It all started with a dream – literally.

The other night I had this weird ass dream.  I was playing a live action game (sorta like Assassin) with a GPS enabled smartphone as my guide – in this case, my Nexus One.   It seemed to go like this:

When the game was starting, the application I had purchased and downloaded notified me.  From then on, I had an assassination target, and someone had me as a target.  Additionally, there were teams – but you didn’t know who was on your team.  In fact, I hadn’t met any of the people I was playing with.

The application gave me salient information about the target, and would notify me when I was near a team member.  It was up to me to track down the target on my own and neutralize them – the app didn’t have their location information.  It did, however, have location info on my team members.  No one had a team member as a target – those people were allowed to work together if they could find each other.

This led to a wide assortment of weirdness in my dream, including finding Gabrielle (who wasn’t my wife in the dream) to be one of my team members, and large amounts of urban exploration in what was apparently a post-apocalyptic Downtown Columbus.

What’s more interesting to me is that the idea is totally feasible.  Using technology available right now, one could write an application that lets a person register for the live action game.  The app could be terminate and stay resident in order to provide notifications, or the central server could text users with broadcast information.

Once the game is started and everyone is online, you would log into the app, and your target information would be available from the application.  Research tools might be built in.  Mapping with waypoints is essential.

Most interesting is the peer to peer sharing of GPS data.  If you got near a team member, the application would let you know – perhaps even using bluetooth as a closer metric than the GPS.  Once thus notified, observation and hensojutsu would be your guide, and you may have a valuable partner in the game, if you play the cards right.

This could be played in a company, or a group (like a school) or a city, or even nationally or globally is money no object.  What’s more, it shouldn’t be that tough to write. I don’t have the chops to do it on any mobile platform as things stand right now, but it would probably have to be built for Android, iPhone and Windows Mobile 7.  There would be pretty strict requirements for the hardware, but I bet you could make some coin if you set it up, and it would be a hell of a lot of fun.

If someone does it, invite me.  I might not build the app, but I sure will play.

Defcon 17 is in the books, and Gabrielle and I had another fantastic time.  Props go out to all of the Defcon staff.  The Locksport International team and TOOOL put another fantastic lockpicking village together.  Coffee Wars pulled a record turnout of thirty-six brews, and we met some great people there.  (We lost badly.) And thanks to the hard working goons we met.

We arrived on Thursday, but with the new Defcon 101 tracks, we were practically late.  The lines weren’t much worse than usual but there was a badge shortage right away thanks to the fine people at Chinese Customs.  Gabrielle and I ended up with paper badges at first, but Gabrielle social engineered us into two actual badges soon thereafter.

The badge, as usual, is fantastic.  Kingpin did an over-the-top job of building a sleek, simple badge that still has lots of hacking potential and out-of-the-box functionality.  It uses the 32 pin MC56F8002 processor, with a microphone and an RGB LED to produce visual effects from aural input.  Wired Magazine actually published the open source firmware.  I am not a hardware hacker, but I have been working on getting it to produce different visual output based on pitch rather than volume.

I didn’t get his name, but one of the engineering team from Freescale (the company that made the microprocessor on the badge) came to the con.  He just set up shop in the Hardware Hacking Village and helped people program the board.  It was one of the coolest things I have seen at any con.  As some of you probably know, my hardware experience is circa 1979.  He effortlessly moved between helping me with the most basic soldering questions to the most advanced programming questions.  I was blown.  Get me his address, someone.  I want to send him a bottle of Scotch.

It seemed like the traffic flow was worse at first compared to Defcon 15, but it soon leveled out.  Part of the problem was the need to clean out the rooms fully and then count them coming back in due to the fire code.  The marshals were around, and very visible, throughout the con.

There is a lot of talk about the Riv being too small.  I happen to disagree – I think that DT just needs to find a logistics volunteer that will orchestrate the talks in such a way to control the crowds.  I have seen Gabrielle do it.  It is possible.  (You hear that Jeff?  She will work for Absolut.)  The people at the Riv work their collective asses off to make it a good con and you just can’t replace that.  Let’s change the logistics instead.

Oh wait, there was technical content too!  Who knew?

The most significant thing I learned is that for all of the protections for CAS in the .NET Framework, there is a mind blowing flaw.  The framework assemblies are just called by name.  If you replace an assembly, EVERY .NET program on that machine will use the altered DLL to run the program.  Does that mean if you replace the encryption protocol to email the keys to China, that all programs will send that key to China?

Yes.

Discuss.

Props to Erez Metula.

There was a great talk on using iMacro to do screen scraping for AJAX sites, and I plan on getting some new PoCs for that up in the future.  It wasn’t rocket science, but it was a really good implementation of a simple idea that I sure as hell didn’t come with.  I mean, if it was easy, everyone would be doing it, right?  Screen scraping is a massively underused art.  There is a LOT of information out there and the web browser just sucks for really making use of it.

