The Angel of Death as an Outsourced Service

Angel of Death in Egypt

The Hagaddah which is recited at the Seder on the first night of Passover retells the biblical story of the infliction of the ten plagues on Egypt and the exodus of the Israelites slaves. One four verse passage referencing chapter 12 in the book of Exodus stands out in the narrative because of the redundant emphasis on who was responsible for these acts:

  1. “I will pass through the land of Egypt”, I and not an angel;
  2. ”And I will smite every first-born in the land of Egypt”, I and not a seraph;
  3. ”And I will carry out judgment against all the gods of Egypt”, I and not a messenger;
  4. ”I G-d”, and none other!

;וְעָבַרְתִּי בְאֶרֶץ מִצְרַיִם בַּלַּיְלָה הַזֶּה – אֲנִי וְלֹא מַלְאָךְ
;וְהִכֵּיתִי כָל בְּכוֹר בְּאֶרֶץ־מִצְרַים. אֲנִי וְלֹא שָׂרָף
;בְכָל־אֱלֹהֵי מִצְרַיִם אֶעֱשֶׂה שְׁפָטִים. אֲנִי וְלֹא הַשָּׁלִיח
.ואֲנִי ה’. אֲנִי הוּא וְלֹא אַחֵר

The 1320 Golden Hagadah P36-37
Image 1: The passage in the Golden Hagaddah circa 1320 CE

The context of the verses makes it clear that G-d alone inflicted the punitive measures and that they were executed directly by Him and not through other intermediaries like an angel, seraph, or messenger. Further support for this can be found in verse 12:12:

“For I will go through the land of Egypt on that night and will smite all the first-born in the land of Egypt, both man and beast; and against all the gods of Egypt I will execute judgment: I am G-d.

וְעָבַרְתִּי בְאֶרֶץ-מִצְרַיִם, בַּלַּיְלָה הַזֶּה, וְהִכֵּיתִי כָל-בְּכוֹר בְּאֶרֶץ מִצְרַיִם, מֵאָדָם וְעַד-בְּהֵמָה; וּבְכָל-אֱלֹהֵי מִצְרַיִם אֶעֱשֶׂה שְׁפָטִים, אֲנִי יְהוָה

But despite this clear and repetitive language regarding G-d’s direct responsibility, some Jewish and Christian scholars argue that the term “destroyer” used in verse 12:23 does not refer to G-d and should instead be read as the “angel of death”. They also postulate that G-d doesn’t act directly or get involved in the ‘hands-on’ day to day minutiae. Thus, he must have been using an agent of some sort to perform this work.

This textual dichotomy has been the source of endless arguments between theologians, translators and scholars. For example, the Pseudo-Jonathan Targum (translation) of Exodus 12 uses both the terms מַלְאָכָא מְחַבְּלָא (Aramaic for “destroying angel”) and מַלְאָךְ מוֹתָא, (Aramaic for the “angel of death”). Obviously, this interpretation suggests that besides G-d there is another entity—angelic or otherwise—with a certain degree of autonomy at work here.

From the contextual point of view, the arguments in favor of an angelic agent raise a number of questions about the role of this “destroyer” and the scope of his responsibility and autonomy. For example, can this destroyer exercise free judgment? Is he constrained by any boundaries?

The Hebrew bible emphasizes the idea that the entire universe falls under G-d’s jurisdiction and that all of nature falls under his control. He is the creator of light and darkness, good and evil. As Genesis 1:31 and Isaiah 45:7 state, He is the creator of all things:

“And G-d saw every thing that He had made, and, behold, it was very good. And there was evening and there was morning, the sixth day.”

וַיַּרְא אֱלֹהִים אֶת-כָּל-אֲשֶׁר עָשָׂה, וְהִנֵּה-טוֹב מְאֹד; וַיְהִי-עֶרֶב וַיְהִי-בֹקֶר, יוֹם הַשִּׁשִּׁי

I form the light, and create darkness; I make peace, and create evil; I am G-d, that doeth all these things.

יוֹצֵר אוֹר וּבוֹרֵא חֹשֶׁךְ, עֹשֶׂה שָׁלוֹם וּבוֹרֵא רָע; אֲנִי יְהוָה, עֹשֶׂה כָל-אֵלֶּה

The scripture also makes it clear that G-d is not dependent on his creation and the creation cannot exist independently of Him. Even Satan’s depiction in Job 1.7 illustrates that he is not a rival of G-d nor does he possess the ability to oppose him in any way, he is just one of many tools that G-d uses to maintain the world in working moral order. Job 1.21 further reinforces the idea that the life and death cycle entirely emanates from G-d:

“And he said; naked came I out of my mother’s womb, and naked shall I return thither; G-d gave, and G-d hath taken away; blessed be the name of G-d.”

וַיֹּאמֶר עָרֹם יָצָתִי מִבֶּטֶן אִמִּי, וְעָרֹם אָשׁוּב שָׁמָּהיְהוָה נָתַן, וַיהוָה לָקָח; יְהִי שֵׁם יְהוָה, מְבֹרָךְ

So if the scripture consistently states that G-d has complete and undisputed sovereignty, what then is the basis for the existence of an independent angelic agent who manages death, destruction, and the afterlife?

Broadly speaking, the source for this argument can be classified into these three categories of references:

  1. Specific scriptural terminology such as: Abaddon, destroyer, messengers of death, angel that destroys, executioner, slayer, angel of G-d, Ashmedai, Satan, the harvester of souls, the angel that smites, serpent, adversary, captain of the host of G-d, leviathan the slant serpent, leviathan the tortuous serpent, and dragon
  2. Allegorical Sources such as: Personification of death in the scripture, messengers of death, Day-Star, cherub that walks on stones of fire, and anointed cherub
  3. Legends and Commentary Sources such as: Testament of Solomon, The Zohar, The Talmud, the book of Tobit, and Thanksgiving Hymns

Specifically, these implied angelic associations can be found in some of the following passages:

Genesis 3:2-5
Now the serpent was more subtle than any beast of the field which G-d had made. And he said unto the woman: ‘Yea, hath G-d said: Ye shall not eat of any tree of the garden?’

וְהַנָּחָשׁ, הָיָה עָרוּם, מִכֹּל חַיַּת הַשָּׂדֶה, אֲשֶׁר עָשָׂה יְהוָה אֱלֹהִים; וַיֹּאמֶר, אֶל-הָאִשָּׁה, אַף כִּי-אָמַר אֱלֹהִים, לֹא תֹאכְלוּ מִכֹּל עֵץ הַגָּן

Exodus 12:23
“For G-d will pass through to smite the Egyptians; and when He seeth the blood upon the lintel, and on the two side-posts, G-d will pass over the door and will not suffer the destroyer to come in unto your houses to smite you.” 

וְעָבַר יְהוָה, לִנְגֹּף אֶת-מִצְרַיִם, וְרָאָה אֶת-הַדָּם עַל-הַמַּשְׁקוֹף, וְעַל שְׁתֵּי הַמְּזוּזֹת; וּפָסַח יְהוָה, עַל-הַפֶּתַח, וְלֹא יִתֵּן הַמַּשְׁחִית, לָבֹא אֶל-בָּתֵּיכֶם לִנְגֹּף

Joshua 3:13-14
And he said: ‘Nay, but I am captain of the host of G-d; I am now come.’ And Joshua fell on his face to the earth, and bowed down, and said unto him: ‘What saith my lord unto his servant?’

וַיֹּאמֶר לֹא, כִּי אֲנִי שַׂר-צְבָא-יְהוָה–עַתָּה בָאתִי; וַיִּפֹּל יְהוֹשֻׁעַ אֶל-פָּנָיו אַרְצָה, וַיִּשְׁתָּחוּ, וַיֹּאמֶר לוֹ, מָה אֲדֹנִי מְדַבֵּר אֶל-עַבְדּוֹ

Zechariah 3:1-2
And he showed me Joshua the high priest standing before the angel of G-d, and Satan standing at his right hand to accuse him.

וַיַּרְאֵנִי, אֶת-יְהוֹשֻׁעַ הַכֹּהֵן הַגָּדוֹל, עֹמֵד, לִפְנֵי מַלְאַךְ יְהוָה; וְהַשָּׂטָן עֹמֵד עַל-יְמִינוֹ, לְשִׂטְנוֹ

Ezekiel 28:13-19
thou wast in Eden the garden of G-d; every precious stone was thy covering, the carnelian, the topaz, and the emerald, the beryl, the onyx, and the jasper, the sapphire, the carbuncle, and the smaragd, and gold; the workmanship of thy settings and of thy sockets was in thee, in the day that thou wast created they were prepared.

