but accurate stories to cover!

Do me a favor. Click on any of the following search links for 'modern slave trade' at the LA Times, the New York Times, CBS News, or ABC News, just as a little test.

You see, the modern slave trade really isn't worth covering as news.

Because investigating this scourge on humanity would require scape-goating parties other than the Bush Administration and the U.S. Military. It would require delving into the true nature of evil. And, goodness knows, the mainstream media doesn't have any time for that.

Fox: The Modern Slave Trade and the State Department's 2005 Trafficking In Persons Report
 

Hate Mail

Picture credit: http://www.tsn.com
From Gregg Doyel, a senior writer at CBS SportsLine, comes this sparkling repartee:

Q: I was at Kansas during the period you talk about. I believe that you are incorrect! Larry Brown did not leave KU with probation issues. He made us mad by saying he was going to UCLA and later leaving to go to the NBA (Spurs pay a lot better than KU), but I do not believe we were ever under investigation or probation for anything Larry did. I think you are a KU hater just making up stuff about Larry. Prove it to me! A: Trying to show restraint, trying to show restraining, failing, failing miserably. ... Patrick, if you were at Kansas at the time of Larry Brown, you'd be close to 40 now. How a man of your intelligence survived 40 years is a mystery. Try Google, Patrick. Insert the words "Larry Brown" and "Kansas" and, I don't know, "probation." The results will shock you and your parents, who sure would like you to move out.

CBS SportsLine: Hate Mail