Facultad de Agronomía y Agroindustrias

martes, 14 de abril de 2020

7 Ways Hackers And Scammers Are Exploiting Coronavirus Panic

In our previous stories, you might have already read about various campaigns warning how threat actors are capitalizing on the ongoing coronavirus pandemic in an attempt to infect your computers and mobile devices with malware or scam you out of your money. Unfortunately, to some extent, it's working, and that's because the attack surface is changing and expanding rapidly as many

via The Hacker News

Continue reading

Probing For XML Encryption Weaknesses In SAML With EsPReSSO

Security Assertion Markup Language (SAML) is an XML-based standard commonly used in Web Single Sign-On (SSO) [1]. In SAML, the confidentiality of transferred authentication statements against intermediaries can be provided using XML Encryption [2]. However, implementing XML Encryption in a secure way can be tricky and several attacks on XML Encryption have been identified in the past [3] [4]. Therefore, when auditing a SAML endpoint, one should always consider testing for vulnerabilities in the XML Encryption implementation.

This blog post introduces our latest addition to the SAML Attacker of our BurpSuite extension EsPReSSO: the Encryption Attack tab. The new tab allows for easy manipulation of the encrypted parts within intercepted SAML responses and can, therefore, be used to quickly assess whether the SAML endpoint is vulnerable against certain XML Encryption attacks.

Weaknesses of XML Encryption

Implementations of XML Encryption can be vulnerable to adaptive chosen ciphertext attacks. This is a class of attacks in which the attacker sends a sequence of manipulated ciphertexts to a decryption oracle as a way to gain information about the plaintext content.

Falsely implemented XML Encryption can be broken using:

an attack against the CBC-mode decryption (quite similar to a padding oracle attack) [3] or
a Bleichenbacher attack against the RSA-PKCS#1 encryption of the session key [4].

SAML makes use of XML Encryption and its implementations could, therefore, also be vulnerable to these attacks.

XML Encryption in SAML

To support confidential transmission of sensitive data within the SAML Assertion, assertions can be encrypted using XML Encryption. An EncryptedAssertion is shown in the abridged example below.

The EncryptedAssertion contains an EncryptedData element, which in turn is the parent of the EncryptionMethod, KeyInfo, and CipherData elements. SAML makes use of what is referred to as a hybrid encryption scheme. This is done using a session key which symmetrically encrypts the payload data (the example uses AES-128 in CBC mode), resulting in the ciphertext contained in the EncryptedAssertion/EncryptedData/CipherData/CipherValue child element. The session key itself is encrypted using an asymmetric encryption scheme. In our example, RSA-PKCS#1.5 encryption is used with the public key of the recipient, allowing the contents of the the EncryptedKey child element to be derived from the KeyInfo element.

Encryption Attacker

Our BurpSuite extension EsPReSSO can help detect vulnerable implementations with the newly integrated Encryption Attacker within EsPReSSO's SAML module.

Once a SAML response which contains an EncryptedAssertion has been intercepted, open the SAML tab, select the Attacks pane, and choose Encryption from the dropdown menu. This works in Burp's Proxy, as well as in the Repeater tool, and is depicted below.

As sketched out above, the symmetric session key is encrypted using the recipient's public key. Since the key is public, anybody can use it to encrypt a selected symmetric key and submit a valid encryption of arbitrary messages to the recipient. This is incredibly helpful because it allows us to produce ciphertexts that decrypt the chosen plaintexts. To accomplish this, one can purposefully send invalidly padded messages, or messages containing invalid XML, as a method to trigger and analyze the different reactions of the decryption endpoint (i.e, turning the endpoint into a decryption oracle). To facilitate these investigations, the new Encryption Attacker makes this process dead simple.

The screenshot above shows the essential interface of the new encryption tab:
At the top, the certificate used to encrypt the symmetric session key can be pasted into the text field. This field will be pre-filled automatically if the intercepted SAML message includes a certificate in the KeyInfo child element of the EncryptedData element. The Update Certificate checkboxes above the text area can be used to include the certificate in the manipulated SAML message.
In the Symmetric Key text field, the hexadecimal value of the symmetric session key can be set. Choose the asymmetric algorithm from the dropdown menu and click Encrypt key -- this will update the corresponding KeyInfo elements of the intercepted SAML message.

The payload in the text area labeled XML data can now be entered. Any update in the XML data field will also be reflected in the hexadecimal representation of the payload (found on right of the XML data field). Note that this is automatically padded to the blocklength required by the symmetric algorithm selected below. However, the payload and the padding can be manually adjusted in the hex editor field.

Eventually, click the Encrypt content button to generate the encrypted payload. This will apply the changes to the intercepted SAML message, and the manipulated message using Burp's Forward or Go button can now be forwarded, as usual.

Probing for Bleichenbacher Oracles

Bleichenbacher's attack against RSA-PKCS1 v1.5 encryption abuses the malleability of RSA to draw conclusions about the plaintext by multiplying the ciphertext with adaptively chosen values, and observing differences in the received responses. If the (error-) responses differ for valid and invalid PKCS1 v1.5 ciphertexts, Bleichenbachers' algorithm can be used to decrypt the ciphertext without knowing the private key [6].

To determine whether or not a SAML endpoint is vulnerable to Bleichenbacher's Attack, we simply need to check if we can distinguish those responses received when submitting ciphertexts that are decrypted into invalidly formatted PKCS1 v1.5 plaintexts, from the responses we receive when sending ciphertexts that are decrypted into validly formatted plaintexts.