בְּעֵדֶן גַּן-אֱלֹהִים הָיִיתָ, כָּל-אֶבֶן יְקָרָה מְסֻכָתֶךָ אֹדֶם פִּטְדָה וְיָהֲלֹם תַּרְשִׁישׁ שֹׁהַם וְיָשְׁפֵה, סַפִּיר נֹפֶךְ, וּבָרְקַת וְזָהָב; מְלֶאכֶת תֻּפֶּיךָ וּנְקָבֶיךָ בָּךְ, בְּיוֹם הִבָּרַאֲךָ כּוֹנָנוּ

Job 1:6-12
Now it fell upon a day, that the sons of G-d came to present themselves before G-d, and Satan came also among them.

וַיְהִי הַיּוֹם–וַיָּבֹאוּ בְּנֵי הָאֱלֹהִים, לְהִתְיַצֵּב עַל-יְהוָה; וַיָּבוֹא גַם-הַשָּׂטָן, בְּתוֹכָם

Job 16:14
The wrath of a king is as messengers of death; but a wise man will pacify it.

חֲמַת-מֶלֶךְ מַלְאֲכֵי-מָוֶת; וְאִישׁ חָכָם יְכַפְּרֶנָּה

Job 33:22
Yea, his soul draweth near unto the pit, and his life to the destroyers.

וַתִּקְרַב לַשַּׁחַת נַפְשׁוֹ; וְחַיָּתוֹ, לַמְמִתִים

Isaiah 14:12
How art thou fallen from heaven, O day-star, son of the morning! How art thou cut down to the ground, that didst cast lots over the nations!

אֵיךְ נָפַלְתָּ מִשָּׁמַיִם, הֵילֵל בֶּן-שָׁחַר; נִגְדַּעְתָּ לָאָרֶץ, חוֹלֵשׁ עַל-גּוֹיִם

Isaiah 27:1
In that day the LORD with His sore and great and strong sword will punish leviathan the slant serpent, and leviathan the tortuous serpent; and He will slay the dragon that is in the sea.

בַּיּוֹם הַהוּא יִפְקֹד יְהוָה בְּחַרְבּוֹ הַקָּשָׁה וְהַגְּדוֹלָה וְהַחֲזָקָה, עַל לִוְיָתָן נָחָשׁ בָּרִחַ, וְעַל לִוְיָתָן, נָחָשׁ עֲקַלָּתוֹן; וְהָרַג אֶת-הַתַּנִּין, אֲשֶׁר בַּיָּם

Isaiah 37:36
And the angel of G-d went forth, and smote in the camp of the Assyrians a hundred and fourscore and five thousand; and when men arose early in the morning, behold, they were all dead corpses.

.וַיֵּצֵא מַלְאַךְ יְהוָה, וַיַּכֶּה בְּמַחֲנֵה אַשּׁוּר, מֵאָה וּשְׁמֹנִים וַחֲמִשָּׁה, אָלֶף; וַיַּשְׁכִּימוּ בַבֹּקֶר, וְהִנֵּה כֻלָּם פְּגָרִים מֵתִים

Proverbs 16:14
The wrath of a king is as messengers of death; but a wise man will pacify it.

חֲמַת-מֶלֶךְ מַלְאֲכֵי-מָוֶת; וְאִישׁ חָכָם יְכַפְּרֶנָּה

Psalm 109:6
Set Thou a wicked man over him; and let an adversary stand at his right hand.

הַפְקֵד עָלָיו רָשָׁע; וְשָׂטָן, יַעֲמֹד עַל-יְמִינוֹ

2 Samuel 24:16
”And when the angel stretched out his hand toward Jerusalem to destroy it, G-d repented Him of the evil, and said to the angel that destroyed the people: ‘It is enough; now stay thy hand.’ And the angel of G-d was by the threshing-floor of Araunah the Jebusite.”

וַיִּשְׁלַח יָדוֹ הַמַּלְאָךְ יְרוּשָׁלִַם, לְשַׁחֲתָהּ, וַיִּנָּחֶם יְהוָה אֶל-הָרָעָה, וַיֹּאמֶר לַמַּלְאָךְ הַמַּשְׁחִית בָּעָם רַב עַתָּה הֶרֶף יָדֶךָ; וּמַלְאַךְ יְהוָה הָיָה, עִם-גֹּרֶן האורנה (הָאֲרַוְנָה) הַיְבֻסִי

Chronicles 21:14-16
So G-D sent a pestilence upon Israel; and there fell of Israel seventy thousand men.

וַיִּתֵּן יְהוָה דֶּבֶר, בְּיִשְׂרָאֵל; וַיִּפֹּל, מִיִּשְׂרָאֵל, שִׁבְעִים אֶלֶף, אִישׁ

And G-d sent an angel unto Jerusalem to destroy it; and as he was about to destroy, G-d beheld, and He repented Him of the evil, and said to the destroying angel: ‘It is enough; now stay thy hand.’ And the angel of G-d was standing by the threshing-floor of Ornan the Jebusite.

וַיִּשְׁלַח הָאֱלֹהִים מַלְאָךְ לִירוּשָׁלִַם, לְהַשְׁחִיתָהּ, וּכְהַשְׁחִית רָאָה יְהוָה וַיִּנָּחֶם עַל-הָרָעָה, וַיֹּאמֶר לַמַּלְאָךְ הַמַּשְׁחִית רַב עַתָּה הֶרֶף יָדֶךָ; וּמַלְאַךְ יְהוָה עֹמֵד, עִם-גֹּרֶן אָרְנָן הַיְבוּסִי

And David lifted up his eyes, and saw the angel of G-d standing between the earth and the heaven, having a drawn sword in his hand stretched out over Jerusalem. Then David and the elders, clothed in sackcloth, fell upon their faces.

וַיִּשָּׂא דָוִיד אֶת-עֵינָיו, וַיַּרְא אֶת-מַלְאַךְ יְהוָה עֹמֵד בֵּין הָאָרֶץ וּבֵין הַשָּׁמַיִם, וְחַרְבּוֹ שְׁלוּפָה בְּיָדוֹ, נְטוּיָה עַל-יְרוּשָׁלִָם; וַיִּפֹּל דָּוִיד וְהַזְּקֵנִים מְכֻסִּים בַּשַּׂקִּים, עַל-פְּנֵיהֶם

II Kings 19:35
And it came to pass that night, that the angel of G-d went forth, and smote in the camp of the Assyrians a hundred fourscore and five thousand; and when men arose early in the morning, behold, they were all dead corpses.

וַיְהִי, בַּלַּיְלָה הַהוּא, וַיֵּצֵא מַלְאַךְ יְהוָה וַיַּךְ בְּמַחֲנֵה אַשּׁוּר, מֵאָה שְׁמוֹנִים וַחֲמִשָּׁה אָלֶף; וַיַּשְׁכִּימוּ בַבֹּקֶר, וְהִנֵּה כֻלָּם פְּגָרִים מֵתִים

Hosha 13:14
Shall I ransom them from the power of the nether-world? Shall I redeem them from death? Ho, thy plagues, O death! Ho, thy destruction, O nether-world! Repentance be hid from Mine eyes!

מִיַּד שְׁאוֹל אֶפְדֵּם, מִמָּוֶת אֶגְאָלֵם; אֱהִי דְבָרֶיךָ מָוֶת, אֱהִי קָטָבְךָ שְׁאוֹל–נֹחַם, יִסָּתֵר מֵעֵינָי

Early Sources
The argument advocating for the concept of an independent destroyer goes back to dawn of Egyptian and Canaanite religions. Egyptian texts that describe Osiris as the god of the dead and the lord of underworld date as early as 2500 BCE. According to passages in the book of the dead, after death, the deceased would face forty-two divine judges that evaluated If he lived in conformance with the guidelines of goddess Ma’at, who represented truth and rightness living. If the they passed the test, they were welcomed into the heavenly kingdom of Osiris. If they failed, they did not share in eternal life and were taken by Ammit, the “devourer” and subjected to terrifying punishments and then thrown to the soul-eating demons in hell.  Sort of Dante’s inferno, Egyptian style.

