Yes, We Did It...

Wichita, KS—June 1, 2009: Wichita, Kansas-based aviation enthusiast and entrepreneur James Wiebe and his wife, Kathy, have acquired the production rights to a previously designed aircraft, the Kitfox Lite, and formed a new business entity, Belite Aircraft, to market it. The airplane will incorporate stronger, lighter carbon fiber components that will allow it to easily meet Federal Aviation Regulation (FAR) Part 103 weight requirements.

The Wiebes, who previously developed and marketed digital forensic computer storage devices as the founders of Wichita-based enterprise, WiebeTech LLC, acquired the tooling, existing parts and manufacturing rights to the aircraft in March of 2009. As a condition of the transaction, they agreed to re-brand the airplane to prevent any confusion with the larger, two-place light sport Kitfox that shares many of the same design features but is owned by another company. Kitfox has recorded more than 4,500 kit sales since its introduction 25 years ago.

An instrument-rated pilot, James Wiebe has applied his creativity and experience to this new venture, developing a proprietary lightweight carbon fiber structure that he is incorporating into the modified airplane’s construction. By converting spars, ribs and struts from steel, wood or aluminum to carbon fiber, he has reduced the airplane’s empty weight to previously unattainable levels, well below the 254-pound limit specified in FAR Part 103 for this type of aircraft.

“This project, which combines my passions for flying and inventing, is exciting on several levels,” Wiebe noted. “From a business perspective, the development and application of our proprietary carbon fiber has lots of potential for other aircraft and in other markets. Its use in this aircraft provides the weight margin that will allow enthusiasts to build it and enjoy the fun of flying it safely and economically. Our proprietary carbon fiber process builds quickly, far faster than aluminum, wood or composite construction. We expect this aircraft to be a practical and popular choice among light sport aircraft,” he added.

Wiebe indicated that he plans to incorporate a number of additional modifications into the design that will further improve the airplane’s performance and versatility. He has reserved exhibit spaces 612 and 615 in the North Display area at the upcoming Experimental Aircraft Association AirVenture 2009 in Oshkosh, Wisconsin and expects to have an aircraft on display at the show. Additional announcements regarding availability and pricing are expected at that time.

# # # #

Tooling purchased; redesign underway.

I am enjoying designing my new airplane!! I'll have much more news soon.

Our fuselage is being built on the tooling which we purchased. (This tooling was used to build the Kitfox Lite a long time ago... long story.)

We are in the process of redesigning the wing to utilize ultralight, ultrastrong, quick assembly carbon fiber. In fact, we are completing our demonstrator aircraft right now and will have it ready to show at Airventure. We expect a formal rollout in late June, so stay tuned. We plan to offer components, subkits, kits, and fully assembled FAR 103 legal airplanes.

A New Day; A New President; A New Business

As of January 1, 2009, I became a consultant to the business I used to own. I continue to help WiebeTech with a variety of issues, including customer contacts, trade shows and with product ideas, but I'm no longer a full time employee or an owner.

I am grateful to several different individuals for the events of the past 15 months:

First of all, my wife. Kathy has been my unending support and partner. She helped build WiebeTech with me, and continues to share and build dreams with me. Kathy also used to work for WiebeTech. She is now involved with CASA and also starts a new position as a lecturer/instructor for Wichita State University, where she starts a class in entrepreneurship tomorrow.

Second of all, my father-in-law, Pres Huston. Pres provided love for all his family members, and he loved me fiercely, for which I am grateful. I grew up without a dad, and he provided what I did not have when I was a child. He provided principles, capital, wisdom and guidance for WiebeTech when it was barely an idea. I miss him; he passed away in August of 2007.

Third of all, my friend, Bob Ring. Bob also provided capital and guidance to me, although much of what I applied at WiebeTech I learned from Bob many years ago, long before WiebeTech came into being.

Bob once noted that where I ended up at WiebeTech was not where I started, and this was true. My original work at WiebeTech was aimed at developing music compression software. I developed an exceptional algorithm for tight compression of audio; and I discovered that occasionally a great idea is destroyed by an inability to find a channel to the marketplace. Ultimately, I took WiebeTech into the storage business, and then into the forensic side of the storage business.

