Malware Devil

Sunday, October 18, 2020

Network Security News Summary for Monday October 19 2020

A brief daily summary of what is important in cybersecurity. The podcast is published every weekday and designed to get you ready for the day with a brief, usually about 5 minutes long, summary of current network security-related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Storm Center. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

The post Network Security News Summary for Monday October 19 2020 appeared first on Malware Devil.



https://malwaredevil.com/2020/10/18/network-security-news-summary-for-monday-october-19-2020/?utm_source=rss&utm_medium=rss&utm_campaign=network-security-news-summary-for-monday-october-19-2020

File Selection Gaffe, (Sun, Oct 18th)

Have you ever sent out the wrong file? I know it has happened to me, attaching the wrong file to an email.

And it happens to malicious actors too.

A reader sent us a malicious email with an attachment: PURCHASE ORDER.mmp

You must be thinking the same as me: what is an .mmp file? Microsoft Project? No, that seems to be .mpp.

Looking at it with a binary editor, it does seem to be some kind op project file:

I searched further for strings that might give me a clue, and found this:

Gammadyne Mailer is email marketing software.

This malicious actor sent out the project file for their mailing campaign!

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Read More

The post File Selection Gaffe, (Sun, Oct 18th) appeared first on Malware Devil.



https://malwaredevil.com/2020/10/18/file-selection-gaffe-sun-oct-18th/?utm_source=rss&utm_medium=rss&utm_campaign=file-selection-gaffe-sun-oct-18th

DEF CON 28 Safe Mode AppSec Village – Fredrick “Flee” Lee’s ‘What Bruce Lee Can Teach Us About AppSec’

Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!

Permalink

The post DEF CON 28 Safe Mode AppSec Village – Fredrick “Flee” Lee’s ‘What Bruce Lee Can Teach Us About AppSec’ appeared first on Security Boulevard.

Read More

The post DEF CON 28 Safe Mode AppSec Village – Fredrick “Flee” Lee’s ‘What Bruce Lee Can Teach Us About AppSec’ appeared first on Malware Devil.



https://malwaredevil.com/2020/10/18/def-con-28-safe-mode-appsec-village-fredrick-flee-lees-what-bruce-lee-can-teach-us-about-appsec/?utm_source=rss&utm_medium=rss&utm_campaign=def-con-28-safe-mode-appsec-village-fredrick-flee-lees-what-bruce-lee-can-teach-us-about-appsec

Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WEEK 299’

via   the respected information security capabilities of  Robert M. Lee   & the superlative illustration talents of  Jeff Haas  at  Little Bobby Comics .

via the respected information security capabilities of Robert M. Lee & the superlative illustration talents of Jeff Haas at Little Bobby Comics.

Permalink

The post Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WEEK 299’ appeared first on Security Boulevard.

Read More

The post Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WEEK 299’ appeared first on Malware Devil.



https://malwaredevil.com/2020/10/18/robert-m-lees-jeff-haas-little-bobby-comics-week-299/?utm_source=rss&utm_medium=rss&utm_campaign=robert-m-lees-jeff-haas-little-bobby-comics-week-299

Twitter Breaches, MFAs, and the Need for Identity Proofing

National Cybersecurity Awareness Month (NCAM) was initially launched in October of 2003 through a collaboration between the U.S. Department of Homeland Security and the National Cyber Security Alliance (NCSA).  Together, they have been

The post Twitter Breaches, MFAs, and the Need for Identity Proofing appeared first on SecZetta.

The post Twitter Breaches, MFAs, and the Need for Identity Proofing appeared first on Security Boulevard.

Read More

The post Twitter Breaches, MFAs, and the Need for Identity Proofing appeared first on Malware Devil.



https://malwaredevil.com/2020/10/18/twitter-breaches-mfas-and-the-need-for-identity-proofing/?utm_source=rss&utm_medium=rss&utm_campaign=twitter-breaches-mfas-and-the-need-for-identity-proofing

DEF CON 28 Safe Mode Appsec Village – Jarrod Overson’s ‘Hackium A Browser For Web Hackers’

Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!

Permalink

The post DEF CON 28 Safe Mode Appsec Village – Jarrod Overson’s ‘Hackium A Browser For Web Hackers’ appeared first on Security Boulevard.

Read More

The post DEF CON 28 Safe Mode Appsec Village – Jarrod Overson’s ‘Hackium A Browser For Web Hackers’ appeared first on Malware Devil.



https://malwaredevil.com/2020/10/18/def-con-28-safe-mode-appsec-village-jarrod-oversons-hackium-a-browser-for-web-hackers/?utm_source=rss&utm_medium=rss&utm_campaign=def-con-28-safe-mode-appsec-village-jarrod-oversons-hackium-a-browser-for-web-hackers

Google Workspace vs. Microsoft 365

Whether you use Google Workspace or Microsoft 365, JumpCloud manages their identities for free through a single cloud directory platform.

