First Flight Belite Aircraft

On Thursday June 25, around 2:00 pm, the new Belite Aircraft had its first flight.

OK, the flight was just a short hop, just over the runway at Jabara airport (KAAO). Temperature was around 100 degrees, with a calculated density altitude of 4500 feet. HOT!

The flight demonstrated liftoff, verification of control effectiveness, power cut, and landing. As soon as the plane took off, it was easily demonstrating a nice climb rate. My plan for this flight did not allow for any pattern work, so I immediately chopped power and settled back to the runway.

Here are some specific details on this flight:

Empty Weight (no fuel): approximately 231.5 pounds includes 13 pounds ballast!!

As flown with fuel: approximately 240 pounds

This includes basic instrumentation, AND it includes approximately 12 pounds of metal ballast in the engine mount design. The plane is so light that we had a CG tail heavy problem. This will be resolved before Oshkosh by utilizing a heavier, more powerful engine.

Therefore, without ballast, weight would have been about 219.5 pounds. Not bad. This flying weight can be reduced further by removing the turtledeck, and even further by cutting corners in the fabric covering (EG, no UV protectant -0- BAD idea). Or by not installing the carpet. (which this plane has). Or by not installing the rear view windows (which this plane has). Or by not installing a wood instrument panel (which this plane has).

Our rollout next Tuesday will show the plane in "dress trim": with a nice cowl on it and a spiffed up engine/engine compartment. Our test flight was without a cowl.

Weight plan to Oshkosh:

We have 34 pounds to play with. (220 pounds effective current weight).

Swap out fuel tank for new fuel tank -- may save 2 pounds.
Swap out engine as we continue to test engines -- adds some weight depending on engine
Add cowl -- adds 3.5 pounds
Put in full panel and electrics, antennas -- estimated to add 9 to 12 pounds

Final Weight, with full panel, electrics, cowl, bigger engine -- about 245 pounds. (Legal limit is 253.9). Of course you can fly it as a home built experimental with any weight you want.

Hope you enjoy the picture as well.

BTW, for the weight calculations, I weigh 200 pounds, and I had about 5 pounds of additional radios & water bottles with me in the airplane.

We do have video of this, we'll try and post it on Monday evening.

Belite Avionics / Instrument Panel Coming Along

We've gotten a lot done in the last couple of weeks.

Engine installation; test run; aircraft weight; cg analysis.

One of the things I'm most pleased with is our panel.

It's a really cool little panel -- everything you need; a little steam; a little digital. A gizmo dock for a Garmin 496.

I'd really appreciate feedback on the layout. We can move a few things around before our rollout next week; we may cut another panel prior to Oshkosh.

Switches are as follows: magneto on/kill; momentary starter (left side).
The four switches are: avionics power; nav lights; landing light; extra switch.

The demo unit has a MicroAir transceiver and a Becker transponder.

Note the fuel gauge as well! :-)

I think I'll add a voltmeter as well.

This panel was cut from birch plywood and will be stained and finished in the next few days.

Interviewed by TV reporter; video on Belite posted

I was interviewed by KAKE TV yesterday on the Belite aircraft.

While the video is a little distilled, it still is a great overview.

The man at the rear is Dave Franson, our publicist.

Here's the story and video.

A picture of a wing for the upcoming Belite Aircraft

Here's a sneek peak of the new wing design for the Belite aircraft. Notice: carbon fiber spar tubes, carbon fiber ribs, carbon fiber false ribs. Also note plywood veneer (0.4mm) which is bonded on top of carbon fiber rib cap strips for purposes of bonding to ceconite covering. Some of the glue joints have been made (EG: rib to spar) while others haven't yet been made. (EG: front false ribs). The entire weight of everything you see here is less than 14 pounds. (Not counting sand bag and level. :-)

Also note the really cool wing work benches we made. The stripes are exactly 6 inches apart, and the entire work surface has been leveled.

The end ribs have a solid sheet of carbon fiber bonded to them, for appearance. They are beautiful and they are completely visible, even after the ceconite covering has been finished.

I will have a completed aircraft, along with a completed airframe/wing without covering on display at Airventure. Come take a look!!

Yes, We Did It...