Ones in hell, the goddess Sekhmet inflicted further punishments on them in the place of “destruction”. The dead were thrown into lakes of fire kindled by flame spitting snakes, where demons fed on the victims entrails and drank their blood. The demons then butchered and hacked their victims to pieces and burned them with inextinguishable fire, in deep pits or in cauldrons, where they were scorched, cooked, and reduced to ashes. 

Egyptian Hell
Image 2: Egyptian view of hell

Not as detailed as the Egyptian book of the dead, the Canaanites developed similar concepts about their god of death and the underworld.

The Canaanite deity Mavet  מָוֶת Mavet (who shares some traits with Osiris), played a central role in the The Baal Cycle written circa 1500 BCE. The hymn describes the god of death and the underworld as a predator with an unsatieted appetite for consuming the living by:

…Mavet (Death) would open His mouth wide.
“A lip to earth,
A lip to heaven,
And a tounge to the stars,
So that Baal may enter His inwards,
Yea, descend into His mouth,
As scorched is the olive,
The produce of the Earth,
And the fruit of the Trees.”

In addition to a detailed description of Mavet’s character and exploits, several other passages in the text detail the rivalry between Baal (the Canaanite equivalent of Zeus) and his brother Mavet (the Canaanite equivalent of Hades). In one example, goddess Anath informs El, the head of the gods about a battle she witnessed between the two deities:

Then Anath went to El, at the source of the rivers, in the middle of the bed of the two oceans.
She bows at the feet of El, she bows and prosternates and pays him respects.
She speaks and says:
“the very mighty Baal is dead.
The prince, lord of the earth, has died” (…)
“They fight like heroes. Mavett wins, Baal wins.
They bit each other like snakes.
Mavett wins, Baal wins.
They jump like horses.
Mavett is scared. Baal sits on his throne”.

In the final part of the Baal cycle, Mavet informs Baal that he, “like a lion in the desert, hungers constantly for human flesh and blood”. Mavet threatens to cause the heavens to wilt and collapse and break Baal into pieces and eat him. Baal is also warned by Shapash, the sun-goddess, about Mavet’s superior power and advises that he submit to him:

Do not draw near the god Mavet,
Lest He make You like a lamb in His mouth,
Like a kid in His jaws Ye be crushed!
The Torch of the gods, Shapash, burns;
The heavens halt on account of El’s darling, Mavet.
By the thousand acres,
Yea the myriad hectares
At the feet of Mavet bow and fall.
Prostrate Yourselves and honor Him!

The goodess Anath Text
Image 3
: Text from the goddess Anath epic referencing Baal’s rivals

The Hebrew Bible View of Death
The Hebrew Bible rejected these polytheistic concepts of an independent god of death and the rivalry between deities. According to Isaiah 45:7, G-d is the only source of both good and evil and is the master of life and death.

Cassuto in his commentary on the Pentateuch argued that the bible was written in the language of the common man, and thus, the personification of death and the allusions to his other emissaries such as the leviathan the slant serpent, leviathan the tortuous serpent, and the dragon as described in Genesis 1:21 and Isaiah 23:1 were remnants of the ideological war that the Hebrew bible waged against the pervasive culture that was infused with these concepts. In opposition to the dominant beliefs of the time, the scripture emphasized the notion that no other entity but G-d possessed the power to create and return man to dust Job 10:9.

A careful reading of the roles of the “destroyer”, “the harvester of souls”, the “angel of the Lord” who “smites” and “destroys” human beings in the scripture shows that they are always temporary messengers with limited scope of operation and windows of opportunity of action. In the few instances where death is personified as in Psalms 49:15; 91:3; Job 18:14, and Proverbs 16:14; 17:11 it is clear that he does not possesses any permanent power nor has the ability to terminate life of his own volition.

The Formation of the Axis of Evil
From a historical prospective, the western concept of an independent angel of death only emerged in the post-biblical period and can be attributed to the fusion of Egyptian, Canaanite, and Greek religions in the Hellenistic world.

This amalgam of deities the likes of Hades, Osiris, and Mavet formed the distinct figure of the angel of death who became associated with the terrifying demons and evil spirits commonly found in the ancient near east literature. By this time, this hybrid deity retained only a tangential association with the biblical concepts of the destroyer as a vehicle for delivering morally driven divine retribution. 

This new manifestation of evil, death, cruelty, and wretchedness also incorporated the concept of the morally deficient, cunning, and deceitful snake from the garden of Eden (Genesis 3:1-14) and after several additions and enhancements such as evil spirits, demons, and Liliths, it appeared in the literature and theology of 2nd century BCE-1st century CE as בְּלִיַעַל‎ Belial. One example dated to the second Temple period found in a Dead Sea Scroll titled the “Songs of the Sage”, contains the following apotropaic prayer: 

“And, I the Sage, declare the grandeur of his radiance in order to frighten and terri[fy] all the spirits of the ravaging angels and the bastard spirits, demons, Liliths, owls”

In another Dead Sea scroll, a fragment entitled “Curses of Belial” contains a reference to Belial בְּלִיַעַל (wicked or worthless), “sons of Belial”, the “angel of the Pit” and a “spirit of destruction” and carries the following curses against him and his lot:

“The Community Council shall say together in unison, ‘Amen. Amen.’ Then [they] shall curse Belial and all his guilty lot, and they shall answer and say, ‘Cursed be [Be]lial in his devilish and damned be he in his guilty rule.”

From the 2nd century CE through the early middle ages, Belial became affiliated with the devil in gospel texts and assumed a central and permanent role of the ultimate evil that seeks to seduce, sabotage, harm, and fight mankind. He is described as a rebellious fallen angel who rose against G-d and challenged his sovereignty.

Lacking direct biblical sources to support these assertions, some prominent theologians such as Cyprian, Clement of Alexandria, Augustine, Dionysius the Pseudo-Areopagite, and John of Damascus, Origen used unrelated passages such as Isaiah 14:12-15 to buttress their claims:

“And thou saidst in thy heart: ‘I will ascend into heaven, above the stars of G-d will I exalt my throne, and I will sit upon the mount of meeting, in the uttermost parts of the north;
I will ascend above the heights of the clouds; I will be like the Most High.”

The Satanic Verses V1
Image 4: L-R Cyprian, Clement of Alexandria, Augustine, Dionysius, John of Damascus, Origen 

The absence of supporting scriptural provenance didn’t stop the widespread dissemination of these daemonic ideas. Now instead of using biblical exegesis, writers resorted to speculative fiction to describe in detail the devil’s nature, domain, powers, and attributes. For example, Cyprian in his Treatise 10.4 claimed that the reason for the fall of Satan was:

“When he saw human beings made in the image of God, he broke forth into jealousy and malevolent envy” and thus rebelled against God.

Where the biblical world experienced a rare and indirect interaction with a “destroyer”, the religious universe of late Roman period swarmed with pitched battles between angels and demons, with humanity caught in between. Even the most mundane matters including eating, marriage, and bearing children became a battleground between good the evil. Origen in his Commentary on Matthew and Clement of Alexandria in his Stromata discuss these prevailing contemporary views including one that the institute of marriage “is fornication” and that it was “introduced by the devil”.

By now, the previous narrative of the “destroyer” as mere messenger or the delivery mechanism for divine retribution regressed to the ancient idolatrous relationship between factions of warring deities reflected in the Enuma Elish. The new pantheon of the devil and his cohorts grow steadily and by the 6th century CE authors were dedicating entire treatises to the cataloging of the demonic and angelic realms. Early medieval writers such as Pseudo-Dionysius the Areopagite also produced an encyclopedic works such as the The Celestial Hierarchy that classified angels by function and utility and discussed in great details subjects such as:

“Which is the first Order of the Heavenly Beings? which the middle? and which the last? How many, and of what sort, are the Orders of the super-celestial Beings, and how the Hierarchies are classified amongst themselves”

Pseudo-Dionysius the Areopagite, The Celestial Hierarchy
Image 5: The Celestial Hierarchy of Pseudo-Dionysius the Areopagite

By the Second Council of Nicaea in 787 CE, angles and saints (who are in affect demi-angles) became official objects of veneration and adoration and patrons of every mundane daily function such as food preparation, travel, and athletic activity

St. Sebastian Sterling Silver Medals
Image 6: The St. Sebastian athletic emulates

By the middle ages, Archangel Michael acquired an affiliation with certain functions of the angel of death who—among other responsibilities—was tasked with evaluating and carrying the souls of all the deceased to heaven and fighting Satan. Just like in the case of the Egyptian Anubis, Byzantine and Catholic liturgy and art assigned Michael the role of weighing the souls of the dead with his scales. Another popular depiction of him is being armed with a spear or sword and locked in mortal combat with Satan—In which for some unknown reason, he consistently fails to win a decisive victory.