The post Google Workspace vs. Microsoft 365 appeared first on JumpCloud.

The post Google Workspace vs. Microsoft 365 appeared first on Security Boulevard.

Read More

The post Google Workspace vs. Microsoft 365 appeared first on Malware Devil.



https://malwaredevil.com/2020/10/18/google-workspace-vs-microsoft-365/?utm_source=rss&utm_medium=rss&utm_campaign=google-workspace-vs-microsoft-365

State CIOs Lead Digital Transformation During the Pandemic

As NASCIO concluded its annual conference virtually this past week, an extensive list of deliverables offered road maps for 2021 and beyond. Member profiles for all 50 states can be found at this interactive website, and an encouraging aspect to this year’s virtual event was the excellent level of participation from the states and U.S…

The post State CIOs Lead Digital Transformation During the Pandemic appeared first on Security Boulevard.

Read More

The post State CIOs Lead Digital Transformation During the Pandemic appeared first on Malware Devil.



https://malwaredevil.com/2020/10/18/state-cios-lead-digital-transformation-during-the-pandemic/?utm_source=rss&utm_medium=rss&utm_campaign=state-cios-lead-digital-transformation-during-the-pandemic

Beyond good ol’ Run key, Part 129

Browsing through windows libraries I came across a few that had an intriguingly named function being resolved during run-time: DllBidEntryPoint. The libraries referencing this API are: msado15.dll msadomd.dll msadox.dll msadrh15.dll […]
Read More

The post Beyond good ol’ Run key, Part 129 appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/beyond-good-ol-run-key-part-129-2/?utm_source=rss&utm_medium=rss&utm_campaign=beyond-good-ol-run-key-part-129-2

Saturday, October 17, 2020

Beyond good ol’ Run key, Part 129

Browsing through windows libraries I came across a few that had an intriguingly named function being resolved during run-time: DllBidEntryPoint.

The libraries referencing this API are:

  • msado15.dll
  • msadomd.dll
  • msadox.dll
  • msadrh15.dll
  • msadce.dll
  • msadco.dll
  • msadds.dll
  • msdaprst.dll
  • msdarem.dll
  • msdaora.dll
  • msdasql.dll
  • msdatl3.dll
  • oledb32.dll
  • sqloledb.dll

As usual, the first thing was to go to Google and soon I discovered that it’s a part of a documented tracing interface used by SQL Server called Built-in Diagnostics (BID).

One can use one of these keys:

  • HKLMSoftwareMicrosoftBidInterfaceLoader
  • HKEY_LOCAL_MACHINEsoftwareWow6432NodeMicrosoftBidInterfaceLoader

and add ‘:Path ‘ value name pointing to a DLL that will act as a tracing DLL.

As usual, the linked document contains all the gore details.

Read More

The post Beyond good ol’ Run key, Part 129 appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/beyond-good-ol-run-key-part-129/?utm_source=rss&utm_medium=rss&utm_campaign=beyond-good-ol-run-key-part-129

Hundreds of Live Phishing Sites Menacing Amazon Prime Day Shoppers

This week, Amazon Prime Day prompted a big increase in phishing attacks, as reported by Threatpost and many other media outlets. Shoppers anxiously awaited the amazing offers and discounts revealed during the two-day sale, with bad actors lying in wait to take advantage of the excitement. SlashNext Threat Labs analyzes 1B internet transactions and 7M web pages […]

The post Hundreds of Live Phishing Sites Menacing Amazon Prime Day Shoppers appeared first on Security Boulevard.

Read More

The post Hundreds of Live Phishing Sites Menacing Amazon Prime Day Shoppers appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/hundreds-of-live-phishing-sites-menacing-amazon-prime-day-shoppers/?utm_source=rss&utm_medium=rss&utm_campaign=hundreds-of-live-phishing-sites-menacing-amazon-prime-day-shoppers

DEF CON 28 Safe Mode Appsec Village – Kelley Robinson’s ‘2FA In 2020 And Beyond’

Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!

Permalink

The post DEF CON 28 Safe Mode Appsec Village – Kelley Robinson’s ‘2FA In 2020 And Beyond’ appeared first on Security Boulevard.