Recall that PKCS1 v1.5 mandates a certain format of the encrypted plaintext, namely a concatenation of a BlockType 00 02, a randomized PaddingString (PS) that includes no 00 bytes, a 00 (NULL-byte) as delimiter, and the actual plaintext message. The whole sequence should be equal in size to the modulus of the RSA key used. That is, given the byte length k of the RSA modulus and the message length |m|, PS has the length |PS| = k - 3 - |m|. Furthermore, PKCS1 v1.5 demands that |PS| to be at least eight bytes long [5].

In SAML, the recipient's public key is usually known because it is published in the metadata, or even included in the EncryptedAssertion. For this reason, we do not need to fiddle around with manipulated ciphertexts. Instead, we simply submit a validly formatted RSA-PKCS1 v1.5 encrypted message and an encrypted message which deciphers into an invalidly formatted plaintext. As an example, assume an RSA public key of 2048 bits which we want to use to encrypt a 16 byte session key `01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10` (hexadecimal representation). |PS|$ is $2048/8 - 3 - 16 = 237, so a valid PKCS1 v1.5 plaintext, ready to be encrypted using `AA` for all 237 padding bytes, could look like the listing shown below.

00 02 AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA
AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA 00
01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10

In the Encryption attack pane of EsPReSSO, ensure that the correct public key certificate has been added to the Certificate field. Insert a valid plaintext, such as the one above, into the Symmetric Key field and select Plain RSA encryption from the Algorithm drop down menu. Click the Encrypt button to compute the RSA transformation and apply the new EncryptedKey element to the intercepted SAML message. Now, submit the message by clicking Burp's Go or Forward button and carefully inspect the response.

Next, repeat the steps outlined above, but this time submit an invalid PKCS1 v1.5 message. For example, consider using an invalid BlockType of `12 34` instead of `00 02`, or replace the `00` delimiter so that the decryptor is unable to determine the actual message after decrypting the ciphertext. If you are able to determine from the recieved responses whether or not the submitted ciphertext decrypted into a valid PKCS1 v1.5 formatted plaintext, chances are high that the decryptor can be used as a Bleichenbacher oracle. Don't forget to take into account the actual XML data, i.e., the assertion encrypted with the new session key; by submitting valid or invalid XML, or by removing signatures from the SAML message or the assertion you may increase your chances of detecting differences in the returned responses.

Probing for Oracles in CBC-Mode Decryption

Another known attack on XML Encryption is aimed at the Cipher Block Chaining (CBC) mode, which can be used with the block ciphers AES or 3DES [2]. The attack is described in detail in this referenced paper [3] and is quite similar to Padding-Oracle attacks on CBC mode; the malleability of CBC mode encryption enables the attacker to perform a bytewise, adaptive manipulation of the ciphertext blocks which are subsequently sent to the decryptor. In most cases, the manipulated ciphertext will not decrypt to valid XML and an error will be returned. Sometimes, however, the plaintext will be parsed as valid XML, in which cases an error is thrown later on at the application layer. The attacker observes the differences in the responses in order to turn the decryptor into a ciphertext validity oracle which can be used to break the encryption. Due to some particularities of the XML format, this attack can be very efficient, enabling decryption with about 14 requests per byte, and it is even possible to fully automate the process [7].

In order to determine if a particular SAML service provider is vulnerable to this attack, we can avoid the cumbersome ciphertext manipulation, if we are in possession of the decryptor's public key:
In the Encryption Attacker tab of EsPReSSO, add the public key certificate to the Certificate field (if necessary) and insert a symmetric key of your own devising into the Symmetric Key text field. Select an appropriate RSA encryption method and click the Encrypt button to apply the new EncryptedKey element to the original SAML message.

An XML message can now be inserted into the XML data text field. Select a CBC mode encryption algorithm and click Encrypt to apply the changes. As in the example above, press Burp's Go or Forward button to send the message and carefully inspect the response. Try sending invalid XML, e.g., by not closing a tag or using the `&` character without a valid entity and keep an eye open for differences in the returned responses. To manipulate the padding, the text field on the right side shows the hexadecimal representation of the plaintext, including the CBC padding. If you send a single block and set the last byte, which indicates the padding length to the blocksize, i.e. 16 or 0x10 for AES, the ciphertext should decrypt into an empty string and is generally considered "valid" XML.

Please refer to the original paper for more details, tips, and tricks for performing the actual attack [3].

Summary

The new XML Encryption attacker included in EsPReSSO can help security auditors to quickly assess if a SAML endpoint is vulnerable to known attacks against XML Encryption. To this end, the decryptor's public key is used in order to send suitable test vectors that can be provided in plaintext. Ciphertext manipulation is, therefore, not required. The actual process of decrypting an intercepted SAML message is, however, considered out of scope and not implemented in EsPReSSO.

In case you wonder how XML Encryption can be used in a secure fashion, here are some considerations [6]:

Always use an authenticated encryption mode such as AES-GCM instead of the CBC-mode encryption.
Using RSA-PKCS1 v1.5 within XML Encryption is particularly difficult to do in a secure manner, and it is recommended to use RSA with Optimal Asymmetric Encryption Padding (OAEP) instead [2].
Apply a digital signature over the whole SAML response, and ensure it is properly validated before attempting to decrypt the assertion. This should thwart the attack as a manipulated response can be recognized as such and should be rejected.

----------

[1] https://www.oasis-open.org/standards#samlv2.0
[2] https://www.w3.org/TR/xmlenc-core/
[3] https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-XML-Encryption/
[4] https://www.nds.ruhr-uni-bochum.de/research/publications/breaking-XML-Encryption-pkcs15/
[5] https://link.springer.com/chapter/10.1007%2FBFb0055716
[6] http://www.w3.org/2008/xmlsec/papers/xmlEncCountermeasuresW3C.pdf
[7] https://web-in-security.blogspot.com/2015/05/how-to-attack-xml-encryption-in-ibm.html

Related links

sábado, 11 de abril de 2020

Missed Classic: Trinity - Is This The 50S? Or 1999?