Wichita, KS—June 1, 2009: Wichita, Kansas-based aviation enthusiast and entrepreneur James Wiebe and his wife, Kathy, have acquired the production rights to a previously designed aircraft, the Kitfox Lite, and formed a new business entity, Belite Aircraft, to market it. The airplane will incorporate stronger, lighter carbon fiber components that will allow it to easily meet Federal Aviation Regulation (FAR) Part 103 weight requirements.

The Wiebes, who previously developed and marketed digital forensic computer storage devices as the founders of Wichita-based enterprise, WiebeTech LLC, acquired the tooling, existing parts and manufacturing rights to the aircraft in March of 2009. As a condition of the transaction, they agreed to re-brand the airplane to prevent any confusion with the larger, two-place light sport Kitfox that shares many of the same design features but is owned by another company. Kitfox has recorded more than 4,500 kit sales since its introduction 25 years ago.

An instrument-rated pilot, James Wiebe has applied his creativity and experience to this new venture, developing a proprietary lightweight carbon fiber structure that he is incorporating into the modified airplane’s construction. By converting spars, ribs and struts from steel, wood or aluminum to carbon fiber, he has reduced the airplane’s empty weight to previously unattainable levels, well below the 254-pound limit specified in FAR Part 103 for this type of aircraft.

“This project, which combines my passions for flying and inventing, is exciting on several levels,” Wiebe noted. “From a business perspective, the development and application of our proprietary carbon fiber has lots of potential for other aircraft and in other markets. Its use in this aircraft provides the weight margin that will allow enthusiasts to build it and enjoy the fun of flying it safely and economically. Our proprietary carbon fiber process builds quickly, far faster than aluminum, wood or composite construction. We expect this aircraft to be a practical and popular choice among light sport aircraft,” he added.

Wiebe indicated that he plans to incorporate a number of additional modifications into the design that will further improve the airplane’s performance and versatility. He has reserved exhibit spaces 612 and 615 in the North Display area at the upcoming Experimental Aircraft Association AirVenture 2009 in Oshkosh, Wisconsin and expects to have an aircraft on display at the show. Additional announcements regarding availability and pricing are expected at that time.

# # # #

Tooling purchased; redesign underway.

I am enjoying designing my new airplane!! I'll have much more news soon.

Our fuselage is being built on the tooling which we purchased. (This tooling was used to build the Kitfox Lite a long time ago... long story.)

We are in the process of redesigning the wing to utilize ultralight, ultrastrong, quick assembly carbon fiber. In fact, we are completing our demonstrator aircraft right now and will have it ready to show at Airventure. We expect a formal rollout in late June, so stay tuned. We plan to offer components, subkits, kits, and fully assembled FAR 103 legal airplanes.

A New Day; A New President; A New Business

As of January 1, 2009, I became a consultant to the business I used to own. I continue to help WiebeTech with a variety of issues, including customer contacts, trade shows and with product ideas, but I'm no longer a full time employee or an owner.

I am grateful to several different individuals for the events of the past 15 months:

First of all, my wife. Kathy has been my unending support and partner. She helped build WiebeTech with me, and continues to share and build dreams with me. Kathy also used to work for WiebeTech. She is now involved with CASA and also starts a new position as a lecturer/instructor for Wichita State University, where she starts a class in entrepreneurship tomorrow.

Second of all, my father-in-law, Pres Huston. Pres provided love for all his family members, and he loved me fiercely, for which I am grateful. I grew up without a dad, and he provided what I did not have when I was a child. He provided principles, capital, wisdom and guidance for WiebeTech when it was barely an idea. I miss him; he passed away in August of 2007.

Third of all, my friend, Bob Ring. Bob also provided capital and guidance to me, although much of what I applied at WiebeTech I learned from Bob many years ago, long before WiebeTech came into being.

Bob once noted that where I ended up at WiebeTech was not where I started, and this was true. My original work at WiebeTech was aimed at developing music compression software. I developed an exceptional algorithm for tight compression of audio; and I discovered that occasionally a great idea is destroyed by an inability to find a channel to the marketplace. Ultimately, I took WiebeTech into the storage business, and then into the forensic side of the storage business.

I am also grateful to Randy Barber, CEO of CRU/WiebeTech, who acquired our business. Randy is a sharp, decent man. He negotiated a fair deal, and he did what he said he would do, when he said he would do it. Many in the world of business acquisitions fail to deliver on their promises; Randy has been superb. I am continuing to work with Randy.