Read More

The post DEF CON 28 Safe Mode Appsec Village – Kelley Robinson’s ‘2FA In 2020 And Beyond’ appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/def-con-28-safe-mode-appsec-village-kelley-robinsons-2fa-in-2020-and-beyond/?utm_source=rss&utm_medium=rss&utm_campaign=def-con-28-safe-mode-appsec-village-kelley-robinsons-2fa-in-2020-and-beyond

XKCD ‘Chemist Eggs’

via  the comic delivery system monikered  Randall Munroe  resident at  XKCD !

via the comic delivery system monikered Randall Munroe resident at XKCD!

Permalink

The post XKCD ‘Chemist Eggs’ appeared first on Security Boulevard.

Read More

The post XKCD ‘Chemist Eggs’ appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/xkcd-chemist-eggs/?utm_source=rss&utm_medium=rss&utm_campaign=xkcd-chemist-eggs

CVE-2020-5135 – Buffer Overflow in SonicWall VPNs – Patch Now, (Sat, Oct 17th)

Discovered by Tripwire VERT, CVE-2020-5135 is a buffer overflow vulnerability in the popular SonicWall Network Security Appliance (NSA) which can permit an unauthenticated bad guy to execute arbitrary code on the device.

The following versions of SonicWall are vulnerable:
SonicOS 6.5.4.6-79n and earlier
SonicOS 6.5.1.11-4n and earlier
SonicOS 6.0.5.3-93o and earlier
SonicOSv 6.5.4.4-44v-21-794 and earlier
SonicOS 7.0.0.0-1

After some research, I am unclear how many devices may be vulnerable to this attack. Tenable/Tripwire implies it could be up to approximately 800,000 devices (as detected by Shodan).  

I expect that not all of these devices have the VPN enabled, and some have been updated already, so the number is probably quite a bit lower, but still significant. 

I have not been able to find a way to remotely detect which devices are vulnerable.  Nmap can be used to detect SonicWall instances, but does not provide enough information to determine the OS version or probe for the vulnerability.

PORT      STATE    SERVICE        REASON         VERSION
80/tcp    open     http-proxy     syn-ack ttl 53 SonicWALL SSL-VPN http proxy
|_http-server-header: SonicWALL SSL-VPN Web Server
443/tcp   open     ssl/http-proxy syn-ack ttl 53 SonicWALL SSL-VPN http proxy
|_http-server-header: SonicWALL SSL-VPN Web Server
50001/tcp filtered unknown        no-response

If any of you know of a reliable scanning technique to detect this vulnerability please let me know at our contact page and I will update the diary.

SonicWall released updates last week which fix this vulnerability and several others. Although no known exploit has been detected in the wild.  I expect, give recent historical attacks on VPNs, I would expect this one will get a lot of interest from bad guys. I strongly recommend updating as soon as reasonable.

More information can be found at the following links:
https://www.bleepingcomputer.com/news/security/critical-sonicwall-vulnerability-affects-800k-firewalls-patch-now/
https://www.tripwire.com/state-of-security/vert/sonicwall-vpn-portal-critical-flaw-cve-2020-5135/
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0010

 

— Rick Wanner MSISE – rwanner at isc dot sans dot edu – http://namedeplume.blogspot.com/ – Twitter:namedeplume (Protected)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Read More

The post CVE-2020-5135 – Buffer Overflow in SonicWall VPNs – Patch Now, (Sat, Oct 17th) appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/cve-2020-5135-buffer-overflow-in-sonicwall-vpns-patch-now-sat-oct-17th/?utm_source=rss&utm_medium=rss&utm_campaign=cve-2020-5135-buffer-overflow-in-sonicwall-vpns-patch-now-sat-oct-17th

DEF CON 28 Safe Mode Appsec Village – Maddie Stone’s ‘Who’s Secure Who’s Not: Who Makes That Choice’

Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!

Permalink

The post DEF CON 28 Safe Mode Appsec Village – Maddie Stone’s ‘Who’s Secure Who’s Not: Who Makes That Choice’ appeared first on Security Boulevard.

Read More

The post DEF CON 28 Safe Mode Appsec Village – Maddie Stone’s ‘Who’s Secure Who’s Not: Who Makes That Choice’ appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/def-con-28-safe-mode-appsec-village-maddie-stones-whos-secure-whos-not-who-makes-that-choice/?utm_source=rss&utm_medium=rss&utm_campaign=def-con-28-safe-mode-appsec-village-maddie-stones-whos-secure-whos-not-who-makes-that-choice

Weekly News Roundup — October 4 to October 17

Hello and welcome to Sec Soup, where the weekly newsletter has a collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

Threat Research 

Tools and Tips

Breaches, Government, and Law Enforcement 

Vulnerabilities and Exploits

Read More

The post Weekly News Roundup — October 4 to October 17 appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/weekly-news-roundup-october-4-to-october-17/?utm_source=rss&utm_medium=rss&utm_campaign=weekly-news-roundup-october-4-to-october-17

Microsoft Testing User Based Windows Setup For Performance Optimization

What do you primarily use your PC for? It’s a more important question than you might think, because different use cases for your PC require it to be configured in different ways to optimize your user experience. Until now, that’s something that each individual user has attended to, making tweaks as necessary to the core Windows setup to make the machine work better. It is all based on how each person uses their machine.