Written by Joe Pranevich

Welcome back! Last time out, I explored the strange mushroom forest that I was dropped into after the end of the world. This "wabe", as I think it is called, is a strange place set in the shadow of a gigantic sundial and includes giant bees, an impossible flower garden, a cottage with game design notes, and a half-dozen mushrooms with little doors. But this isn't The Smurfs: each mushroom appears to have been created by a nuclear detonation. As I closed out last time, I finally worked out how to control the movement of the "sun" overhead to drop shadows on each of the doors. I opened the first door and was dropped back into reality, somewhere and somewhen.

This game remains difficult to write about. My usual style is a bit flippant and just not appropriate for the subject matter, but I also cannot help to be quippy. I'll try to keep the tone light as much as I can, but this is a difficult game with difficult themes and some of the scenes in this session are disturbing. I had to step away from the game at one point for a few days. Fair warning, but on with the show.

Ray Palmer seems like such a nice guy.

When I walked through the mushroom door in my previous post, I arrived in a rickety room filled with equipment that I do not understand. The white door remains open and I can use it to return to the mesa in the wabe, but then it closes immediately after. No amount of resetting the sundial opens the door again so I assume there is no way back. Will I only get one shot at each doorway? Is there a way to know what order I have to take the doors? I hope Mr. Moriarty won't be too evil about this, but I am prepared for a lot of saving and reloading.

The equipment that I stand next to is radioactive and obviously a nuclear bomb, but I'm not positive which bomb it is. Climbing down the scaffolding, I find myself in a large room with aircraft hangar-style doors. They are too heavy to open, but there's a button nearby so it's not much of a puzzle. A second button activates an intercom speaker and a voice informs anyone listening that it is six minutes to detonation. I'd better hurry! I open the doors and head out onto a tropical island. Thanks to the manual's history lesson, I guess that this is the H-Bomb explosion in 1952. The documentation just says a "remote island in the South Pacific" and I was fairly certain that was Bikini Atoll, but a quick Wikipedia search informs me that the first test was actually on nearby Enewetak Atoll.

Focusing on the present, I notice that the tide is coming in. That voice in my ear sniggers that "Gnomon can tether tide or time." Whoever he is, he's less clever than he thinks he is. We start exploring from our vantage point on the south of the island. To the west is a second island with a single coconut tree. Thanks to a mob of attacking crabs, there is no way to get to that island or its lone tree. To the north is an "extension" of wood leading off the island, described as being like a six-foot in diameter drinking straw connecting the facility to someplace offshore. It's too high up to climb and I do not see a way to access it from the hangar shed. While exploring, a shark follows me around the island, but when I reach the eastern shore he reveals himself to actually be a friendly dolphin! That's cute, but… er… he's going to die pretty soon.

R.I.P Flipper. None under sea were smarter than he.

Beyond that, there doesn't seem to be much to do here. After a time, I notice that the western island has sunk under the tide and only a single coconut remains floating in the water. There is no obvious way to fetch it but it screams "puzzle" and must be important for something. I eventually work out that the dolphin is actually incredibly intelligent and fetches the coconut for me when I ask. I break it open with my axe but find only coconut milk inside. What did I expect? A priceless gem? The "milk" leaks out quickly and I restore so as not to lose it. Could that be "good enough" for the potion at the cottage? The magpie said that we needed milk, honey, garlic, and a lizard. Surely, this vegan substitute for milk isn't "good enough" for a magic potion, is it? With nothing else to do and the timer ticking down, I leave my paradise to its fate and return through the white door.

I do some fast Googling to learn that the island was called Elugelab; the blast destroyed it utterly, leaving only a 15-story deep crater in the ocean bed where an island once had been. The wooden "straw" led to the nearby Teiter Island which survived the blast. There doesn't seem to be any real-world counterpart to the tiny island with the coconuts; as a tidal island it's not likely to have appeared on any maps and Moriarty may have just made it up.

When I return to the "wabe", I immediately try the coconut milk in the potion and it seems to work! I'm not sure how that counts, but I have three ingredients now. I need to find a lizard.

Princess Peach has seen better.

The Mushroom Kingdom

With my first trip out of the way and the knowledge of how to open the doors, I take stock of the rest of the portal toadstools:

The first is in the meadow where I started. It doesn't open again now but presumably led to Kensington Gardens.
The second is the toadstool at the waterfall.
I cannot find the third. I suspect that it is near the boy blowing bubbles and possibly somewhere I need to fly to if I can work out how to gain altitude. Or perhaps the boy is sitting on it?
The fourth is the one that I just explored on the mesa.
The fifth is in the garden behind the magpie's cottage.
The sixth door is on the moor far to the east of the map.
I cannot find the seventh, but I expect that it is probably wherever the ferryman takes you.

My guess is that Mr. Moriarty is clever and has made each of the toadstools independent so that you can take them in any order. I therefore try the second one next and am immediately proven wrong: it leads out into Earth orbit with no spacesuit and nearly instant death. Nukes in space? There must be a way to survive there to do whatever I need to do, but I'm pretty sure I don't have the means yet.

The death scene at least offers some hints as we arrive, dead, at the ferryman's river. This time, we have a coin and use it to board the boat to the great beyond. Other than that, I don't glean any further hints how to cross without dying so I restore and try the next mushroom.

As a kid, I visited the Psygnosis offices in Cambridge. It was amazing. By coincidence, I later worked in the exact same office long after they had moved out.

Mother Russia

I take the fifth door next and arrive in what appears to be an elevated shack on the Siberian steppe. It's cold and gray and someone is speaking in Russian on the loudspeaker. Google fails me and has no idea what "dyevianatsat minut" means, but Infocom was likely using either a nonstandard (or simply outdated now) romanization. My guess is that they meant "devyatnadtsat' minut" (девятнадцать минут) or nineteen minutes. Plenty of time, right?