So much net development was done on Metasploit in the last 12 months that they got an entire track dedicated to it.  The biggest piece is undoubtedly the Oracle module, which really puts all of the disparate Oracle attacks into one place for ease in testing.  I can’t recommend its use enough if you are a pen tester or in charge of db security

The civil liberties content was significant compared to 15.  Nearly one whole track for three days was filled with lawyers telling us how not to go to jail when we fly to Italy on vacation with some music of questionable origin on our laptop.  I just popped in and out of these, but every time I did I learned something.

 Did you know that if you are asked to give up your password in the states you can say “come back with a warrant” but if you are flying overseas, they can just take the machine without your permission, copy the whole hard drive, and say “Thanks for the warez, d00d.”  Lesson learned?  Carry an empty laptop overseas and download your data set from a secure channel once you get there.   When done, upload results and clear the machine again.  Microsoft doesn’t even LET you carry a machine overseas.

Speaking of privacy (weren’t we, really?) social networking was a huge topic this year.  Tom Eston and Kevin Johnson gave a great talk on some proof of concept work they did on social networks and trust.  For instance, set up a parody account of a ‘B’ celebrity, and gain trust of followers.  Then send out a link for a fun quiz with an XSS attack.  Gain twitter cookie, get password, rinse and repeat.  Social Butterfly is another of their tools, which manages the creation of apps in social networking sites like Facebook.  It collects user accounts to be used for research purposes.  Check it out.  It’s not just that picture of the Christmas party last year that will get you in trouble on Facebook.

Locksport village was very informative, very well attended, and very well stocked.  I picked up some new equipment and finally met both Schuler Towne and Doug Farre in the flesh.  Doug and I are going to make some moves toward getting the Locksport International organization a little more, well, organized, and get things up and running there. 

Gringo Warrior was a hoot.  I supplied the live guard with a cigar (which he really needed!) and watched.  Deviant had a whole boatload full of people, and I hadn’t practiced enough, so I didn’t do it this year.  Maybe next year.  The ah-ha moment for that was watching a very accomplished picker run the whole gamut in three minutes, and then spend ANOTHER three minutes trying to open the car door.  After that, Deviant stood by the auto locks and yelled “Everyone look!!”  Took out his auto jigglers.  “Easy lock,” pop.  “Medium lock’” pop.  “Hard lock,” pop.  “GET some jigglers people!  They aren’t that expensive!”  I got some jigglers.

My Defcon moment had to be standing in the elevator lobby waiting for a ride down from my floor, when thmping bass – LOUD thumping bass – became clearly audible.  I thought “that’s one hell of a boom box.”  Wait.  Aren’t those lights?

The door opens, and there is a full mobile DJ station in the elevator.  I kid you not.  There was a mini-rave going on right there in the elevator with a DJ and dancing babes and the obligatory big white guy who can’t dance just bobbing his head and looking cool.  It had to have been the coolest thing I have ever seen in an elevator, bar none.

Can’t wait for next year, folks.  This one was fantastic.  Till then, see you at PhreakNIC!

In Jujutsu, details matter. The Bansenshukai Ninjutsu jujutsu curriculum is made up of a 30 part kata of maneuvers from American Jujutsu in the Crawford system. It's the basic stuff you see in an MMA fight, really. Mount reversal, guard break, side mount, key lock, arm bar, arm bar, juji gatame ... you get the idea.

What astounds me is how much the details matter. Fo instance, in step 4 of the drill Tori is in side mount and Uke breaks an arm bar and grabs for a scarf choke. Tori goes to gaidon and get a vertical arm bar. Uke's arm is laying against the back shoulder and chest of Tori, and Tori has both hands to get the lock. In BSSKN, we use the palm grip (palms together, thumbs interlocked, fingers folded over back of hand) and tonight Sensei reminded me to use the knife edge of the inside of the forearm to get the lock. Just put that bone right on the top of the tricep.

That makes all the difference.

It is simpler to just grab the elbow joint with the hands. In fact, you can just hit it with a fist and break the elbow joint if you want. But putting that edge there just puts Uke in an inordinate amount of pain right away, and who doesn't want to end a fight faster?

So next time you train, work out the details. It's not just a fight, it is a set of techniques, and blending them will take time. Focus on the techniques now so them come naturally later.

In the world of taijutsu, legs are like pistons. You let the pressure out of them to lower yourself to the ground, and increase the pressure to lift yourself up. Take Morote Gari. You drop to a sprinters stance - releasing the pressure in your knees (performed by the calves and thighs) and position yourself at the knees of uke, then increase the pressure in your knees to take uke to the mat.