Archangel Michael
Image 7: Depiction of Archangel Michael in medieval and renaissance art

Anubis Weighing of the Heart
Image 8: Anubis weighing the souls of the dead

From the late middle ages through the late renaissance, we find an increasing a number of books on demonic classification. These works progressively become more elaborate. They detail the nature of each demon, their MO, the category of sins which they impart to their human victims, the month in which their power is strongest, and the saints that are their adversaries. Some of the more notable classification works from this period are:

The 1410 Lantern of Light by John Wycliffe. A daemon classification system that was based on the Seven Deadly sins and the following association of sin and demon:

  1. Lucifer – Pride
  2. Beelzebub (Belzebub) – Gluttony (Glotouns)
  3. Satan (Sathanas) – Wrath (Wraþþe)
  4. Leviathan (Leviathan) – Envy (Envous)
  5. Mammon – Greed (Auarouse)
  6. Belphegor –  Sloth (Slow)
  7. Asmodeus – Lust (Leccherouse)

The 1459 Fortalitium Fidei by Alphonso de Spina. In the chapter on demons, Asphonso took daemon accounting to a new level or precision and stated that the total number of angels who sided with Lucifer’s revolt against G-d was 133,306,668. He also classified demons based on the following criteria:

  1. Incubi and succubi
  2. Familiars
  3. Drudes
  4. Cambions born from the union of a demon with a human being (AKA witches and warlocks).
  5. Demons that induce old women to attend Witches’ Sabbaths

The c. 1486 Malleus Maleficarum (Hammer of Witches). This most ‘thorough’ treatise on witchcraft and demons was written by two German Dominican monks, Heinrich Kramer and Jacob Sprenger and came with an official papal bull. The book sold more copies than any other book except the Bible until 1678. It was single-handedly responsible for the murder of hundreds of thousands (if not millions) of innocent woman and young girls across Europe. According to the book, it has been proven that it is normal for many woman to embrace sorcery and “to perform filthy carnal acts with demons.”

The 1533 De Occulta Philosophia by Cornelius Agrippa. A demon classification system based on the number 4 and the cardinal directions that included:

  1. Oriens – East
  2. Paymon – West)
  3. Egyn – North
  4. Amaymon – Sout

The 1591 The Confessions of Warlocks and Witches by Peter Binsfeld. A demon classification system similar to the Lantern of Light’s seven deadly sins but with a slight variation in the classification as follows:

  1. Lucifer – Pride
  2. Mammon – Greed
  3. Asmodeus – Lust
  4. Leviathan – Envy
  5. Beelzebub – Gluttony
  6. Satan – Wrath
  7. Belphegor – Sloth

The 1597 Daemonologie by King James (the same James who later sponsored the translation of the Bible to English better known as the “King James Bible”). A demon classification treatise in three volumes dedicated to the study of demonology and the methods demons used to inflict and torment mankind. The classification included:

  1. Spectra – Used to describe spirits that trouble houses or solitary places
  2. Oppression – Used to describe spirits that follow upon certain people to outwardly trouble them at various times of the day
  3. Possession – Used to describe spirits that enter inwardly into a person to trouble them
  4. Fairies – Used to describe spirits that prophesy, consort, and transport

The books also covered important topics such as werewolves and vampires. It was aimed at educating the ignored citizenry of England on the history, practices and implications of practicing sorcery and all things demonic.

The Observer's Book of Monsters by Claude Savagely
Image 9: The Observer’s Book of Monsters by Claude Savagely

The 1608 Compendium Maleficarum by Francesco Maria Guazzo (a rework/rip-off of the the 11th century Classification of Demons by Michael Psellus). The work classified demons into:

  1. Empyreal – Fiery
  2. Aerial – Airborne
  3. Subterranean – Underground
  4. Lucifugous – Heliophobic
  5. Aqueous – Water based
  6. Terrene – On the ground

The 1686 Semiphoras and Schemhamforas by Andreas Luppius which was based on a similar system of classification as “De Occulta Philosophia” but instead of 4 used the number 9 and had the following orders of demons:

  1. False spirits
  2. Spirits of lying
  3. Vessels of iniquity
  4. Avengers of wickedness
  5. Jugglers
  6. Airy powers
  7. Furies sowing mischief
  8. Sifters or triers
  9. Tempters or ensnarers

Demonic classification books
Image 10: A sampling of a few demonic classification books from the 14th-17the centuries

The Jewish View
Some ancient and modern Jewish scholars, like Richard Friedman, also erroneously made the correlation between the “destroyer” and the angel of death. These errors were based on anecdotal evidence in the secondary literature and art. Friedman for example came to this conclusion based on a sword bearing figure in one of the illustrations on the Golden Haggadah whom he identified as the angel of death (top right corner of Image 11). This led him to conclude that the authors of the 14th century Haggadah must have also subscribed to the textual and theological interpretation that the “destroyer” was in fact the angel of death.

Golden Haggadah Angel of Death
Image 11: Illustration from the Golden Haggadah (Note figure in top right corner)

Ironically, the same Golden Haggadah that is used as proof for the existence of the angel of death contains a hand written note, which is a combination of some biographical details and poetry. In line 6 of the note it reads:

״…בחוכמה בתבונה ובדעת, חי העולמים יושב המרומים ומשגיח התחתונים אחד ונעלם אלקי חיים ומלך עולם…״

“…In wisdom, understanding, and knowledge, the creator of the universe who sits on high and oversees the underworld (i.e. the dead), who is one and unseen, the king of the world…”

From the context it’s clear that the writer of the text (and likely the owner of the book) did not buy into the angel of death idea or his ability to challenge the sovereignty of G-d.

Intro Text to Golden Haggadah
Image 12: The hand written note in cursive script in the Golden Haggadah and its in-line transliteration to block script

Why The Confusion?
I think that the confusion about the meaning of the “destroyer” in the verses in Exodus can be attributed to the misreading of the text and failure to identify the wordplay and the variant usage of the root N-G-F נגפ. This root and its derivatives can be read as smite, obstacle, defeated, plague, blow, and strike. Depending on its usage and context, it can also be used as a noun such as in ‘bubonic plague’ and as a verb such as in ‘I’ve been plagued by ill health”.  Keeping this in mind, we can try to reconcile the contextual problem by reading verses 12:12-29 as follows:

12–For I will go through the land of Egypt in that night, and will smite [וְהִכֵּיתִי] all the first-born in the land of Egypt, both man and beast; and against all the gods of Egypt I will execute judgments: I am G-d.

13–And the blood shall be to you for a token upon the houses where ye are; and when I see the blood, I will pass over you, and there shall no plague [נֶגֶף] be upon you to destroy [לְמַשְׁחִית] you, when I smite [בְּהַכֹּתִי] the land of Egypt.

22–Take a bunch of hyssop, and dip it in the blood that is in the basin, and strike the lintel and the two side-posts with the blood that is in the basin; and none of you shall go out of the door of his house until the morning.

23–For G-d will pass through to smite [לִנְגֹּף] the Egyptians; and when He seeth the blood upon the lintel, and on the two side-posts, G-d will pass over the door, and will not suffer the destroyer [הַמַּשְׁחִית] to come in unto your houses to smite [לִנְגֹּף] you.

27–that ye shall say: It is the sacrifice of G-d’s Passover, for that He passed over the houses of the children of Israel in Egypt, when He smote [בְּנָגְפּוֹ] the Egyptians, and delivered our houses.’ And the people bowed the head and worshipped.

29–And it came to pass at midnight, that G-d smote [הִכָּה] all the firstborn in the land of Egypt, from the first-born of Pharaoh that sat on his throne unto the first-born of the captive that was in the dungeon; and all the first-born of cattle.

Putting all of these elements together gives us: the destroyer [הַמַשְׁחִית] smites [לִנְגֹּף] using a plague [מגיפה] the first born in Egypt via “the destroyer’s plague” [ נֶגֶף לְמַשְׁחִית], with plague [נֶגֶף].

A similar word play in English would be along the lines of:

The striker (destroyer), stroke (inflicted), the stricken (victims), with a strike (affliction).