I've come to know so any WiebeTech customers -- what a great group of people. It's good news that I will continue to see many of you on behalf of WiebeTech. I especially enjoy WiebeTech's customers in Washington, DC. Thank you!

A few quick names: The following employees were foundational in getting WiebeTech off the ground: Michael Gaskins; Lora Murray; Mark McClain; Carol Heier; Jeff Hedlesky. Also, Justin Lauzet and Bill Head. Thanks!

WiebeTech can always be found at www.wiebetech.com

Outside of work, I have some others who are very important to me: my pastor -- Ben Staley, Northridge Friends Church, where I am head trustee. Ben's a friend, a fishing buddy, and constant encourager.

Speaking of pastors, another who is important to me is Mike Andrews, former Wichita resident, and current pastor of Belleview Community Church. Mike is a passionate follower of Christ and nearly as passionate as a flyfisherman and wilderness camper. Mike has been able to be my candid friend and occasional spiritual counselor. Thanks, Mike.

Another close friend is Jason Trego, a doctor who currently lives in Africa. My first adventures where with Jason. He's lost money by investing in me, but he's forgiven my past failures and has always been there (except when he's not, due to the distance...)

Now -- on to what I am doing now.

I mentioned to my wife a few weeks ago that I wanted to start a new business in timing with the inaugaration of President Barack Obama. That happened today, and here I am, making my first post on my new business.

I'm doing three different things. I'm convinced that one of these three will provide a marketable product. I'm not sure which will work out; and I'm very aware that the final outcome (product) may bear no resemblance to what I'm actually working on now.

A few weeks ago, I leased a space to start this business development. I've converted a 2000 square foot warehouse into a workshop; and I'm developing an airplane in that workshop. This is one of the three big ideas, and the only one which I am willing to discuss. This idea may cause you to think that I am audaciously off center; and perhaps I am:

1) There is an economic problem in the world.
2) Aircraft sales are dropping. Markets are stalled and moving backwards.
3) I have limited capital; aircraft development takes inordinate amounts.
4) I do not have a background in aeroengineering.
5) (However, I am a pilot, and I do love to fly).

Stick with me, read this blog, watch me succeed, watch me fail -- watch how my ideas mutate into marketable products. I'll pay occasional attention to the new policies of President Obama, and how they help or hurt my efforts.

Kind Regards,

James Wiebe

BitLocker for the forensic investigator

Welcome back to my monologue on Vista BitLocker, specifically written for the forensic investigator.

BitLocker provides three modes of operation, which are implemented in four different options. The first two modes require a cryptographic hardware chip called a Trusted Platform Module (TPM), along with a compatible BIOS. BitLocker may be present in Enterprise or Ultimate versions of Vista. As Vista gains corporate acceptance, (and as users up-purchase to the most deluxe Vista computers) these are the most likely versions which might be encountered, so it is likely that BitLocker capabilities are lurking in the computer. 'Bad Guys' are likely to use BitLocker to their benefit. The forensic investigator needs to be prepared.

Here's some background on TPM hardware. By searching on the web for TPM, you are likely to quickly stumble on the Intel website, and ultimately, you may end up on the website of STMicroelectronics. They provide an integrated circuit which is the hardware basis for TPM encryption. A photograph from this family of chips is here. One of the current part # of the chips is ST19NA18; if you see this chip on the motherboard of a computer, it certainly has BitLocker capabilities (and your forensic investigation is likely a day late and a dollar short.) A full matrix of current and future TPM hardware offerings from STM is here. Other silicon manufacturers such as Infineon (part # SLD9630) are also vendors of TPM hardware, and I am confident that others exist. I would appreciate feedback if you run into other vendors of TPM hardware on the motherboards which you encounter.

The current version of TPM is 1.2 or higher.

The hardware implementation of BitLocker is important, as it provides obvious performance benefits to the user, along with some additional slight user satisfaction of knowing that FIPS 140 compatible hardware is involved in the process of encryption.