I climb down from the shack and immediately step on a rodent underfoot. In fact, the ground is mobbed by hundreds or thousands of creatures all racing to the northeast. They "look something like hamsters, with long brown fur and beady eyes". Should I follow them? Or see where they came from? I try heading "upstream" against the tide of creatures, but Russian guards kill me so that's not the way. I follow them instead to discover a cliff edge where the rodents are jumping off in apparent mass-suicide. Only then does the game tell me what you already figured out: they are lemmings! Of course, lemmings don't actually jump off of cliffs, right? That's just an urban legend spread by an old (faked) Disney documentary?

At the cliff, I discover a single trapped lemming in a fissure. I rescue it but it quickly bites my hand and disappears into the mass. If I release the magpie, I can grab it and then stick it in the cage. Is that a good trade? Do I need the magpie for anything? Remembering back last week, I did not get any points for it (only for the cage) so maybe not? Also, lemmings are not lizards even if they have the same starting letter, and even if the potion took coconut milk instead of cow's milk, that would be too much of a stretch. I find nothing else of interest on the tundra. I even jump off the cliff once but just drown in the frigid Arctic water. Once there is nothing left to do and the countdown is presumably getting close, I head back through the door.

Doing some real-world research, I learn that I wasn't on the Russian steppe after all: the Soviets did their nuclear testing at a site in Kazakhstan. I was close enough though since that was part of the Soviet Union until 1991 and Moriarty would likely not have seen it as a separate country. The test site was 100 miles west of Semipalatinsk (now called Semey) and the region sees many health problems thanks to all of the tests performed there. There doesn't seem to be any real-world analogue to the cliffs as the nearest bodies of water I can find to the test site are frozen lakes around 25 miles to the northeast according to Google Earth. Am I looking too deeply at this? Absolutely. I'm procrastinating writing the next section.

A spoonful of sugar helps the deep existential dread go down?

Hiroshima

The sixth door is my only remaining choice, located on the moor just north of the ferryman's river. Stepping through, we find ourselves in midair and falling fast. Unlike in the space section, we have a few turns to experiment before we land with a splat and I have an idea what to do: open the umbrella! Doing so slows our descent enough that we land safely in a children's sandbox. Writing this section is choking me up, so I'm going to pause by just giving you the room description:

Playground, in a sandpile

A set of children's swings move back and forth in the humid breeze. Behind them stands a long building, its windows hung with flowers and birds folded from colored paper.

Mounds of dirt are heaped around a dark opening to the east. It appears to be a shelter of some kind.

Several small children are happily chasing dragonflies north of the swing set. Turning south, you see a group of adults (schoolteachers, by the looks of them), wearily digging another shelter like the first.

Somewhat shaken, you rise to your feet in a child's sandpile. In the pile, you see an umbrella, an axe, and a birdcage.

We know what's about to happen and it's devastating. I gather together my things and discover that I can really only move east towards the shelter without being caught. Inside is a disgusting and rough hewn bomb shelter, filthy and smelling of urine from the people that had to relieve themselves while waiting out the terror outside. It's an awful thought. There's a spade on the ground which I pick up, but otherwise there's nothing else to do.

I leave and discover that a girl is now playing in the sandpit. She spots me and nearly runs to her teacher, but then she spots my umbrella and her curiosity gets the best of her. I can tell that she wants it, so I hand it to her and she runs off into the shelter to play. Could she be the scarred woman in London? Do I even want to consider that?

There is still nowhere else that I can go safely, but seeing folded paper cranes in a nearby school window gives me a thought. I follow her into the shelter and hand the girl my unfolded origami crane from the beginning of the game, the one that gave me the message to go to the Long Water by 4 PM. She folds it back into its original crane shape and I gain three points. It glows with a strange energy. I return outside and the crane grows into a giant living paper bird. I climb on its back and it takes me up to just outside the white door, still suspended in midair, where I can leap off and through. Whew!

From a game perspective, that was an interesting segment and very much "on rails". If I had not brought the paper or umbrella with me, I could not have progressed, plus it was really only two rooms that I had to move back and forth between to advance story segments. More than any other section of the game except perhaps the first near-future in London, this paints a human face on the misery of the bomb. Honestly, this section wrecked me and I needed to take some time off from the game. I'm really not cut out for reviewing this type of emotional experience. This game hurts. I don't even care that I don't know if that was Hiroshima or Nagasaki, I'm done and need to move on.

"You can either look at things in a brutal, truthful way that's depressing, or you can screw around and have fun." - David Spade

Calling a Spade, a Spade

With no more toadstool doors to explore-- I haven't found the third or seventh and the second one kills me immediately-- I resolve find places in the wabe where my new items might be useful. I still have up a spade, a lemming, and an open coconut. It takes some experimentation, but I'll skip my failures and move straight to the good part: I can open the crypt in the cemetery!

Using the spade, we pry off the lid to see the corpse of the "Wabewalker" (me?). This was well-hinted since I was told earlier that I needed more "leverage" to move the lid and a spade is certainly leverage. I had hoped the grave would be empty, but instead I look down at a "great missionary or explorer" in his final rest. I hope this game does not go all Infidel on me. The corpse is wearing a burial shroud, a bandage around his head, and two strangely colored boots: one red and one green. Like any good tomb raider, I strip the corpse and take all of his stuff. His mouth hangs open once the bandage is removed and I discover a silver coin inside. Fare for the ferryman? The boots each have a strange (but empty) recess at the tip of the toes. Do I have to hide something in them? With the corpse thoroughly desecrated, I'm nearly halfway through the game: 49 points!