So, G-d Himself “passes through” (עָבַר) the land of Egypt and smites all the firstborn in the land of Egypt. This is accomplished via “the destroyer” which happens to be the plague, that plagues the firstborn of Egypt with a plague. In this context, the destroyer is G-d’s mechanism for delivering the destruction. 

To paraphrase Sherlock Holmes: “This Exodus story stands flat-footed upon the ground and there it must remain. The world is big enough for us. No angel of death need apply.”

Considering this, I propose a practical alternative reading of the “destroyer” to be a software function that looks like the following:

Function Destroyer(Identity, DateTime, Agent, Cause, Delay, Reason, Place, Duration, Awareness, Terminate)
  Identity = Identity of the deceased (VictimID)
  DateTime = Date&Time of death (from the creation of the universe)
  Agent = Delivery Mechanism (e.g. Carbon monoxide)
  Cause = Actual cause of death (see CDC codes)
  Delay = In hours:minutes:seconds
  Reason = Triggering event
  Place = Location of victim in universal XYZ coordinates
 
Duration = Timed (use ‘Delay’ as an offset) or Permanent
  Awareness = Premonition value 0-9 about the impending death
  Terminate = A real-time abort flag (True or False)

End Function

Module TenthPlague

    KillFirstBorn()

    DeceptionInvolved = Use cases like Egyptians using fake blood
    or paint on their door, hiding in an Israelite home, etc.

            
       
‘Test if everything is Kosher

        If BloodFoundOnDoor = true DeceptionInvolved = false Then

         
         
Nothing to see here, move along…

          Exit

       
        ‘Are they cheating?
        ElseIf
 DeceptionInvolved = True Then

                         
          ‘Is there a first born inside?
          If FirstBornPresent and Terminate = False Then

         
          Get’em!       
          Destroyer(VictimID,4.54×109,Anthrax,Pneumonia-Cardiac
          Arrest,0,Disobedience10,30°0’47.001656”
          N 31° 12’31.870834” E 12.920,Permanent,0,False)

         
         
End If

       
        ‘There is no blood on the door or we are in the open
        ElseIf BloodFoundOnDoor = False
Then
                

       
  ‘Is there a first born present? 
          If FirstBornPresent and Terminate = False Then
 
         
Get’em!
    
     Destroyer(VictimID,4.54×109,Anthrax,Pneumonia-Cardiac
          Arrest,0,Disobedience10,30°0’47.001656”
          N 31° 12’31.870834” E 12.920,Permanent,0,False)

         
End If

       
       
End If

   
   
End
Sub


End
Module

The ‘destroyer’ is no more good or bad than any other types of delivery system and has no more free will than an envelope delivering a letter. Thus, the destroyer is a mere mechanism that G-d uses to execute judgment upon Egypt, Israel, and others. it is not a separate entity. The same dual reference to G-d’s action and His ‘delivery mechanism’ can be seen in Samuel 15-16, where G-d sent a plague to punish Israel:
 
“So G-d sent a pestilence  upon Israel from the morning even to the time appointed; and there died of the people from Dan even to Beer-sheba seventy thousand men.”

וַיִּתֵּן יְהוָה דֶּבֶר בְּיִשְׂרָאֵל, מֵהַבֹּקֶר וְעַד-עֵת מוֹעֵד; וַיָּמָת מִן-הָעָם, מִדָּן וְעַד-בְּאֵר שֶׁבַע, שִׁבְעִים אֶלֶף, אִישׁ

and in Samuel 24:16, where the “destroyer” is described as:
 
”And when the angel stretched out his hand toward Jerusalem to destroy it, G-d repented Him of the evil, and said to the angel that destroyed the people: ‘It is enough; now stay thy hand.’ And the angel of G-d was by the threshing-floor of Araunah the Jebusite.”

וַיִּשְׁלַח יָדוֹ הַמַּלְאָךְ יְרוּשָׁלִַם, לְשַׁחֲתָהּ, וַיִּנָּחֶם יְהוָה אֶל-הָרָעָה, וַיֹּאמֶר לַמַּלְאָךְ הַמַּשְׁחִית בָּעָם רַב עַתָּה הֶרֶף יָדֶךָ; וּמַלְאַךְ יְהוָה הָיָה, עִם-גֹּרֶן האורנה (הָאֲרַוְנָה) הַיְבֻסִי

Conclusion
It is ironic, that the same pagan ideas that the scripture fought so hard to invalidate are even more popular today then they were 3500 years ago. The prevalence of psychic readers on every street corner, Satanism in movies, literature, and popular culture just show you that regardless of how clear the message is, there are always creative ways to misinterpret and change it.

Death and Hollywood
Image 13: Satanic and demonic motifs in mainstream entertainment account for 5%-15% of movies

Horror is profitable
Image 14
: The profitability of Satanism

Berkeley Psychics
Image 14
: Distribution and density of Psychics, Tarot Card Readers, and Clairvoyant Mediums in Berkeley

All of this makes you wonder: what is it about these simple four self-explanatory statements that can possibly be confusing?

  1. “I will pass through the land of Egypt”, I and not an angel;
  2. ”And I will smite every first-born in the land of Egypt”, I and not a seraph;
  3. ”And I will carry out judgments against all the gods of Egypt”, I and not a messenger;
  4. ”I G-d”, and none other!

Happy Passover and Easter. 

References and Sourcing
*** Special thanks to Dr. Alshech for his contribution to the translation of the introduction to the Golden Haggadah

The Golden Hagaddah – Credit the British Library Add. MS 27210

He Smote the First Born of Egypt – Handel Israel In Egypt

Campin’ In Canaan’s Happy Land – Stanley Brothers Old Time Camp Meeting Album

I have left the land of bondage with its earthly treasures
I’ve journeyed to the place where there is love on every hand
I’ve exchanged the land of heartaches for the land of pleasure
I’m camping, I’m camping, in Canaan’s happy land

Every day I’m camping (camping) in the land of Canaan (Canaan)
And in rapture I survey its wondrous beauty grand (Oh, Glory)
Glory, hallelujah (I have) found the land of promise
(And I’m) camping, I’m camping, in Canaan’s happy land

Out of Egypt I have traveled through the darkness dreary
Far over hills and valleys and across the desert sands
Thoughts of land that’s safe and homeward I shall not go weary
I’m camping, I’m camping, in Canaan’s happy land

Yes I’ve reached the land of promise with the saints of glory
My journey ended in a place so lovely and so grand
I’ve been led by Jesus to this blessed land of story
I’m camping, I’m camping, in Canaan’s happy land

The Promised Land – Hymn 128 Sacred Harp Tunebook
128 The Promised Land

On Jordan’s stormy banks I stand,
And cast a wishful eye,
To Canaan’s fair and happy land,
Where my possessions lie.

I am bound for the promised land,
I am bound for the promised land,
Oh, who will come and go with me,
I am bound for the promised land.

Oh, the transporting, rapt’rous scene,
That rises to my sight,
Sweet fields arrayed in living green,
And rivers of delight.

I am bound for the promised land,
I am bound for the promised land,
Oh, who will come and go with me,
I am bound for the promised land.

Filled with delight, my raptured soul
Would here no longer stay!
Though Jordan’s waves around me roll,
Fearless I’d launch away.

I am bound for the promised land,
I am bound for the promised land,
Oh, who will come and go with me,
I am bound for the promised land.

The Curse of Belial – Dead Scroll 394, 4Q2864Q287, fragment 6
Curse of Belial

(1) The Community Council shall say together in unison, ‘Amen. Amen.’ Then [they] shall curse Belial (2) and all his guilty lot, and they shall answer and say, ‘Cursed be [Be]lial in his devilish (Mastematic) scheme, (3) and damned be he in his guilty rule. Cursed be all the spir[its of] his Mot in their Evil scheme. (4) And may they be damned in the schemes of their [un]clean pollution. Surely [they are the to]t of Darkness. Their punishment (5) will be the eternal Pit. Amen. Amen. And cursed be the Evi[1] One [in all] of his dominions, and damned be (6) all the sons of Bel[ial] in all their times of service until their consummation [forever. Amen. Amen.’] (7) And [they are to repeat and say, ‘Cursed be you, Angel of the Pit and Spir[it of Destruction in al[1] the schemes of [your] gu[ilty] inclination, (8) [and in all the abominable [purposes] and counsel of [your] Wick[edness. And damned be you in [your] [sinful] d[omi]n[ion] (9) [and in your wicked and guilty rule,] together with all the abom[inations of She]ol and [the reproach of the P]it, (10) [and with the humiliations of destruction, with [no remnant and no forgiveness, in the fury of [God’s] wrath [for]ever [and ever.] Amen. A[men.] (11) [And cursed be al]1 who perform their [Evil schemes,] who establish your Evil purposes [in their hearts against] (12) Go[d’s Covenant,] so as to [reject the words of those who see] his [Tru]th, and exchange the Judge[ments of the Torah…]

Targum of Yonatan ben Uzziel (in Aramaic)
Targum (translation) Jonathan is a western targum of the Torah (Pentateuch) from the land of Israel as opposed to the eastern Babylonian Targum Onkelos (which was written by the nephew of the Roman emperor Titus). Its correct title was originally Targum Yerushalmi (Jerusalem Targum), which is how it was known in medieval times. But because of a printer’s mistake it was later labeled Targum Jonathan, in reference to Jonathan ben Uzziel. Some editions of the Pentateuch continue to call it Targum Jonathan to this day.

