This is a story two and a half years in the making. Even though I’m putting it here, it really doesn’t have much (or anything) to do with security - it’s more of a story about living life. Maybe that’s the point. Hopefully you’ll enjoy the ride.
It all began back in February 2014. At the time, I was a consultant for InGuardians and I was assigned to do five days work, onsite, for a client in California. Because spending a few February days in California unquestionably trumps spending those same days in Northern Illinois, my lovely wife Karen decided to tag along for the trip. I warned her that I would be working and that she would need to find something to occupy herself during some pretty long days. Karen allowed as how she was sure that sitting by the pool in the sun would keep her happily occupied.
Then, the cold snap hit California.
Where the average temperatures that time of year normally hovered in the upper 70’s and lower 80’s, they plunged to the low to mid-60’s - certainly not pool weather.
Karen was, however, a trooper. She didn’t complain (much) and managed to keep herself entertained as best she could. As the week wore on and the weather continued to be uncooperative, her options for things to do during the day started to dwindle.
Thursday evening, I got back somewhat late from the client’s site. It was already dark, and I was feeling a little guilty that she’d been waiting for me. As I changed out of my “work clothes” so we could go to dinner, Karen told me about her day. She said that she had made dinner reservations at a restaurant in walking distance and - more importantly - there was something on our walk that she really wanted to show me.
“What did you find?” I asked
“You’re going to laugh at me,” was her response. “I found the cutest pig statue ever.”
“On our walk” turned out to be something of an exaggeration - it was actually in the opposite direction. Fifteen minutes later, we were standing outside of a restaurant I’d been to many times before (I’d often done work for this client). Somehow, I’d never bothered to notice what my wife had seen: just outside the front door there was, indeed, a pig statue.
As pig statues go, it was nice, but to my eye it wasn’t quite “we-must-make-a-pilgrimage-to-visit-the-pig” nice. My wife grew up on a farm, and her father - at one point - raised pigs, so her love of pigs, and especially “cute” pigs, likely far outstripped mine. In the back of my head, I was pretty sure that desperation for California cold-weather entertainment was responsible for this fixation.
It was a few weeks later, when I happened to overhear her talking to a friend on the phone. We were back at home and she was recounting details of the trip and sure enough, I heard her talking about the pig statue.
“No, seriously… it was absolutely the cutest pig statue ever.”
“Ok,” I thought, “I’m going to have to get her that statue.”
And so, it began…
Now I wasn’t necessarily going to get her THAT statue. I mean - if the restaurant was interested in selling it, sure… I’d get that one. But I knew by looking at it that it wasn’t a one-off. I’d just find another copy… somewhere.
Oh, how naïve I was…
I called the restaurant that day, and left a message for the owner - telling them that I was interested in the pig statue and asking them to call me.
Nothing.
Perhaps “I’m interested in finding out some information about the pig statue you have outside,” is a little weird for voicemail. I called back, got the owner’s email address, and sent them an email laying out my lovely wife’s obsession with “the cutest pig statue ever,” and asking them for information about where they’d gotten it.
Nothing.
In all, I sent about a dozen emails and left about dozen voicemails over the course of about a year and a half - contacting them at least once a month. The owner never seemed to be around whenever I called, and they never responded to my emails - so I pretty much gave up finding anything out from them.
I took to Google’s Image Search, using various combinations of descriptors with the term “pig statue.”
I’ve looked at hundreds (perhaps thousands) of pictures of pig statues.
(Go, right now, and do a Google Image Search for “pig statue.” I’ll make it easy for you - click here. There are LOTS of pig statues. Angry pigs, happy pigs, pigs with wings, pigs dressed in clothing, fat pigs, skinny pigs… pigs, pigs, pigs. There are a LOT of pig statues… just not the one I was looking for…)
I also looked on EBay, which seems to have a never ending supply of new and different “pig statues” cycling through their platform. Apparently I’ve somehow greatly underestimated the world’s appetite for pig statuary…
When I made the move from InGuardians to Warner Brothers, I found out that the WB “Mill” can, essentially, make anything - and they’re available to do work for employees - for cost. They’re the folks who make the sets, props, etc… for movies and TV shows, and so they have amazing capabilities. Because most of the stuff they make for filming just has to look good, most of what they make is… well… good looking crap - but they’re true artisans, and actually enjoy making “real” things for employees. My old boss, Ron Dilley, did some leg work for me (he’s gone through the process before and had an awesome piece of furniture to show for it…) and got an estimate for the cost of making a casting of the original (if I could get the folks at the restaurant to lend it to me for a couple of days - a dicey proposition at best, since I couldn’t get them to even talk to me). When Ron told me the price… well… I love my wife, but let’s just say that there are limits.