Microsoft wants to start changing that in a bid further enhance user experience. To that end, the company is adding a “customize your device” screen to the Windows setup routine. If you select one of the categories Microsoft has defined, the setup routine will automatically make tweaks and adjustments behind the scenes, leaving you with less to do to optimize your rig.

The following information is based on a recent screen shared by the company’s “Windows Insiders” group.

The predefined categories are:

  • Gaming
  • Family
  • Creativity
  • Schoolwork
  • Entertainment
  • Business

These are generally good options, and it’s easy to see how the company could feather in the automatic installation of any number of apps, based on the selection made. Notably absent from the list, however, is a “Developer” option. Sorry developers, you’re on your own. Although once we know more about what each of these options is and does, it may be the case that the “Business” option covers the needs of developers reasonably well, too.

Overall, it’s a good addition, available to a select group of Windows Insiders right now, in build 20231. Based on their feedback, it will be rolled out to the general public in the months ahead.

Kudos to Microsoft for putting user experience front and center with the change. The company hasn’t always been perfect in that regard, but it’s clear that they’re trying hard to reform, and there’s something to be said for that.

Used with permission from Article Aggregator

Read More

The post Microsoft Testing User Based Windows Setup For Performance Optimization appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/microsoft-testing-user-based-windows-setup-for-performance-optimization/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-testing-user-based-windows-setup-for-performance-optimization

Hosted MDM Solution

Apple requires an MDM solution for Big Sur Macs. Here are the features you should consider in your search for a hosted MDM solution.

The post Hosted MDM Solution appeared first on JumpCloud.

The post Hosted MDM Solution appeared first on Security Boulevard.

Read More

The post Hosted MDM Solution appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/hosted-mdm-solution/?utm_source=rss&utm_medium=rss&utm_campaign=hosted-mdm-solution

DeXRAY 2.22 update

Added Amiti IFC files. It’s not a well-known AV program, but I came across it today and couldn’t resist so … here we are.

The latest version of DeXRAY can be downloaded here.

DeXRAY supports:

  • AhnLab (V3B)
  • Amiti (IFC)
  • ASquared (EQF)
  • Avast (Magic@0=’-chest- ‘)
  • Avira (QUA)
  • Baidu (QV)
  • BitDefender (BDQ)
  • BullGuard (Q)
  • Cisco AMP
  • CMC Antivirus (CMC)
  • Comodo (not really; Quarantined files are not encrypted 🙂
  • ESafe (VIR)
  • ESET (NQF)
  • F-Prot (TMP) (Magic@0=’KSS’)
  • Kaspersky (KLQ, System Watcher’s .bin)
  • Lavasoft AdAware (BDQ) /BitDefender files really/
  • Lumension LEMSS (lqf)
  • MalwareBytes Data files (DATA) – 2 versions
  • MalwareBytes Quarantine files (QUAR) – 2 versions
  • McAfee Quarantine files (BUP) /full support for OLE format/
  • Microsoft Antimalware / Microsoft Security Essentials
  • Microsoft Defender (Magic@0=0B AD|D3 45) – D3 45 C5 99 metadata + 0B AD malicious content
  • Panda Zip files
  • Sentinel One (MAL)
  • Spybot – Search & Destroy 2 ‘recovery’
  • SUPERAntiSpyware (SDB)
  • Symantec ccSubSdk files: {GUID} files and submissions.idx
  • Symantec Quarantine Data files (QBD)
  • Symantec Quarantine files (VBN), including from SEP on Linux
  • Symantec Quarantine Index files (QBI)
  • Symantec Quarantine files on MAC (quarantine.qtn)
  • TrendMicro (Magic@0=A9 AC BD A7 which is a ‘VSBX’ string ^ 0xFF)
  • QuickHeal files
  • Vipre (_ENC2)
  • Zemana files+quarantine.db
  • Any binary file (using X-RAY scanning)

Read More

The post DeXRAY 2.22 update appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/dexray-2-22-update/?utm_source=rss&utm_medium=rss&utm_campaign=dexray-2-22-update

No, that’s not how warrantee expiration works

The NYPost Hunter Biden story has triggered a lot of sleuths obsessing on technical details trying to prove it’s a hoax. So far, these claims are wrong. The story is certainly bad journalism aiming to misinform readers, but it has not yet been shown to be a hoax.