I am also grateful to Randy Barber, CEO of CRU/WiebeTech, who acquired our business. Randy is a sharp, decent man. He negotiated a fair deal, and he did what he said he would do, when he said he would do it. Many in the world of business acquisitions fail to deliver on their promises; Randy has been superb. I am continuing to work with Randy.

I've come to know so any WiebeTech customers -- what a great group of people. It's good news that I will continue to see many of you on behalf of WiebeTech. I especially enjoy WiebeTech's customers in Washington, DC. Thank you!

A few quick names: The following employees were foundational in getting WiebeTech off the ground: Michael Gaskins; Lora Murray; Mark McClain; Carol Heier; Jeff Hedlesky. Also, Justin Lauzet and Bill Head. Thanks!

WiebeTech can always be found at www.wiebetech.com

Outside of work, I have some others who are very important to me: my pastor -- Ben Staley, Northridge Friends Church, where I am head trustee. Ben's a friend, a fishing buddy, and constant encourager.

Speaking of pastors, another who is important to me is Mike Andrews, former Wichita resident, and current pastor of Belleview Community Church. Mike is a passionate follower of Christ and nearly as passionate as a flyfisherman and wilderness camper. Mike has been able to be my candid friend and occasional spiritual counselor. Thanks, Mike.

Another close friend is Jason Trego, a doctor who currently lives in Africa. My first adventures where with Jason. He's lost money by investing in me, but he's forgiven my past failures and has always been there (except when he's not, due to the distance...)

Now -- on to what I am doing now.

I mentioned to my wife a few weeks ago that I wanted to start a new business in timing with the inaugaration of President Barack Obama. That happened today, and here I am, making my first post on my new business.

I'm doing three different things. I'm convinced that one of these three will provide a marketable product. I'm not sure which will work out; and I'm very aware that the final outcome (product) may bear no resemblance to what I'm actually working on now.

A few weeks ago, I leased a space to start this business development. I've converted a 2000 square foot warehouse into a workshop; and I'm developing an airplane in that workshop. This is one of the three big ideas, and the only one which I am willing to discuss. This idea may cause you to think that I am audaciously off center; and perhaps I am:

1) There is an economic problem in the world.
2) Aircraft sales are dropping. Markets are stalled and moving backwards.
3) I have limited capital; aircraft development takes inordinate amounts.
4) I do not have a background in aeroengineering.
5) (However, I am a pilot, and I do love to fly).

Stick with me, read this blog, watch me succeed, watch me fail -- watch how my ideas mutate into marketable products. I'll pay occasional attention to the new policies of President Obama, and how they help or hurt my efforts.

Kind Regards,

James Wiebe

BitLocker for the forensic investigator

Welcome back to my monologue on Vista BitLocker, specifically written for the forensic investigator.

BitLocker provides three modes of operation, which are implemented in four different options. The first two modes require a cryptographic hardware chip called a Trusted Platform Module (TPM), along with a compatible BIOS. BitLocker may be present in Enterprise or Ultimate versions of Vista. As Vista gains corporate acceptance, (and as users up-purchase to the most deluxe Vista computers) these are the most likely versions which might be encountered, so it is likely that BitLocker capabilities are lurking in the computer. 'Bad Guys' are likely to use BitLocker to their benefit. The forensic investigator needs to be prepared.

Here's some background on TPM hardware. By searching on the web for TPM, you are likely to quickly stumble on the Intel website, and ultimately, you may end up on the website of STMicroelectronics. They provide an integrated circuit which is the hardware basis for TPM encryption. A photograph from this family of chips is here. One of the current part # of the chips is ST19NA18; if you see this chip on the motherboard of a computer, it certainly has BitLocker capabilities (and your forensic investigation is likely a day late and a dollar short.) A full matrix of current and future TPM hardware offerings from STM is here. Other silicon manufacturers such as Infineon (part # SLD9630) are also vendors of TPM hardware, and I am confident that others exist. I would appreciate feedback if you run into other vendors of TPM hardware on the motherboards which you encounter.

The current version of TPM is 1.2 or higher.

The hardware implementation of BitLocker is important, as it provides obvious performance benefits to the user, along with some additional slight user satisfaction of knowing that FIPS 140 compatible hardware is involved in the process of encryption.