Around that same time, the original client did something huge. He’s actually a close friend, and knew that I had been trying to get information on the pig statue. One day, he had stopped in the restaurant for lunch and - perhaps the stars were perfectly aligned - the owner was there. He basically cornered the owner and told them that his friend really wanted to know the provenance of the pig statue. Long story short: before he left, he had the name of the place from which the owner thought it had been purchased.
At this point, it had been over two years since Karen had originally seen the pig. The pig hunt wasn’t constant - I would usually “spin up” once a month or so and dig though a few hundred listings on EBay or throw some new term at Google Image Search and scroll past a couple hundred new photos - but it was starting to seem futile. Now, I had a real lead.
I called the place - it was a high-end gardening, pottery, and “found items” shop - and, essentially, they laughed at me.
“A statue of a pig? I’m sure we’ve never sold anything like that.”
Square one.
I sent emails to the addresses on their website with a picture of the pig. The dude on the phone seemed to be way more snooty than someone working in a place like that should be, and I hoped that my email might reach a more down-to-earth person who would actually check.
Nothing.
I found this latest dead-end very frustrating, because - despite snooty dude’s demeanor, looking at their website, it sure seemed like a place that would sell a statue of the “cutest pig ever.”
That’s when it hit me…
CeWL - DigiNinja’s Custom Word List generator is a tool that I’ve used in the past on engagements. The idea is this: you run CeWL on a target organization’s website and it extracts a list of words that are specific to that organization. You then use those words when you’re attempting to crack passwords or brute-force accounts. It’s surprisingly effective.
If snooty dude’s website painted the picture of a place where I would likely find the pig statue, maybe if I used some of the same kinds of descriptive words they used… if I seeded my Google Image Search using those terms (along with “pig statue”)… I might have better luck. Not that I was actually going to run CeWL on their website… but you get the idea.
“UNIQUE GARDEN PIG STATUE”
It was about the 5th new combination that I tried. The other four attempts had come up empty, and I was feeling a little dejected. As I scrolled through hundreds more images I wasn’t expecting much…
SON-OF-A-BITCH… THERE IT IS!
As it turned out, the words “UNIQUE” and “GARDEN” were the key, because the “cutest pig statue ever” is a product of Unique Stone, Inc - purveyors of antique and garden reproductions in Rockingham, NC.
My tenth wedding anniversary was coming up, and somehow the search engine gods had managed to part the clouds standing between me and the perfect anniversary gift.
I called Unique Stone and ended up talking to Amy, a very sweet lady with the thickest southern accent I’ve heard in a long time. I told her the story of my search for the “cutest pig statue ever” and explained that I wanted to purchase one.
It turns out that Unique Stone isn’t in the retail pig statue business (who knew?) and generally sells only wholesale - in large lots (i.e. like 1000 pieces). Given my long search and my story, Amy (who - as you’ll see - has the patience of a saint) was willing to sell me one. The only issue was that they weren’t really in the business of shipping individual statues… they were geared for shipping truckloads. I told Amy that if she would sell me a pig statue, I would figure out a shipping method.
As we talked through the purchase and I gave Amy my address, she asked a rather odd question:
“McHenry, Illinois… is that anywhere near Gurnee?”
Yes. Yes it is.
It turns out that Amy and her husband were planning to drive north to Gurnee, Illinois for her nephew’s high school graduation in a few weeks. If I would be willing to drive to Gurnee to pick it up, Amy said she would be happy to bring the pig north with her. Southern hospitality is a very real thing.
There was only one hitch: she was coming to Illinois for her nephew’s high school graduation on the same weekend that I was heading to Memphis for my daughter Mary’s graduation from her Master’s program.
What’s the point of having lots of children if you can’t impose on them to do things for you? I called my oldest step-daughter Lauren (who lives nearby) and once again told the story of the “cutest pig statue ever.” I asked her if she could meet Amy in Gurnee that weekend to get the pig. She said she would. I gave her Amy’s number and gave Amy hers - the two of them would figure out a time to meet that would work once Amy was here.