While exploring, I also get the brilliant idea to float the Bubble Boy's bubble out through the "space" doorway. Amazingly, it fits! The bubble immediately freezes to create a protective shell and that somehow keeps us from dying in the cold vacuum of space. Unfortunately, there is no way to control the bubble and the white door drifts rapidly away from us. After a time, a satellite comes closer and then departs again without letting us do whatever we are supposed to do. There is briefly a Star Wars-style laser destruction of a missile, but nothing to do except wait it out and die. There are still things that I am missing before I can conquer outer space.

What happened to the other five stories?

Desert Island Decameron

I wear all of my burial clothes and the ferryman lets me on the boat! He takes the silver coin as payment (but not the London 20p one) and deposits me across the river. There is no entrance to Hades or two-headed dogs, but there is a small island with the expected toadstool on it. When I arrive with the seventh symbol set on the sundial, I emerge into another rickety shack next to a large metal ball covered with wires.

There are voices outside and if I leave prematurely, I am killed-- more on that in a minute. But if I explore the room first the voices eventually leave. I use that time to try to open the bomb via an access panel that I discover on the side, but no dice without a screwdriver. I even try using the London coin, but it doesn't fit. A book sits discarded on the floor, the Desert Island Decameron. Doing some Googling, I discover that it is an "unconventional anthology of humor"... a strange thing to find in a room with a giant bomb, but perhaps one of the guards needed a little light reading while he considered the hellscape that he was potentially helping to create. Inside is a bookmark with a poem on one side and a diagram scrawled on the other. I get four points for reading it so it must be important, but the only part we can "see" in text is the legend: "RD=DET, BL=POS, ST=INF, WH=GND". My guess is that we are looking at a wiring diagram and an explanation on how to defuse the bomb. In any event, it's useless without the panel being opened.

Once the voices are gone, I exit and climb down the ladder. At the bottom is a padlocked box… and our friend the roadrunner! He's finally back in his natural habitat and seems happy to see me. He even drops the ruby at my feet! I pick it up to gain a few more points and from this moment the roadrunner follows me around. I cannot open the padlocked panel, even when I try to smash it with the axe or spade. Letting the lemming go doesn't help either and I do not see any lizards here.

I'm going to pass on delving too deeply into my explorations of the New Mexico desert for now, except to say that we only get a few turns before we die and even with successive restores I do not find much of interest. I suspect that I am here before I am ready; maybe I find a way to slow down time? Maybe by defusing the bomb at the beginning, the test is delayed by a few minutes and I can explore further before dying?

Perhaps more importantly, this is the message that I get when I inevitably die:

All at once, the desert around you disappears in a flash of startling brilliance! You jam your hands over your eyes in the awful glare; never see the fireball closing in at many times the speed of sound; and never feel the stellar hear that annihilates much of the state of New Mexico.

The real Trinity test, which I am certain is where this gate has taken us, did not nuke the state of New Mexico. It was relatively modest as far as later bombs were concerned and so something must have happened to change history. Have I finally stumbled on the plot of the game? Did someone or something interfere with the Trinity test to make it even deadlier than before? It's a great twist if that's what happened and I am eager to see how the game continues.

For now however, I am stuck and have a few open problems to solve:

I have yet to find the third toadstool. I thought it was by the Bubble Boy, but since we use the bubble to go to space I was probably mistaken. I will have to search for it since there's something I missed someplace.
I do not know what to do with the wight, either to help it or kill it. Could the crypt's skeleton key by the solution to the lock in New Mexico?
I do not know what to do in space.
I do not know what to do with the magnetic meteorite.
I do not know where to find a lizard. It seems most likely to be in New Mexico, but I doubt it given that even if we find a way to reopen the doors, I don't seem to have a path back across the river to the main part of the wabe.

I did manage to get 70 points, but I've reloaded now to before crossing the ferry so I will have to get some of those again.

Time played: 2 hr 15 min
Total time: 7 hr 25 min

Inventory: bag of crumbs, small coin (20p), silver coin, red boot, blue boot, bandage, burial shroud, credit card, wristwatch, birdcage with lemming, broken coconut, and silver axe. (Not all being carried at once.)
Score: 70 of 100

viernes, 10 de abril de 2020

Busy Day!

What's going on everyone!?

Today makes 4 days before we have to be out of our old home and in our first ever house that we will own! This meant a LOT of moving today and even more tomorrow as our goal is to be out and sleeping in our new home by tomorrow night!

So with all of this in mind, please understand the reasons for me repeatedly playing all these app games. I will get to physical games as soon as I am able but currently our new house is so small that we can't even fit a kitchen table in there, lol.

Today for the #2019gameaday challenge I played another game of Zombie in my pocket and ALMOST walked away with a win but at the last second I ran out of time and all was lost.

It really is a fun game and I love that its just as easy to win as it is to lose!

As always, thank you for reading and don't forget to stop and smell the meeples! :)

-Tim

miércoles, 8 de abril de 2020

Books Vs Movies 1/2: Books I Read After Seeing The Movie

Anna Karenina, Leo Tolstoy

Movie: One of those movies that uses it's actors like juggling balls rather then for their talents and performances. Filled with a self-indulgent hyper-kinetic freneticism that is supposed to overawe but only makes me feel as empty as I do after watching forty minutes of Marvel movie fighting. I couldn't take more than a half hour of it.

The movie contains only the barest outline of the contents of the book (which is well over 700 dense pages).

Book: A classic, beautifully written, deeply insightful, and filled with a rich panoply of characters and events. I just don't like it. Why? Because it's filled with despair , depression, and the oppression of a soulless bureaucracy. I need someone to root for in my media, and there are no redeemable characters in the book. Anna starts out likeable enough, but soon becomes single-mindedly fixated on her adultery and filled with despair. Levin is kind of interesting as he works out the basics of communism, but hardly someone to identify with. Kitty is vacuous during the first half of the book, but she gains a few morals by the middle; unfortunately, her character just isn't that interesting.