Most scholars refer to the text as Targum Pseudo-Jonathan. This targum also includes Aggadic material (non legal or narrative material, as parables, maxims, or anecdotes) collected from various sources as late as the Midrash Rabbah and the Talmud. It is a combination of a commentary and a translation. In the translation portions, it often agrees with the Targum Onkelos. The date of its composition is disputed. It cannot have been completed before the 633 CE Arabic conquest as it refers to Mohammad’s wife Fatimah, but might have been initially composed in the 4th Century CE. However, some scholars date it in the 14th Century (which would make this document contemporary with the Golden Haggadah). 

The Goddess Anath: Canaanite Epics of the Patriarchal Age – Umberto Cassuto

The Observer’s Book of Monsters – Gavin Lines
The Observer's Book of Monsters

Copyright 2019 Yaacov Apelbaum, All Rights Reserved.

Coincidence or Not?

Coincidence or not

You may have seen this motivational masterpiece. It’s a favorite among performance consultants.

It goes as follows:

IF

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

THEN:

K

N

O

W

L

E

D

G

E

 

11

14

15

23

12

5

4

7

5

96%

AND:

H

A

R

D

W

O

R

K

   

8

1

18

4

23

15

18

11

 

98%

Both are important, but fall just short of 100%

BUT…

A

T

T

I

T

U

D

E

   

1

20

20

9

20

21

4

5

 

100%

So the moral of the story is that if you have the right attitude, you will achieve 100% of your potential. It sure looks great on paper. To test the mystical proposition, I’ve written a short script to first create words that are between 2-12 character long that add up to the value of 100 and then find which of these is found in a dictionary. 

As might be expected, the script generated hundreds of valid words (see the short sample at the end of the post just for the letter A). It turns out that many of them are not very motivational.

A

N

E

U

R

I

S

M

   

1

20

20

9

20

21

4

5

 

100%

A

S

B

E

S

T

O

S    

1

19

2

5

19

20

15

19  

100%

The problem with all of these leadership gimmicks is that they fail to understand the fundamentals of human performance, chiefly that nothing in nature functions at 100% efficiency. In reality, any information worker productivity in the 50% range is outstanding. As you can see from the list bellow, this is a conservative average daily activity breakdown of a typical information worker:

#

Activity

Time (Min)

1

Checking social media

44

2

Reading news websites & checking out ecommerce site like Amazon

65

3

Visiting and discussing non-work-related activity with colleagues

40

4

Making hot drinks

17

5

Smoking or doing some mobile device maintenance

23

6

Texting and instant messaging

14

7

Snacking

8

8

Preparing food in the office

7

9

Calling partners and friends

18

10

Looking for a new job and or doing some LinkedIn “maintenance”

26

Total

262

So about 4.3 hours of every 8 hour day are non-productive. If you still have any doubts, feel free to consult Frederick Brooks’ Mythical Man-Month.

Word

Letter Values

Sum

Abrogative

1 + 2 + 18 + 15 + 7 + 1 + 20 + 9 + 22 + 5

100

Acromegaly

1 + 3 + 18 + 15 + 13 + 5 + 7 + 1 + 12 + 25

100

Affectation

1 + 6 + 6 + 5 + 3 + 20 + 1 + 20 + 9 + 15 + 14

100

Alienation

1 + 12 + 9 + 14 + 5 + 1 + 20 + 9 + 15 + 14

100

Anchoritic

1 + 14 + 3 + 8 + 15 + 18 + 9 + 20 + 9 + 3

100

Anglophobia

1 + 14 + 7 + 12 + 15 + 16 + 8 + 15 + 2 + 9 + 1

100

Anorchism

1 + 14 + 15 + 18 + 3 + 8 + 9 + 19 + 13

100

Aryanism

1 + 18 + 25 + 1 + 14 + 9 + 19 + 13

100

 

© Copyright 2017 Yaacov Apelbaum, All Rights Reserved.

Capturing the Flag

Yaacov Apelbaum - Who Knows What Evil Lurks in the Heart of a Cyber Attacker

If you are a typical cyber security practitioner, you most likely catch-up on the latest developments by visiting on-line sites like News Now and by periodically attending various vendor workshops. For the majority of InfoSec managers, the daily work grind and life/work balance challenges diminish the prospects of going back to school and plowing through hands-on in-depth training.

Over the past two decades, the corporate cursus honorum for IT management has been the much coveted MBA degree. In a large number of Fortune X00s, having an MBA from a top school was considered a prerequisite for an executive promotion. An MBA attested that an individual possessed all the current business acumen and the polish needed to take on any future leadership responsibility, it was the ultimate professional endorsement of merit.

This trend—other than having the end result of a glut of MBAs on the market—has also resulted in a shortage of highly technical cyber security managers. Consider some of the wholesale data breaches in some of the largest US retailers for 2014 alone. Check out the biographical backgrounds of some of the CISOs of the impacted companies. Not surprisingly, you will find no shortage of MBAs from top tier schools. What appears to be missing are individuals with vocational specializations in information and cyber security, and I’m not referring to rank and file CISSPs.

Of course, a common counter argument to this is that as a manager you are not supposed to know the ‘nitty gritty’ details of every technology in your corporate inventory and instead are expected to delegate to and draw on the expertise of others.

I don’t agree with this argument. Cyber security unlike databases or ecommerce, is almost entirely a low level technical play and as such, a security manager should not have gaping holes in his knowledge or overly rely on subordinates to make sense of risk, threats and counter measures. In a corollary it would be unacceptable for a airline pilot to have gaping holes about his aircraft operations and him delegating the actual flight responsibility to the cabin crew.

I’ve recently had a chance to witness just how limited classical enterprise defenses have become. This is especially true when it comes to Advanced Persistent Threats. In one incident that eventually became the catalyst for me going back to school, I witnessed how a one cyber attack managed within minutes to defeat all of the traditional enterprise defenses and counter measures without even braking a sweat. Amazingly, even after the debriefing and root cause analysis, the security team was no closer to understanding how a properly configured and maintained brand name FW and an IDS/IDPS failed to stop the attack, let alone even detect it.

If you are thinking that this couldn’t happen to you, think again. In the incident that I just described, all target boxes were patched, there were strict access control measures in place, the network was sub-netted, and there were effective audit and password management systems in place.

After recovering from my momentary shock, I had an epiphany and realized that I urgently needed to re-hone my skills. I’ve heard about the SANS Institute from a number of colleagues and after checking it out, I decided to enroll in their Penetration Tester program. After juggling my bank account, my work schedule, and their course availability, I selected the following four courses:

  1. SEC504 Hacker Techniques Exploits & Incident Handling
  2. SEC560 Network Penetration Testing and Ethical Hacking
  3. SEC575 Mobile Device Security and Ethical Hacking
  4. SEC617 Wireless Ethical Hacking, Penetration Testing, and Defenses

The SANS courses tuition is on the expensive side, ranging from $6000-$9000 USD per course. Add travel and accommodations and you are looking at about $12K per class. Each course is delivered in about a week (40-60 hours of classroom activity). Classes are divided into lectures and hands-on labs with heavy emphasis on getting down and dirty.

Though it took me several months to complete the coursework, I have found the whole experience to be uplifting. In addition to getting access to practical, real-world expertise from some of the world’s best penetration testers, we practiced the gray art of performing detailed reconnaissance on would-be targets including mining a social media, and infrastructure data from blogs, forums, search engines, social networking sites, and other Internet resources.

