Soaking in the local couture ...

The funniest thing this Kat has heard over the past few days of rain and deep humidity in Hong Kong was an unintentional comment made by a lady to someone who was manning a booth in the INTA Exhibit Centre.  When asked if she enjoyed travel, she responded : "I love travelling to foreign parts and soaking in the local culture".

***************************

Here's a thought, taken from iPiT's LinkedIn Group.  iPiT founder and former guest Kat Robert Cumming has started a discussion in which he asks:

"When will a hashtag infringe a trade mark? "The hashtag #, or octothorpe depending on your etymological preference, is commonly used on social media to group discussions according to their topic. For example, tweets which include #iplaw allow users to quickly filter posts about IP law. But what about when lawyers use the hashtag #INTA14? Could that ever entitle the International Trademark Association to bring an action for infringement?"

Around the weblogs.  The IPKat isn't the only blogger who has put paw to pad, as it were, in order to give readers the benefit of a subjective view of this year's INTA Meeting.  Posting on the IP Factor, Michael Factor's story, "INTA --Washout" narratives the physical and the metaphysical dimensions of his visit to Kong Kong, here.  Erik Pelton takes a look at the new Netflix logo, contrasts it with the old one and asks: "Love it or leave it?" Ron Coleman (Likelihood of Confusion) makes a frivolous point with a cunningly concealed major issue concealed within it: he asks, as a regular sponsor but current non-attender, about the capability of an absent sponsor to exercise quality control.  Another whimsical post with a core of steel is solo practitioner Sally Cooper's post on the SOLO IP blog on the Association of Sole Practitioners, here, noting that this year's event attracted 192 solo practitioner  registrants, from 59 countries. This Kat is sure that there are plenty more INTA posts lurking out there and just waiting to be found ...

For some, the venue was a long, long walk ...

"Meet the Bloggers" is more than a mere imperative: it's the name of one of the features of INTA week. "Meet the Blogger", or "MTB" as it is often affectionately abbreviated, is is not part of the official INTA programme. This means various things: (i) anyone can attend, even if they are not registered for INTA (not a bad idea,given that IP blogs cover lots of topics that have nothing to do with trade marks),(ii) INTA doesn't have to worry about insuring it against fire, theft, death by misadventure or catering malfunction and (iii) you are unlikely to receive continuing legal education points for turning up.

MTB: humble origins

MTB co-founder Marty Schwimmer (Leason Ellis) opened the formal side of the gathering by welcoming all present, reminding them of MTB's humble beginnings in a bar in San Diego and of its subsequent blossoming into a massively supported binge gathering of notables at the Royal Hong Kong Yacht Club.  The beneficence of event hosts Marks & Clerk (correctly pronounced 'Clark') was warmly acknowledged, as was the contribution of all bloggers, readers and jolly wassailers to the blogosphere and this splendid social eruption from it. Marty then proceeded to stun all present with a carefully-worded articulation of his belief that the use of the Washington Redskins' controversial Redskins brand [see Wikipedia here for a handy summary of this controversy], considered by many people to be racist, should be dropped by its owners.  Marty urged all bloggers and tweeters present to draw to the attention of their respective readers a blogpost which he is currently planning (Marty's iconic Trademark Blog is here).

This Kat is happy to oblige once Marty's post goes live, though he doesn't entirely agree with Marty's position. Marty wants the Redskins mark to be renounced because it is racist, while this Kat's contention is that its owners should kiss it goodbye regardless whether it is offensive or not: assuming the brand was never intended to cause offence, its value of an asset has been deeply harmed by the perception on the part of a substantial segment of the public that it is racist -- and this Kat doubts whether the trade mark owner will ever be in a position to shift this misperception. Accordingly, it makes good commercial sense to start afresh with a rebrand.  He wonders whether readers agree with him or with Marty.

All that was left of this Kat's taxi after the rain ...

Following Marty's plea, those present -- and there were many -- returned to the serious business of staying both sane and adequately hydrated.  Between the heat and the humidity many good folk were shipping water fast, and the air at times resonated with the sticky squelch of old friends embracing.  When eventually the curtain came down and the last revellers prepared to leave, the skies again opened, the rain plummeted to earth and Merpel had a chance to test out her hypothesis that many Hong Kong taxis are water-soluble since she attributes their tendency to vanish within minutes of a precipitation to the fact that they have been dissolved by the Special Administrative Region's acid rain.

This Kat would like to offer his thanks in particular to Marty for both the serious and the humorous dimensions to his oration, to Michael Lin and Richard Holmes of Marks & Clerk for their attention to detail in the organisation of the event and for their patent concern for the well-being of their guests, and to all the bloggers who made themselves accessible to their readers -- and to each other -- in an evening of fun, friendship, information exchange and see-you-next-years.

OpenLiveView
Tim Vidas has posted OpenLV, an update to the popular LiveView tool that many of use have used before. When conducting an investigation, there are a number of ways to access acquired images, such as via any number of analysis frameworks (DFF, ProDiscover, Autopsy, etc.) that provide a great deal of functionality for interacting with data.  There are tools for mounting an acquired image as a read-only volume (FTK Imager, etc.), but OpenLV allows you to boot the acquired image.  This can provide a great deal of visibility into the system, allowing the investigator to see what the intruder saw, interact with the system the way the intruder interacted with it, and even verify malware autostart functionality.

Be sure to check out the DFRWS Proceedings, written by Tim, Matthew Geiger, and Brian Kaplan.

EVTXtract
The other day I was answering a question about Windows Event Log analysis, and I ran across Willi Ballenthin's tool, EVTXtract (PDF here).  This tool allows an analyst to recover deleted Windows Event Log records.  The Windows Event Log (.evtx) files follow a binary structure that's much different from the Event Log (.evt) files on Windows XP and 2003, but deleted records can apparently be recovered, at least in some cases.

ThunderBird Parser
Mari has shared her ThunderBird Parser.  Her blog post has some great information...she talks about what issue she faced and how she chose to address it by writing her own code.  Doing this not only helped her understand the underlying data on much more intimate level, but it also opened that understanding up to other analysts.

Conferences
My conference attendance changed recently, and I am no longer a member of Suzanne Widup's author panel at the SANS DFIR Summit in Austin, TX.  I was really looking forward to speaking on the panel (I've written a book or two), and discussing various topics around writing DFIR books.  In fact, we'd already started addressing some questions in my blog, and I was really looking forward to hearing and addressing other questions.


Brian Carrier has opened up the call for papers for the OSDFCon, to be held in Herndon, VA, on 5 Nov. This has always been a great conference to attend (see here), and needs more practitioners to submit presentations.  In fact, I've recommended to Mari that she submit to the conference to give a presentation on the ThunderBird email parser, or any of the other tools she's written.  I've already submitted two presentation ideas.

I'm also looking for thoughts and ideas for other conferences to which I can submit to the CfP.  CEIC is out because it's already come and gone.  If anyone has any thoughts regarding a conference (or conferences) that are specific to DFIR, and include topics on addressing targeted threats, I'd greatly appreciate it if you'd comment here or drop me an email.  Thanks.