Arrival, Ted Chiang

Movie: Quiet but phenomenal: intelligent, suspenseful, beautifully acted, scripted, and directed, and thoroughly engaging. It was only an hour after the movie ended that I figured out exactly what had been going on. One of my favorite movies of its year.

Book: A very nice short story, written in an economical style, well-plotted and thoughtful. To be honest, the movie is so good that it makes reading the story kind of superfluous. The movie contains everything in the original story (with a few irrelevant changes) and more.

Atonement, Ian McEwan

Movie: A beautiful movie with some haunting cinematography and outstanding acting. Some of the scenes and characters are haunting, and it contains some of my favorite actors. The story is clean and harsh.

Book: Very well-written, the movie is fairly close to the book. Both were enjoyable.

Bridget Jones' Diary, Helen Fielding

Movie: A very well-made chick-flick romcom that is a modern remake of Pride and Prejudice. A defining role for the fetching, sarcastic, and sympathetic Renee Zellweger. Actually a lot of fun, although kind of devolves a bit at the end as romcoms do.

Book: Slightly better than the movie, with a sharper satirical voice. The movie pretty much follows the book, but the book has its own distinctive voice.

The Chosen, Chaim Potok

Movie: A classic coming of age movie set in two Jewish 1940s Brooklyns that intersect. Contains some lessons in overcoming prejudices, making friends, and dealing with the heavy roles placed on us by society and family.

Book: As I recall, the movie is pretty much a reflection of the book, but the book is longer and deeper. Honestly, it's been a long while since I read it.

Chitty Chitty Bang Bang

Movie: An iconic live-action Disney musical and performance by Dick Van Dyke. Very reminiscent of his overacting and production, like Mary Poppins. Fun in a nostalgic kind of way.

Book: Holds up better than the movie It is aimed at young readers and has good pictures and a simple clean writing style. The movie basically follows the book but changes several story elements to make it more child-friendly.

E.T. The Extraterrestrial, William Kotzwinkle

Movie: A classic Spielberg movie, with an absent father, cute kids, realistic dialogue that can veer from maudlin to annoying, and an incredible sense of wonder and magic. Beautiful cinematography and direction.

Book: A novelization of the movie, and I remember being thoroughly underwhelmed. The book adds some inner dialogue to the book that somehow managed to destroy the magic of the story.

East of Eden, John Steinbeck

Movie: A great movie, one of the three major films starring James Dean. Powerfully shot and directed, with iconic performances.

Book: A powerhouse classic novel, one of the best American novels ever written. It is large, wide and epic, as well as thought-provoking with biblical allusions, well-drawn out characters, and interesting moral questions. The movie only superficially covers about the last quarter of the book.

The English Patient, Michael Ondaatje

Movie: A great movie; could be considered a chick-flick but it is so much more, with sweeping characters caught in a global war and a series of interesting character dynamics and coincidences. Beautifully shot and acted, and very engaging.

Book: The movie follows the book fairly closely, and may be slightly better, but the book is also great. A very good read.

Escape to Witch Mountain, Alexander, H. Key

Movie: I loved this as a kid. It's kind of dated and a bit hokey, but still pretty fun to watch.

Book: Aimed at a rather young audience, so very easy and quick to read. The movie and book are nearly identical.

Fantastic Beasts and Where to Find Them, J. K. Rowling

Movie: An interesting movie, more low key than the Harry Potter movies. Two thirds of its time is spent on the pastoral main character and his doings and only in the last third do the hinted-at dark elements come to the fore. In this way, it is actually a closer representation of Rowling's writing style than the HP movies.

The main character is not a fighter, but a nurturer, which is quite an unusual choice for a movie that seems, superficially, to be more about action. It was well shot, had quirky characters, but was perhaps a bit slow. And then there was a battle sequence which went on too long, or at least with too much monotony. But it was enjoyable, all the same.

Book: Has nothing to do with the movie; it is a small fictional encyclopedia, which will eventually be written by the main character of the movie. You can skip it.

The Fault in Our Stars, John Green

Movie: Cute but disappointing. The characters were nice, the message was upbeat, but it was mostly predictable. The movie had a particularly bad misstep by setting a romantic scene in The Anne Frank House (ugh) and one particularly good scene near the end in a car. The rest was fine, occasionally charming, but too tame and pedestrian.

Book: The movie very closely follows the book. The book is slightly better, but has basically the same flaws.

Freaky Friday, Mary Rodgers

Movie: Here I refer to the original movie with Barbara Harris and Jodie Foster, I suspect that it is now pretty hokey, like many made for TV Disney films, but may still have some charm. I remember find it very funny and entertaining when I was a kid. The remake with Jamie Lee Curtis and Lindsay Lohan was watchable but often over-produced and dumbed down. I think I might try to find the original again.

Book: Has several major differences from the movie, as I recall, as it follows almost entirely the point of view of the daughter in the mother's body. I don't remember it, although I remember my brother owning a copy. It was aimed at young teens.

The Grapes of Wrath, John Steinbeck

Movie: I saw this in high school and wasn't ready for it. It's pretty grim. Well made, but not really entertaining.

Book: A well written classic, and far more expansive than the movie. The movie covers most of the book, but skips the first few and last few chapters and glosses over a lot of the middle. The book is also grim, but the good writing brings the characters to life, and it is more engaging.

Heaven Can Wait, Leonore Fleischer

Movie: Another somewhat dated movie (1978). While the special effects are hokey and the timing and performances of the actors are sometimes a bit off, it still holds up pretty well. I really enjoyed it when I was young.