In each course, we used the latest cutting-edge attack tools as well as the traditional low budget techniques that are still quite prevalent. The aim of the course was to push the envelope in each domain and not to merely teach a handful of hacks and tricks. Another great component was exploring various administrative questions such as legal issues associated with responding to computer attacks, employee monitoring, working with law enforcement, and the collection and handling of evidence.

SANS Capture the Flag Las Vagas 2015

When it came to performing the actual exploit, we got to use the best tools on the market. This included both, COTS components and custom written utilities and scripts. In each class we learned dozens of methods for exploiting target systems and how to gain access to the systems post-exploitation. Just to illustrate the extensive hands-on approach that SANS adapted in teaching Penetrating Testing, here is a list of tools and techniques that we used in just the SEC 504 course:

– RootKits and detection
– Hidden file detection with LADS
– HTTP Reverse Shells using Base64
– InSSIDer for Wireless LAN discovery
– Nmap Port Scanner and Operating System fingerprinting tool
– Nessus Vulnerability Scanner
– Windows Command Line Kung-Fu for extracting Windows data through SMB sessions
– Sniffers, including Tcpdump
– Sniffer detection tools, including ifconfig, ifstatus, and promiscdetect
– Netcat for transferring files, creating backdoors, and setting up relays
– Metasploit, Metasploit, Metasploit Lots of Metasploit
– ARP and MAC analysis for ARP cache poisoning attack detection
– Password cracking
– Cross-site scripting and SQL injection web application attacks
– Intercepting and forging session cookies
– Detecting and executing DoS attacks techniques
– Detecting backdoors with Netstat, lsof
– Covert channels using Covert TCP
– clandestine network scanning and mapping
– Exploitation using built in OS commands
– Privilege escalation
– Advanced pivoting techniques

The great thing about the SANS curriculum is that they go pretty far down into the rabbit hole. A few of the classes required hard core coding skills (you get to write/execute some buffer overflows). Other classes were procedural and got down to the wire in terms of the inner functioning of RFC and protocol. For example, in the Wireless Ethical Hacking we had comprehensive coverage of WiFi, cordless telephones, smart devices, embedded home devices, mash technologies like ZigBee and Z-Wave, Bluetooth, DECT, and NFCs.

In the Mobile Device Security we practiced reverse-engineering iOS binaries in Objective-C, reverse-engineering Android binaries in Java and Dalvik Bytecode, evaluating mobile malware threats through source-code analysis, defeating Apple FairPlay encryption for application binary access, and overcoming anti-decompilation techniques.

SANS Capture the Flag Washington DC 2015

The participants in the classes came from diverse backgrounds, including three letter agencies, LEA incident handling team members, and security administrators. The classes are well-suited for anyone with a good command of TCPIP and networking and they would also benefit architects and technical leads involved in security operations and R&D.

The delivery of the material is completely immersive. You go from 0-90 in one second.  Each course is equivalent to a traditional graduate semester course of 4 credits so we had to complete an average of one textbook per day.  At times, you feel like you are drinking and showering from a fire hose at the same time.

Taking good notes and hitting the books at night will help you stay afloat. It goes without saying that the instructors were outstanding; they offered unlimited tutoring and were always available—even during lunch and after hours—to help answer questions and work through the practice labs.

Yaacov Apelbaum - SANS SEC504 Yaacov Apelbaum - SANS SEC560 Yaacov Apelbaum - SANS SEC575 Yaacov Apelbaum - SANS SEC617

Several interesting sessions in each class revolved around learning how to avoid being caught through various tactics and strategies for covering your tracks such as: File and directory camouflage, piggybacking on existing user Internet sessions to avoid detection, event log tampering and pruning, and performing memory cleanups.

For me, the best part of each course was the final session called “Capture the Flag”.  There, in a culmination of all of the hard work, we got to practice everything we had learned over the previous week. Each class had different parameters for capturing the flag, but they tended to follow the same patterns.

We needed to do some reconnaissance, reconstruct the network layout of our target, map our victim’s equipment and software inventory, and then proceed to execute the attacks. Once you breached the target, you would perform some additional exploits and start pivoting between hosts and ‘living off the land”. The overall objective of this exercise was to collect flags that had been placed on various locations on the victims’ network by the instructor. Some of these flags contained encrypted files or messages that we needed to decrypt and use as clues for other attacks, others involved passwords that were being sent over VOIP, in memory session information, or data hidden in binaries.

SANS Capture the Flag Boston 2015

The capture the flag event usually lasts a full day and ends when one team successfully recovers all flags. At that point, the competition is stopped, the results are verified, and the winners are awarded the coveted challenge coins.

Yaacov Apelbuam SANS 575 Capture the Flag Token  Yaacov Apelbuam SANS 617 Capture the Flag Token  560-capture-the-flag-token

If you are a computer security practitioner, I highly recommend that you take all four courses. Even if you can only afford one, go for it. It will change your prospective on pen testing forever and help you take a proactive role in keeping your company safe and out of the negative limelight.

Performing a good penetration test is much more than just hiring some outside help and rubber stamping an audit. Anyone can throw a bunch of attacks against an organization and regurgitate the output of some automated tools in hundreds of pages of reports. Verifying the integrity of your corporate security takes more than just kicking a few InfoSec tires and lifting the hood these days.

Participating in hands-on structured training will help you avoid this trap and allow you to grasp your company’s security needs so that you can prioritize and formulate the appropriate plan of action in the most cost effective and timely manner.

Going through the meat grinder, you get to witness first hand the process of hot dog making. It’s not a pretty sight, but its an informative one. One of my most profound takeaways from this whole experience was answering the existential question of the spoon. Yes, the spoon does exist, but only for the end-user, sysadmin, DBA, and auditors. There is no spoon if you are a proficient attacker. With the right strategy and tools, concepts such as access control, event log integrity, and passwords are meaningless and are but chaff before the wind.

Yaacov Apelbaum - There is no Spoon

I keep my three hard earned challenge coins on my office bookshelf as a reminder that there is likely someone out there right now who is targeting my network through some kind a a clever attack. He/she has all the right tools and resources and are as determined and hard working as I was to get his coins.

And as far as my earlier MBA comment is concerned, if you are curious to know just how many managers attended the classes, the answer is just one. None of the 20-40 participants in each classes had managerial responsibility. In fact most of the folks I spoke to were surprised that a CTO would take time from his schedule and opt to get his hands dirty instead of just delegating this to one of his directs.

After all, ‘Isn’t that what a manager is supposed to do?’

© Copyright 2015 Yaacov Apelbaum All Rights Reserved.

Scaling the Wall

Yaacov Apelbaum-Climbing

Eagerly beginning the wall to scale,
Using only my hands and feet.
Resolved to follow the hardest trail,
I confidently place my cleat.

Suddenly, there’s no foothold to rest,
Desperately, I cling to the wall.
My heart is pounding in my chest,
My ascent slows to a crawl,

My feet and arms tire and shake,
The safety line invites me to bail.
Should I reach for the line and forego the ache,
Or continue to try, maybe fail?

The voice from below says: “Look to the right”,
I reach and grab a far hold.
Propelling free from my previous plight,
Good advice is more precious than gold.

It’s romantic to view the world as a wall,
Scaled heroically by pure self-esteem.
But in complex endeavors you’re certain to fall,
Without the support of a team.

 

© Copyright 2011 Yaacov Apelbaum All Rights Reserved.

Only the Racially Pure Need Apply

The German American Bundpsd

On February 20, 1939, over 20,000 American supporters of the Nazi party packed Madison Square Garden in New York City. They anxiously awaited the appearance of Fritz Julius Kuhn, the newly anointed Führer of the German−American Bund. The event took place two days before George Washington’s birthday and a 30−foot-portrait of the first president (who was described by Kuhn as the first fascist) hung behind the podium along with Nazi flags and swastikas.

George W and Bund Fritz Kuhn
The 30 foot poster of GW and the American Führer Fritz Julius Kuhn

Kuhn entered the arena together with thousands of uniformed Nazi guards. During the rally he and his fiery fellow orators held back no punches, calling President Franklin D. Roosevelt: “Franklin Rosenfeld,” and referring to his New Deal as a “Jew Deal.”

Nazis in Madison Square Garden

Being a creature of the night, Kuhn loved nightclubs, drinking, and the company of women (among them his two mistresses, Virginia Cogswell AKA “The Marrying Georgia Peach−on account of her previous seven husbands”, Florence Camp, Frau Hedwig Munx, and others). Just like many petty dictators, he was pompous, dishonest, idiotic, and didn’t understand his own limitations.