Throughout the weekend in Memphis, I kept texting Lauren for updates. She allowed as how with all of the texting and meeting up with people in parking lots with cash, it seemed like she was part of a drug deal. The “meet” was finally set for Sunday during our drive home, and every time we stopped for gas or food, I would fire off another text to Lauren for an update. Finally, the deal went down:
Uh oh…
I asked Lauren to text me a picture.
Aaaaaarrrrrrgggggghhhhh!!!!
It turns out that Unique Stone had some problems with their website. Specifically, the pig I wanted and the pig I got both had the same part number and description listed on the site - something that no one had noticed until now. The upshot: Amy brought the wrong pig.
I called Amy the next week and explained the situation and she was more than apologetic. I had done some “recon” using Google maps and had located a pack-n-ship place in Rockingham, NC. Amy gave me the specifications of the correct pig, and I called and chatted with them about their shipping capabilities. It looked like a “go.”
Amy kindly credited me for the “little” pig and volunteered to drop the new “cutest pig statue ever” off at the pack-n-ship place. Once again, southern hospitality is a very real thing. (Note: Later, I learned that she carried the 90 pound statue into the store by herself. After going over the specifics with the high-school aged clerk, she said she had to laugh when he asked one of his co-workers to help him move it…)
By coincidence, the package was scheduled to arrive on the day that Karen and I were leaving for a trip for our anniversary. The UPS website showed that the delivery window was going to butt up against the time that we needed to leave for the airport, and I kept my fingers crossed that it would arrive on the early end of the window.
The night before it arrived, I had a dream that it showed up and was broken. I considered trying to distract Karen when the package arrived so I could check it first, but decided that there was little chance of being able to successfully pull that off. I was just being paranoid, after all.
FYI: That’s something that we, in the literary biz, call “foreshadowing.”
Sitting together on our front porch, Karen opened what was supposed to be a surprise anniversary gift (we had decided not to get each other individual gifts - the trip was our gift) only to find… well… several hundred chunks of the “cutest pig statue ever.”
(Note: The pig was the item, broken in transit, that I referenced in an earlier blog post, Po-tay-to… Po-tah-to)
Fast forward to today…
This past weekend, I drove my daughter Maggie to Raleigh, NC where she will be attending Meredith College. After two years at another college, she wasn’t really sure she was on the right path and took a year off to participate in Mission Year - an urban ministry program focused on discipleship in (in her case) inner city Houston. After that, she decided to continue her education at Meredith.
A few weeks after she had asked me about driving her to school, a lightbulb lit up above my head. I looked at Google maps and found that Rockingham was only a two hour detour…
I called Amy again and asked to purchase two pigs for pickup. Why two? As much trouble as this dang pig has been, I really need to have a spare.
This picture is two and a half years in the making. In it, you’ll see the “cutest pig statue ever” sitting on our front porch… right where it belongs.
I said that this was a story about living life… but what did I mean?
I love my wife, and while a two and a half year hunt for the “cutest pig statue ever” may seem crazy, it reminds me that while you may not love what you’re doing at every moment, if you love the overall goal, it’s all more than worthwhile.
There’s always a part of the day-to-day minutia of anything we do that’s dull, boring, or tedious. (I believe that “looking through pictures of hundreds of pig statues” is actually the archetypical example used to define “tedious.”)
Nothing worthwhile works out easily - but persistence has a way of paying off in the end.
And you know what? That pig statue actually is pretty darned cute…
-TL
Tom Liston
Owner, Principal Consultant
Bad Wolf Security, LLC
Mastodon: @tliston@infosec.exchange
Twitter (yes, I know… X): @tliston
August 16, 2016
]]>
(click to enlarge)
nce upon a time, a noble knight of the InGuardians clan was asked by a client to perform a penetration test against that client’s network. Late one afternoon, the noble knight began his testing, and lo!, there was much 0wnage to be had.
nd it came to pass that the minion attempted to log into the knight’s system via “ye olde SSH” in a vain attempt to disprove the rumors of the knight’s coolness.
lowly it began to dawn on the minion that perhaps things hadn’t worked out quite as well as he thought. He began to get the idea that he had stumbled into a trap.
he knights of the InGuardians clan are nothing if not merciful. They chided the minion but forgave him, telling him that they hoped he had learned a lesson.
Apparently, during the early 90’s all of the mirrors in the world were temporarily broken.