Now, back to the operating modes of BitLocker. They are Transparent Operation Mode; User authentication Mode (which has TWO options); and USB Key mode. Here are their descriptions:

The first mode is Transparent Operation Mode. This mode exploits the capabilities of the TPM hardware to provide for a transparent user experience. In this mode, the user may not even be aware that his drive is encrypted. The key used for the disk encryption is sealed (encrypted) by the TPM chip and will only be released to the OS loader code if the early boot files appear to be unmodified. The pre-OS components of BitLocker achieve this by implementing a Static Root of Trust Measurement -- a methodology specified by the Trusted Computing Group. ("BitLocker with TPM").

If Transparent Operation Mode is in effect, it will be difficult to remove or image the hard drive for analysis at another location. Any investigative attack on the drive (such as a Linux CD boot or an external USB boot) is likely not to be successful, but if there is a vulnerability in BitLocker, it would be in this mode of operation. Microsoft admits that this mode is vulnerable to hardware attacks.

The Transparent Operation Mode utilizes a series of cascading event points, as illustrated:



(The above chart copied from a Powerpoint presentation on Microsoft's website.)

An interesting sidepoint which may be deduced from is that BitLocker is NOT the same as Whole Disk Encryption. BitLocker maintains a small segment of the disk 'in the clear' in order to store early boot stuff. Without somewhere to store boot time code that is BitLocker/Transparent mode capable, BitLocker could not work. Consider the sequence of events which occurs at boot time:

1. Hard drive is accessed by the BIOS and code is returned/executed in the clear, without encryption.

2. This code verifies that the environment is OK; as a result a Storage Root Key is retrieved from encrypted storage within the TPM. This key gives access to the root of the encrypted OS Volume.

3. Thereafter, an encrypted key is retrieved from the root of the OS Volume. This new key is the Full Volume Encryption Key and provides access, as its name suggests, to the Full Volume.

We will now discuss the User Authentication Mode. This mode requires that the user provide some authentication to the pre-boot environment in order to be able to boot the OS. Two authentication modes are supported -- a pre-boot PIN entered by the user or a USB device that contains the required startup key. These two options are called "BitLocker with TPM and PIN" or "BitLocker with TPM and USB device".

These modes build on Transparent mode by requiring authentication. If only a PIN is required, the user's protection is limited to the capabilities of TPM (which are impressive) along with the ability to maintain security of the PIN. The temptation to use this mode of operation will be high, and it allows maximum opportunity for the properly forewarned investigator to deduce, hunt, search, or demand under warrant the PIN.

The other option of this mode simply places the PIN on a USB device. This allows even greater opportunities for the forensic investigator to find the PIN, simply by paying careful attention to USB devices.

The final mode of operation used by BitLocker is the "BitLocker with USB Key device" mode. You may be thinking that I have just copied a mode which I just described in the prior paragraphs. No, I did not. In this mode, there is no TPM hardware. All of the encryption is performed using software. The USB Key forces the user to maintain a key which is not part of the boot volume. As a result, BitLocker may be installed within any Vista computer; even without special hardware.

Microsoft makes the following comment on this form of BitLocker: "BitLocker provides support for full-volume encryption on computers that do not have the TPM 1.2 chip. Although the additional protection that the TPM provides is not present with this option, many organizations that require a basic encryption solution may find the BitLocker with USB device option satisfactory when combined with policies such as strong user account passwords and the Prompt for password when computer resumes from sleep or hibernate setting."

I am confident that Microsoft has not installed a backdoor to BitLocker. They have made this specific claim quite loudly and publicly.

Conclusions, with a forensic viewpoint:

1) Is BitLocker present? It is abundantly clear that any computer with Vista may have BitLocker.

2) Stabilize the computer. In the event of a sudden seizure, the forensic investigator needs to prevent computers from going to sleep or hibernating. Blatant, but honest advertisement right here: This may be accomplished with WiebeTech's 'Mouse Jiggler'. $29.95. It may also be accomplished by continuously moving the mouse.

3) Search for Keys. Specifically, find the user's USB key BitLocker. Alternatively, find his/her PIN code.

4) Image the computer. This may be performed prior to shutting the computer down, while the current user session is still in process, and BitLocker has not shut access to the disk. (You haven't let the computer go to sleep, have you?)

5) Consider removing the powered up computer to a secure location, utilizing WiebeTech's 'HotPlug'. (OK, that was also a blatant advertisement.)

If you feel I have left anything out of this discussion, or have disagreement with any point, please email me at james@wiebetech.com I welcome all feedback.