Now, back to the operating modes of BitLocker. They are Transparent Operation Mode; User authentication Mode (which has TWO options); and USB Key mode. Here are their descriptions:

The first mode is Transparent Operation Mode. This mode exploits the capabilities of the TPM hardware to provide for a transparent user experience. In this mode, the user may not even be aware that his drive is encrypted. The key used for the disk encryption is sealed (encrypted) by the TPM chip and will only be released to the OS loader code if the early boot files appear to be unmodified. The pre-OS components of BitLocker achieve this by implementing a Static Root of Trust Measurement -- a methodology specified by the Trusted Computing Group. ("BitLocker with TPM").

If Transparent Operation Mode is in effect, it will be difficult to remove or image the hard drive for analysis at another location. Any investigative attack on the drive (such as a Linux CD boot or an external USB boot) is likely not to be successful, but if there is a vulnerability in BitLocker, it would be in this mode of operation. Microsoft admits that this mode is vulnerable to hardware attacks.

The Transparent Operation Mode utilizes a series of cascading event points, as illustrated:



(The above chart copied from a Powerpoint presentation on Microsoft's website.)

An interesting sidepoint which may be deduced from is that BitLocker is NOT the same as Whole Disk Encryption. BitLocker maintains a small segment of the disk 'in the clear' in order to store early boot stuff. Without somewhere to store boot time code that is BitLocker/Transparent mode capable, BitLocker could not work. Consider the sequence of events which occurs at boot time:

1. Hard drive is accessed by the BIOS and code is returned/executed in the clear, without encryption.

2. This code verifies that the environment is OK; as a result a Storage Root Key is retrieved from encrypted storage within the TPM. This key gives access to the root of the encrypted OS Volume.

3. Thereafter, an encrypted key is retrieved from the root of the OS Volume. This new key is the Full Volume Encryption Key and provides access, as its name suggests, to the Full Volume.

We will now discuss the User Authentication Mode. This mode requires that the user provide some authentication to the pre-boot environment in order to be able to boot the OS. Two authentication modes are supported -- a pre-boot PIN entered by the user or a USB device that contains the required startup key. These two options are called "BitLocker with TPM and PIN" or "BitLocker with TPM and USB device".

These modes build on Transparent mode by requiring authentication. If only a PIN is required, the user's protection is limited to the capabilities of TPM (which are impressive) along with the ability to maintain security of the PIN. The temptation to use this mode of operation will be high, and it allows maximum opportunity for the properly forewarned investigator to deduce, hunt, search, or demand under warrant the PIN.

The other option of this mode simply places the PIN on a USB device. This allows even greater opportunities for the forensic investigator to find the PIN, simply by paying careful attention to USB devices.

The final mode of operation used by BitLocker is the "BitLocker with USB Key device" mode. You may be thinking that I have just copied a mode which I just described in the prior paragraphs. No, I did not. In this mode, there is no TPM hardware. All of the encryption is performed using software. The USB Key forces the user to maintain a key which is not part of the boot volume. As a result, BitLocker may be installed within any Vista computer; even without special hardware.

Microsoft makes the following comment on this form of BitLocker: "BitLocker provides support for full-volume encryption on computers that do not have the TPM 1.2 chip. Although the additional protection that the TPM provides is not present with this option, many organizations that require a basic encryption solution may find the BitLocker with USB device option satisfactory when combined with policies such as strong user account passwords and the Prompt for password when computer resumes from sleep or hibernate setting."

I am confident that Microsoft has not installed a backdoor to BitLocker. They have made this specific claim quite loudly and publicly.

Conclusions, with a forensic viewpoint:

1) Is BitLocker present? It is abundantly clear that any computer with Vista may have BitLocker.

2) Stabilize the computer. In the event of a sudden seizure, the forensic investigator needs to prevent computers from going to sleep or hibernating. Blatant, but honest advertisement right here: This may be accomplished with WiebeTech's 'Mouse Jiggler'. $29.95. It may also be accomplished by continuously moving the mouse.

3) Search for Keys. Specifically, find the user's USB key BitLocker. Alternatively, find his/her PIN code.

4) Image the computer. This may be performed prior to shutting the computer down, while the current user session is still in process, and BitLocker has not shut access to the disk. (You haven't let the computer go to sleep, have you?)

5) Consider removing the powered up computer to a secure location, utilizing WiebeTech's 'HotPlug'. (OK, that was also a blatant advertisement.)

If you feel I have left anything out of this discussion, or have disagreement with any point, please email me at james@wiebetech.com I welcome all feedback.