Hokojutsu is the same thing. The key to moving my bulk around silently is to not place my leg, but lower it, and then lower my weight onto it. If I just place it, I thump. If I lower it, I don't. It's a totally different way of thinking.

There are a bunch of examples. When I perform Oni Kudaki, for example (in the classical way) I slide into uke with my back foot and lower by center of gravity on my pistons to take balance. Then I raise myself after I get the lock on the elbow. The legs work just like hydraulics to lower and raise my body.

It's surprising how much preparation is a part of hensojutsu. I have been reading On Acting by Sanford Meisner, and his approach to preparation has me thinking a lot about hensojutsu and reality. Meisner says that 'acting is living truthfully under imaginary circumstances.' Admittedly, if you have one hell of an imagination you can just jump up and do what is required under the circumstances.

I don't.

So, Meisner has his students prepare. The difference is, he has them prepare for the emotion not the action. For instance, say you have a scene where your sister has died. But you are an only child. You don't know what it would feel like to lose a sibling. Well, let's get close, Meisner says. Ever lose a parent? Dear friend? Was it pretty miserable? Alright, THINK about that and say the lines.

For my 6th kyu test I have to perform hensoijutsu as Yado Nashi, or a homeless man. I originally thought to do research, and that is a good idea for the facts - where I live, how I got there, etc. For my actual preparation, though, I have to key in on emotion - hopelessness, or determination depending on my character. I have to call up something that harbors the emotion of the character as well as remember the facts. It isn't like the facts will be more true with the right emotion, but they sure will be more believable.

By far, the easiest way to defeat me in randori is to wear me out. I am 36, 230 pounds, and don't work out enough. Lie on me and make me work - I'll be wiped in no time.

Recently though I have been training with the kuji-in. Funny, that. It seems to work. The Bansenshukai curriculum has one of the nine ninja mudra for each of the nine kyu. The first mudra, for ninth kyu, is Rin or Strength. Every day, during my meditation, I have been focusing on those times when I have found extraordinary inner strength. Once, I stayed up for a very long time when I had a project due and Adam was sick. In a less poignant example, I recently ran a long time on the treadmill, finding some inner endurance. I lasted a long time in one particular randori, and can recall that.

All of this is done while making the Rin mudru, which is hands together, fingers intertwined. The middle finders are raised and touching. what this allows me to do is use the unusual muscle memory to recall all of that hours of meditation in a moment's notice. Say, for instance, right before a long randori match.

It might sound dorky but it works. Just like sitting in Seiza might make you think about class, the mudra recalls the topic of the meditation. I was impressed. I am totally not into mystical stuff (ask anyone about me lack of respect for religion) but when something works it works. The tie between muscle memory and long term memory is well documented.

I like it a lot. This is where the 'magic' of the ninja comes in.

More at Wikipedia.

I have been reading The Special Forces Guide to Escape and Evasion by Will Fowler to kinda formulate a strategy for Intonjutsu in my mind. We study element driven styles of escape and evasion in the club (like Katonjutsu, using fire to mask scent or make a barrier) but I like the forest view once in a while, so I read overview books on contemporary Ninjutsu topics.

I learned something very cool in the Zanson area in the first chapter, though. I like acronyms in emergency situations - when you can't remember much else, you can often remember cool acronyms. Here is one for situations in which Zanson is important: SURVIVAL.

Size up...
... the situation
... the surroundings
... your physical condition
... your equipment

Use all senses
Remember your location
Vanquish fear
Improvise
Value living
Act like the natives
Live by your wits

Now, I think that is good anywhere. If you are in the desert being chased by a band of roving Mujahideen or in the mall during a fire, this is a good set of steps to keep yourself on track. The first and most important thing that most people always forget to do in any emergency is to take a second and Size up the situation. Stop. Look around. What is REALLY happening? Where are you specifically AND in general. Can your environment help you? Are you hurt? Are any of your wards hurt? What do you have with you? Would it be better in your hand right now, or stowed?

A better part of Ninjutsu, as I have posted before, is preparedness. While at the time I was talking gear, it is important to be prepared mentally. None of us know how we will respond in an emergency until one happens, so it is a good idea to have a Contingency Plan of Action for most major types of emergencies, and starting with SURVIVAL isn't a bad bet.

I have been reading On Killing by Lt. Col. Dave Grossman, and it has me thinking about the reality of the martial arts. War is war, and defeating the enemy is just another word for killing them. Lt. Col. Grossman puts a lot of emphasis on the distance factor (it being a lot easier to kill with bomber than a knife) and it came to me that a lot of Ninjutsu is about killing at VERY close range.