In this post, we look at claim the timelines don’t match up with the manufacturing dates of the drives. Sleuths claim to prove the drives were manufactured after the events in question, based on serial numbers.

What this post will show is that the theory is wrong. Manufacturers pad warrantee periods. Thus, you can’t assume a date of manufacture based upon the end of a warrantee period.

The story starts with Hunter Biden (or associates) dropping off a laptop at a repair shop because of water damage. The repair shop made a copy of the laptop’s hard drive, stored on an external drive. Later, the FBI swooped in and confiscated both the laptop and that external drive.

The serial numbers of both devices are listed in the subpoena published by the NYPost:

You can enter these serial numbers in the support pages at Apple (FVFXC2MMHV29) and Western Digital (WX21A19ATFF3) to discover precisely what hardware this is, and when the warrantee periods expire — and presumably, when they started.

In the case of that external drive, the 3-year warrantee expires May 17, 2022 — meaning the drive was manufactured on May 17, 2019 (or so they claim). This is a full month after the claimed date of April 12, 2019, when the laptop was dropped off at the repair shop.

There are lots of explanations for this. One of which is that the drive subpoenaed by the government (on Dec 9, 2019) was a copy of the original drive.

But a simpler explanation is this: warrant periods are padded by the manufacturer by several months. In other words, if the warrantee ends May 17, it means the drive was probably manufactured in February.

I can prove this. Coincidentally, I purchased a Western Digital drive a few days ago. If we used the same logic as above to work backward from warrantee expiration, then it means the drive was manufactured 7 days in the future.

Here is a screenshot from Amazon.com showing I purchased the drive Oct 12.

Here is a picture of the drive itself, from which you can read the serial number:

The Date of Manufacture (DOM) is printed right on the device as July 31, 2020.

But let’s see what Western Digital reports as the end of warrantee period:

We can see that the warrantee ends on Oct 25, 2025. According to Amazon where I purchased the drive, the warrantee period is 5 years:

Thus, if we were to insist on working back from the expiration date precisely 5 years, then that means this drive was manufactured 7 days in the future. Today’s date is Oct 16, the warrantee starts Oct 23. 

The reality is that Western Digital has no idea when the drive arrives, and hence when I (as the consumer) expect the warrantee period to start. Thus, they pad the period by a few months to account for how long they expect the device to be in the sales channel, the period between manufacture and when they are likely to arrive at the customer. Computer devices rapidly depreciate so are unlikely to be in the channel more than a few months.

Thus, instead of proving the timeline wrong, the serial number and warrantee expiration shows the timeline right. This is exactly the sort of thing you’d expect if the repair shop recovered the files onto a new external drive.

Another issue in the thread is about the “recovery” of files, which the author claims is improbable. In Apple’s latest MacBooks, if the motherboard is damaged, then it’s impractical to recover the data from the drive. These days, in the year 2020, the SSD drive inside notebooks are soldered right on the motherboard, and besides, encrypted with a TPM chip on the motherboard.

But here we are talking about a 2017 MacBook Pro which apparently had a removeable SSD. Other notebooks by Apple have had special connectors for reading SSDs from dead motherboards. Thus, recovery of files for notebooks of that era is not as impossible as a it sounds.

Moreover, maybe the repair shop fixed the notebook. “Water damage” varies in extent. It may have been possible to repair the damage and boot the device, at least in some sort of recovery mode.

Conclusion

Grabbing serial numbers and looking them is exactly what hackers should be doing in stories like this. Challenging the narrative is great — especially with regards to the NYPost story, which is clearly bad journalism.

On the other hand, it goes both ways. We should be even more concerned about challenging those things that agree with us. This is a great example — it appears we’ve found conclusive evidence that the NYPost story was a hoax. We need to carefully challenge that, too.

The post No, that’s not how warrantee expiration works appeared first on Security Boulevard.

Read More

The post No, that’s not how warrantee expiration works appeared first on Malware Devil.



https://malwaredevil.com/2020/10/17/no-thats-not-how-warrantee-expiration-works/?utm_source=rss&utm_medium=rss&utm_campaign=no-thats-not-how-warrantee-expiration-works

Barbary Pirates and Russian Cybercrime

In 1801, the United States had a small Navy. Thomas Jefferson deployed almost half that Navy—three frigates and a schooner—to the Barbary C...