Whole Disk Encryption, for the forensic investigator

Portions of this post have been part of my presentation at the NIST Techno Forensics show.

Forensic investigators must deal with issues associated with encryption and password protection. Several companies, such as AccessData, market effective tools for dealing with password protection issues. I have witnessed demonstrations where password cracking software is able to extract user passwords (especially in a typical Windows XP environment). However, Whole Disk Encryption (WDE) is a completely new situation.

WDE is present in Windows Vista, and is also present natively in certain new kinds of hard drives. When used within Windows Vista, it is called 'BitLocker'.

Bitlocker is a collection of technologies and tools that allow users to encrypt any hard drive volume plugged into their Vista-powered computer system. It is very powerful encrypting technology, using a state of the art AES encrypting variant with 48 digit passwords.

Microsoft is in the process of having it certified to FIPS140-2, which is an extremely tough US data security / cryptographic standard. NIST maintains a very nice document which shows the current status of the effort, and I have bookmarked it here. I checked it earlier this morning, and it was last updated in late January.

Bitlocker is only available in the Enterprise and Ultimate editions of Vista. It is also in Server 2008, where Microsoft indicates it is an optional component.

Bitlocker invokes at the obvious times: for instance, at startup, or after screen savers, sleep or hibernation modes have been engaged. As a result, it provides formidable obstacles to forensic investigators. If invoked, it will stop forensic acquisition of drive contents dead in its tracks.

The reason that Bitlocker is so powerful (and nasty) is that its underlying technology uses a well established cipher (AES in CBC mode) with a new component called an Elephant diffuser. The diffuser adds some new encryption properties which are desirable in the disk encryption setting but not included in the AES-CBC cipher method. I will explain both the CBC mode and the Elephant diffuser, in turn.

CBC is particularly effective because each block of plaintext will have a different encrypted outcome. This is because each block is dependent on prior blocks. As a result, two identical blocks of plaintext into the encryption will have different outcomes. I found a website with a particularly nice description of this feature, here. The downside to CBC is that corruption in prior blocks will render consequent blocks unreadable.

The Elephant diffuser is a Microsoft trick for improving what is already nearly perfect. Essentially, it operates as an inline encrypter/decrypter that functions ahead of the AES-CBC cipher. Microsoft's argument is that even if it is broken, AES-CBC remains functional for all the encryption. Another way of saying it is that two encrypters are better than one. If you'd like to read Microsoft's argument, you can do so here. Another good independent commentary on this trick can be found here.

That's enough post for today. In my next post, I intend to cover Bitlocker modes of operation and options thereof.

How do forensic investigators seize and analyze a computer without turning it off?

The nightmare scenario for today's modern digital forensic investigator is the seizure of a computer with strong incriminating evidence contained on its hard drive. After seizure, but prior to investigation of the drive, the computer is turned off and removed to another location. The nightmare begins when the forensic investigator realizes that the computer was password protected and encrypted; and the perp won't provide the password (or the perp is nowhere to be found!).

Think it can't happen? It just did. Read this from a recent newspaper account:

"FEDS WANT PASSWORD TO UNLOCK COMPUTER FILES".

WASHINGTON -- The federal government is asking a US District Court in Vermont to order a man to type a password that would unlock files on his computer, despite his claim that doing so would constitute self-incrimination.

The case, believed to be the first of its kind to reach this level, raises a uniquely digital-age question about how to balance privacy and civil liberties against the government's responsibility to protect the public.

The case, which involves suspected possession of child pornography, comes as more Americans turn to encryption to protect the privacy and security of files on their personal computers and thumb drives.

FBI and Justice Department officials, meanwhile, have said that encryption is allowing terrorists and criminals to communicate their plots covertly.

The original article may be found on the Washinton Post's website, in it's entirety, here.

The use of WiebeTech's 'HOTPLUG' device allows forensic criminal investigators (along with our companion product, 'Mouse Jiggler') to stabilize a computer, prevent it from going to sleep, examine it, and if necessary, relocate it to a secure location without ever powering the computer down. This is real technology, it works, and it's available now.

Go ahead and look at the links. You'll see technical information on how to use Hotplug and Mouse Jiggler, along with a couple of nifty Youtube videos that demonstrate Hotplug in action.