Lets face facts. Ninjutsu is not a movement study. It is about completing an objective, no matter what the odds. If you are training any other way, you might want to ask yourself why you are into Ninjutsu and not Aikido or tai-chi if you like the movement, or judo or karate if you like competition aspect. Nonetheless I have to wonder how many of us could stab an adversary with a knife if the situation warranted. Many of my friends in the club are military and police - they are studying to improve their chances of survival. They might have to complete that thrust we all learn in tantojutsu.

Could you? I don't know if I could.

The psychological aspects of Ninjutsu are shrouded in a combination of the general fear of discussion of Ninjutsu and the "you'll learn that later' part of the art. Fact is, I think a decent psychoanalyst could have a field day with most of us, starting with Hatsumi himself. Studying a combat martial art in this day and age, when you aren't actually planning on any combat is, well, strange.

So why do we? Preparation? Are we getting ready for when martial law is declared? Is it really just self defense? I have no idea. But I have a sneaking suspicion that 1) there is a lot to learn form this art without being consumed with the concept of death and 2) not many of us are gonna find out and that is a good thing.

Read On Killing. It will get you thinking.

Shidoshi posted recently about taking change of one's own training. I don't think I could agree with him more if I tried but only now, after almost a year in, am I starting to get more insight into that principle.

You see, I am not of the warrior caste, as I think I have posted about before. I really have to work at this stuff. None of it comes naturally. I usually get my self up to 80% and them let my natural talent carry me the rest of the 20%. In this, I can't do that. I don't have any natural skill. I have to train all the way to 100%. I have never had to do that before in anything I have done.

So I need a new way to work.

In my particular school, there is a lot of stuff to learn. A LOT. Most than most ninjutsu schools that I have seen the kyu sheets for. Ok, more than all of them. Put together. For my 7th kyu test, I have 29 individual testable points. For the taijutsu parts, I have to know henka and counters, too. Ouch.

Shidoshi says that you have to do each individual movement 100 times with a compliant uke before the muscle memory even starts to think about kicking in. After that, you need to take it to randori and work it there 100 more times. Ok, I think I agree. I am going to formalize it a little bit, and actually plan my training.

For my 7th kyu exam, I am going to actually make a training chart, and track how often I train on each individual item. Everything - from the side roll to the jujutsu kata items. Some I can train alone, most I need an uke for, but that's what open mat is for. AND I will go to class as well.

What I need now is to revise my vision on why I am training. Fact is, I am training like I will use it. Fact is, I probably won't use it. I might once or twice (Aikido has saved my ass twice) but probably not much more than that. I need to now train to get good at it - becasue it is going to be really good for me to get good at something that I have a hard time with.

That might not be enough though. I am a very competition driving individual, though I don't pretend like I am. Takamatsu-sensei said something that matters, though.

The way of the martial artist is the way of enduring, surviving and prevailing over all that would destroy him. More than delivering strikes and slashes, and deeper in significance than the simple outwitting of an enemy, Ninpo is the way of attaining that which we need while making the world a better place. The skill of the Ninja is the art of winning.

Yes. Yes indeed. That's what I am training for - winning. Doesn't matter if it is in the boardroom or a brawl, winning is winning. That's what I am after.

If you hang out at forums like Martial Talk, you will discover that there is a fair amount of discussion regarding the history of Ninjutsu. Generally speaking, there is no real record of ninja before about 1956, and Takamatsu more or less defined the genre. The common belief is that he just created it, and Hatsumi, with his marketing brilliance, has expanded it. The 900 year history is an urban legend.
I say this: So what?

What I, you, my training partners and the Marines are looking for is a fighting system that works. If Takamatsu invented one and it works, who cares? Ueshiba invented Aikido and it works for what it is designed for. Kano invented Judo and it works very nicely too.

I think the problem lies in the same as the one of religion. If something that God or Jesus said is proved to be irrevocably false (like absolute proof that Mary wasn't a virgin, for instance) then large pillars of Christianity fall. If the premise that Hatsumi isn't teaching the art of 33 people before him falls, then again, the Bujinkan will lose a fair amount of identity.

And no one likes to see that.

Don't worry about identity. the implication of that is that you have to be willing to waste a little time studying with someone that turns out to be not what you want then leave. But if that means you find the teacher that you do want, then it was well worth the effort.

That's what it all comes down to - learning what you want to learn. The only kicker is this - be realistic. If you are studying ninjutsu and learning to break bones, don't think you can take your skills to MMA - they don't like broken bones there. If you are studying Aikido and think you are going to go fight on the streets of New York you might want ot reconsider. The art depends heavily on a trained uke.

So - conclusion. 1) Don't worry about history, worry about now. 2) Find an art that works for you, taught by a teacher that works for you. 3) be realistic. Words to train by. Have a nice night.