Book: Actually, the movie is based on the 1941 play Here Comes Mr. Jordan by Henry Segall. This is the novelization of the above version of the movie. It wasn't that bad, just a straightforward telling of what you see on the screen. Not worth seeking out.

The Hours, Michael Cunningham

Movie: A beautiful, thoughtful movie about three women in three different realities, connected by visual clues and emotional eddies. Perhaps a bit heavy handed on cinematic allusions, the directing and production are nevertheless solid, as are the magnificent performances by several incredibly talented actors. Emotional and hopeful.

Book: Was a disappointment after seeing the movie. It's not a bad book, but it is pedestrian in comparison. The movie essentially follows the book, with some cinematic licenses.

The Hunger Games (1), Suzanne Collins

Movie: I loved this movie so much that I immediately bought the entire trilogy of books knowing nothing about it. The performances are fantastic and the story and execution is beautiful. It's a great movie. Even so, the movie glossed over certain side themes and characters. It tried to both denounce the games while at the same time glorify them on screen, which didn't really make sense.

Book: The book is phenomenal, an instant classic, beautifully written with evocative characters and settings. The book presents the correct balance of despair and terror that the movie glosses over.

The second and third books are just as good or even better, while the subsequent movies got progressively worse.

John Carter (A Princess of Mars), Edgar Rice Burroughs

Movie: Roundly condemned for being boring, disjointed, and derivative, it was a huge box office bomb. I liked it. It was quirky and even daring in certain instances, and the plot, while somewhat far-fetched, was easy enough to follow. The characters and plot were shallow, but not boring.

Book: From 1912, the book is pre-golden age of science fiction, which explains its bizarre far-fetched plot. It is a decent read. The movie follows the book fairly closely, but expands on the text and plays with the start and end in order to provide a more compelling explanation of how the protagonist travels to Mars. Neither book nor movie are amazing, but they are both entertaining enough.

Julie and Julia, Julie Powell

Movie: A fun Nora Ephron movie about blogging, New York City, marriage, and cooking. Amy Adams is cute as Julie the blogger who decides to cook through Julia Childs' fat-laced Mastering the Art of French Cooking and Meryl Streep is delightful (of course) as a young Child as she first learns to cook. The fact that, in present time, Child acknowledges Julie only to dismiss what she does as a stunt is disconcerting but somewhat telling.

Book: The movie is actually based on Powell's book Julie and Julia: My Year of Cooking Dangerously as well as an autobiography by Child from the same year. Powell's book corresponds to the Julie scenes in the movie, and is written well enough. I can't really recommend the book: it's okay, but the author has some questionable morals.

Jurassic Park, Michael Crichton

Movie: An iconic, fantastic Spielberg movie that still works so well that you don't even mind the just ever-so-slightly off effects (except for when the girl says "It's a UNIX system!" which elicits a groan of pain from me every time). Has the usual daddy issues and cute, precocious children. Wonderful, magical film, with a great cast especially Goldblum), superb action and humor, and even a timeless message.

Book: The movie pretty much follows the book, which is also excellent. The book leaves out some of the great lines from the movie, but goes deeper into the characters, science, terrain, and so forth, and has a slightly darker more ominous tone, especially the ending.

Life of Pi, Yann Martel

Movie: A stunning work of cinematography, with a good story and good acting. This was one of my favorite movies of its year.

Book: The movie pretty much follows the book, but the movie is more fun to experience.

Me Before You, JoJo Moyes

Movie: Shallow and predictable. Its assets are the impossibly perky Emilia Clarke as Lou and the handsome and winning Sam Claffin as the wealthy but paralyzed Will. Everything else were just devices to have the main characters interact, trade barbs and glances, and share hearts. During the movie, when it appeared to be leading to a tragic ending, the realization of its inevitability evoked some emotion out of me, but that was its only real good point. When it ended I suspected that the book would be better.

Book: I was happily surprised to discover that the book is not only better, but it is excellent, well worth the read. The book goes deep into the poverty and struggles of Lou and her family, the dynamics of Will's parents and sister, the ethics of suicide and assisted suicide, and the lives and struggles of quadriplegics. The book takes its time and is well researched. Even Lou's boyfriend is more interesting in the book: in the movie he is one dimensional and you know he will be kicked to the curb a few seconds after he shows up on screen; in the book, he is still an ass but more well-rounded and sympathetic. I recommend the book.

After you read the book, you can enjoy the movie more, because you now know the back stories of the characters that were glossed over by the movie. Or you may also be even more disappointed in the movie for cutting the heart out of the book.

Message in a Bottle, Nicolas Sparks

Movie: Not a bad chick flick, it is solid but also not particularly daring. Paul Newman steals all of the scenes he is in.

Book: It's Nicholas Sparks: the plot is simple and fun, the writing is good enough to tell the story and not much more. The movie pretty much follows the book.

The Perks of Being a Wallflower, Stephen Chbosky

Movie: A fabulous movie about a strange teen and his mysterious problems and the odd friends he makes in high school The movie is beautifully scripted with several concurrent themes running through it, some serious and some light, and they all work together Great performances and music, too. Inspired me to read the book as soon as possible.

Book: Also great, a longer and more complex version of the movie. The movie managed to portray most of the book's major plot elements, but the book makes them more gripping with an attention to details and events more fully realized. Worth the read.

Scott Pilgrim vs the World, Bryan Lee O'Malley

Movie: A fun, wacky and engaging movie that inspired me to read the comic series as soon as possible. The movie is so random in some ways, and yet it cohesively uses video-game semiotics to metaphorically convey the main character's reality, while the main plot is its own metaphor about making a relationship work while dealing with the ghosts of past relationships. I loved it.

Book: My joy of the movie was lessened after reading the powerhouse that is the graphic novel series. Scott Pilgrim the six part comic series is incredible and incredibly deep, funny, original, cute, cool, and so much fun. The movie more or less covers book 1, some of book 2, parts of book 3, a teeny bit of book 4 and 5, and then nearly entirely rewrites book 6. The plot ends in a totally different place, and so much of the important story, character development, metaphors, depth, and life lessons from the last four books are absent from the movie. The movie is just a shadow of the incredible book series. I still enjoy the movie, but do read the series.

The Shipping News, Annie Proulx

Movie: An adult story set in New England mostly Maine) about loneliness and mediocrity, the movie is pretty good, although it doesn't really have a lot to say. The main characters are not all that sympathetic, but its a decent watch.

Book: A more fleshed out and sympathetic portrayal of the story, the main character transforms and grows by the end of the book. It is written solidly and a good read. Scenes that were flat in the movie are richer in the book since we can see can experience the characters' inner struggles. I enjoyed it more than the movie (and that feeling is only exacerbated by knowing what we now know about Kevin Spacey).

Slumdog Millionaire (Q and A), Vikas Swarup

Movie: A highly-praised movie, and well deserved. It manages to be funny and yet still explore some of the dark areas of Indian poverty, child abuse, and crime. Great acting and sets, and an engaging plot.

Book: Definitely better than the movie, well written and more satisfying. The book contains background information, relationships, and even entire scenes that are skipped over by the movie, so that many of the characters and their motivations make more sense. Not a long book, and worth the read.

Speak, Laurie Halse Anderson

Movie: The movie that introduced me to Kristen Stewart, it is a neat, quiet, but powerful little teen drama about an event that is hard to speak about. It is very well done, almost a classic teen movie.

Book: The movie essentially follows the book. It is something like two different people telling the same story - all of the plot elements are there, but the coloring and which parts are given weight is slightly different in each telling. A very good teen read.

Star Wars, George Lucas (Alan Dean Foster)

Movie: Not much to say here, I think.

Book: A novelization of the movie, adding only a bit of interior dialogue. It was nothing special. Foster went on to write the first sequel to Star Wars - Splinter of the Mind's Eye - even before The Empire Strikes Back came out. As a result, that book doesn't entirely adhere to the SW universe; it was a pretty good book, however.

Superman III, William Kotzwinkle

Movie: Superman was a little soporific, but also iconic in many ways. Superman II was pretty great; from today's perspective, its timing, some effects, and some of the dialogue is off, but it's still a good watch. Superman III tried to be a comedy with Richard Pryor, but it wasn't funny. It was pretty tiresome to watch, and its computer elements were as ridiculous as they come in movies. Some scenes with Clark Kent fighting his evil instantiation were okay.

Book: Like E.T.'s novelization, this book was pretty awful, robbing what little interest the movie held with poor cutesy prose. I hardly remember anything from it except that I didn't like it.

The Sword in the Stone, T. H. White

Movie: One of the minor Disney efforts, it's a barrage of meaningless, psychedelic, and silly visuals and jokes. The move has only passing reference to the book's form, missing nearly all of the rich descriptions, all of its important concepts, and all but the last, major plot point.

Book: The movie glosses over the first book of a five book series on the Arthurian legends. The first four are collected under the title The Once and Future King. The first book, rather like The Hobbit, is the juvenile entry of the series; the other four are more for adults. The entire series is a must read, an absolute classic of English literature, on par with The Lord of the Rings. Yes, it's that good.

The Time Traveler's Wife, Audrey Niffenegger

Movie: Certain movies, like this one, just work, and you can tell that from the first ten minutes. This is a lovely romance movie, which uses its science fiction element as an allegory (as all good works of science fiction do). Heart-warming and captivating, but very much an emotional roller coaster. It falters a bit when it veers into trying to explain things scientifically, and then certain story elements aren't exactly explained well (like how their time traveling daughter can possibly survive, at a very young age, the same kinds of experiences that the protagonist went through as an adult).

Book: Like Perks of Being a Wallflower, the movie is a condensed version of the book. The book gives a richer tapestry of the events, including expanded scenes and an ending that are more satisfying than the movie. A beautiful read, good to read together with a loved one.

Twilight, Stephanie Meyer

Movie: Not bad, although it also somewhat shallow. Like The Time Traveler's Wife, the central fantasy is a metaphor about sexual tension between an older boy and a minor girl, but it is also an action movie. It doesn't quite successfully juggle both elements, and Kristen Stewart doesn't give us much character depth, but that is more the fault of the screenwriter and director than hers. The movie is aimed at tween girls, and they like it, so that's that.

Book: Somewhat better than the movie, still aimed at tween and teen girls. Again, it's not bad, and certainly more original than the hundreds of similar books that it inspired and that came after.

The Wizard of Oz, Frank L. Baum

Movie: A wonderful movie that, amazingly, hasn't lost its charm. Full of great moments, great quotes, and great characters, and some very funny and scary moments you always seem to forget.

Book: Called The Wonderful Wizard of Oz, I was never able to get into it. The author's writing is not as good as the author's imagination. Dorothy is someone who things happen to, rather then someone who does things. The movie really makes the story shine.

Wonder, R.J. Palacio

Movie: I anticipated this being a boring movie with a straightforward story about a disfigured boy who goes to school, is bullied, makes a false friend and then a true friend, finally wins over the school, etc, blah blah. Actually, half of the book is about that, but the other half is told from the point of view of others in his life, and those stories are more interesting. Some of these side stories don't even revolve around the boy, which make the whole thing a richer experience. So I enjoyed the movie, although the main plot was somewhat shallow. I anticipated that the book would contain things left out of the movie.

Book: But the movie nearly exactly follows the book, even the structure of telling stories from the perspectives of the different characters. The book and the movie are essentially the same, so, while the book was also fairly enjoyable, it was not much more than that.