Once during a testimony before the Dies Committee, he was asked by Congressman Starnes if the reason why 23 of 71 Bund units concentrated in and around New York City was because the aircraft and naval manufacturing facilities were handy for sabotage. He replied: “That’s the same thing Lipshitz said. You know who Lipshitz is? That’s Walter Winchell [referring to Winston Churchill]. Lipshitz is his real name.”  No one was amused.

Shortly after his rock concert−like appearance in Madison Square Garden, New York city’s mayor, La Guardia, who was fed up with the constant anti−Semitic and anti−American agitation, started an Al Capone−style financial investigation of the Bund’s taxes.

When asked about his relationship to Florence Camp during his trial, Kuhn denied that he had asked her to marry him and noted that Mrs. Camp was too much of a lady to accept a proposal after just a few days’ acquaintance. Herman McCarthy (the prosecutor) whipped out a Kuhn letter and read it aloud:

“Florence : I am terrible in love with you. I beg you to become my beloved wife. I will always be true to you. . . .”

In another letter to Florence he said that he loved her with his “whole soul and body and was about to have [his] teeth fixed.”

Virginia Cogswell Yaacov Apelbaum - Virginia Cogswell  News
Virginia Cogswell AKA “The Marrying Georgia Peach” and a case related telegraph

In the course of the trial, it was established that Kuhn had pilfered $14,548 from his organization ($717.02 of it having been spent on moving expenses for Mrs. Camp). Kuhn was swiftly convicted on charges of embezzlement, grand larceny, and forgery and was first sent to Sing Sing Prison.  After the war, he was deported to Germany, where he managed to get into trouble again.

The Escape of Fritz Kuhn

In 1949 when he again stood trial in front of a Munich court this time on charges of escaping from jail and being a major Nazi organizer, he claimed that the Bund was strictly “an American patriotic organization,” that he had used the swastika only because it was “an old American Indian design,” and that he had patterned the Bund’s uniforms after the US National Guard, not  the SS. As for his 1944 meeting with Hitler he said: 

“It was purely a social call. If I went to England today, I would naturally like to call on King George.” 

When the US. entered the war, whatever was left of the German−American Bund organization quickly disintegrated, however, that didn’t spell the end of Nazi activity in America. Another high profile organization waiting in the wings was the Steuben Society. In comparison to the Bund which was composed of common National Socialist riff raff, the Steuben Society represented the cream of the crop to the US Nazi aristocracy.

The German American Bund Movie

Although Steuben Society members avoided public Nazi displays such as hailing Hitler, the differences between the two organizations were only skin deep. When it came to hard core issues such Nazi ideology, they were indistinguishable.

While visiting the reception room of the Steuben Society in New York, John Roy Carlson observed:

“One could find a large American flag standing in one corner. On the walls were pictures of Von Steuben, Washington, and Lincoln, The Pledge to the Flag and the Bill of Rights hung framed between them. There was also no lack of red−white−and−blue. Patriotism oozed from every crevice in the room.”

True to its nature, the Society published “The Steuben News” a newspaper for Patriotic Americans which described itself as:

Yaacov Apelbaum-The Steuben News

“. . . a patriotic, civic and educational political society endeavoring to awaken in the hearts and minds of American citizens of German extraction the necessity for taking a more active part and interest in the political affairs of our great country.”

Its program demanded “strict discipline” on the part of its members, and rejected “persons who are shifters and trimmers, or who are known to possess no race pride.” The Steuben Society strongly emphasized Racial (Aryan) consciousness and political objectives.

In his 1943 investigative book Under Cover, Carlson wrote:

“…The Steuben News reprinted articles from the pro−Fascist Italian daily, Il Progress Halo−Americana. It recommended books by the notorious Ausland Institute and ran many articles by Nazi agents. The Steuben News praised as “extraordinary and valuable” the book Scarlet Fingers published by Flanders Hall, the propaganda mill financed by Nazi agent George Sylvester Viereck. The Steuben News followed the accepted party line of pro−Nazi isolationists. It headlined the speeches of Lindbergh. It championed the late senator Ernest Lundeen−some of whose speeches were written by Nazi agent George Sylvester Viereck−and on one occasion devoted eleven columns to one of his defeatist speeches. It reprinted from Social Justice and The Herald, American Fascist weekly. It ran large advertisements for the America First Committee, reprinted its bulletins and urged its members to support it financially. The Steuben Society fought desperately all measures to arm those European Democracies which resisted Hitler’s brutality. And it also quoted liberally from the New York Enquirer, published by William Griffin, who was later shown to have associated with Viereck.”

Now, you’re probably thinking: “This is a fascinating piece of history, but what’s the relevance of all of this 1939 Nazi stuff to our current 21st century jet−set life style?” Well, wonder no more.

This past Sunday morning on our way out of our local diner, I caught sight of the newspaper stand in the entrance vestibule.  I usually don’t read printed media, but the name of the paper and the motto “A Newspaper for Americans” caught my attention. Curious about how the Steuben Society’s defines “American,” I picked up my free copy and read on. 

Steuben News

At the top of the cover page on each side of the title “The Steuben News” were the mission statements: (1) United for Common Interests and Common Needs” and (2) DUTY, JUSTICE, TOLERANCE, CHARITY.

I flipped through and read some of the articles. There was an announcement of a presidential proclamation regarding the German−American Day, a story about the treaty between German settlers of Texas and the native Comanche Indians. My first impression was that it all seemed rather banal. Then I got the last page. Under the calendar of events, I ran into some terminologies like “event sponsored by Unit #998” and “contact Brother Erick or Sister Hildegard.” That seemed a bit cryptic and militant. At the bottom of the page I saw the membership form which prompted an unexpected double−take.

The membership form, unlike any other application I have ever seen,  had questions about the nationality of the applicant’s father and mother, political affiliation, and—most surprising of all—about naturalization. For some reason, the Steuben Society (acting in the capacity of a quasi−government organization?) will only issue membership cards after careful evaluation of the applicant’s naturalization certificate, which includes scrutiny of the certificate number and place of origin. (I’m kind of curious to know who at the INS helps them validate these applications.)

Are You Naturalized

From what I can tell, this membership application has remained consistent over the years. After conducting a quick search on−line for similar historical documents, I found one for the Silver Shirts, and as you can see from the contents, not much has changed in terms of drilling down to pedigree and other über eugenics.

Yaacov Apelbaum-Silver Shirt

When, I checked out the Steuben Society’s website for the name and location of the chapter nearest me, I discovered that they are all named after some distinguished German figure. I was hoping to find a chapter honoring the likes of von Stauffenberg, but alas, no such luck.

I am not sure what to make of all this. I hold German culture, ingenuity, work ethics, and organization in the highest esteem. I’m an avid admirer of Handel’s music and Nietzsche’s, Kant’s, Goethe’s, and Leibniz’s writings. My family originated from Germany and in my travels there I have found most German people to be kind, polite, friendly, and exceedingly intelligent.

On one hand, it’s laughable that anyone would be willing to complete an application detailing his mother’s nationality or his naturalization number in order to join a civic organization. On the other hand it’s really disturbing that in 2010—the age of the internet—a nationwide fraternity that draws its philosophy from one of humankind’s darkest moments, continues to operate in the mainstream with apparently unrestricted access to leading politicians and public figures.

If you are considering joining an organization such as this, take a breather and dedicate some time to learning the German language, literature, philosophy, and music instead. You will discover that the richness of Germanic culture has a lot to do with individuality and little with purity of race and blood.   

Et si omnes ego non

© Copyright 2009 Yaacov Apelbaum All Rights Reserved.

Political Science 101

Political Science

Having kids in elementary school comes with several important parental commitments. Ranking high among these is the participation in the yearly science project. The main objective is to expose kids to the fundamentals of the scientific method. Following the principal of “learning by doing,” children, with the assistance of their parents, are required to conduct and showcase a yearly science experiment.

In our school district, exhibition day is a long-awaited, festive event with hundreds of projects being showcased at the school’s gymnasium. It is a great opportunity for families to mingle and view each other’s work. To spice things up a bit, at the end of the event, a panel of teachers selects the top three projects for each grade. The 1st place winners are then entitled to enter their project into the yearly regional competition that takes place at Brookhaven National Laboratory, a much coveted honor.

Although it is a great concept in theory, for some, the yearly science project can become a dreaded event, often testing a family’s procrastination capacity to the limits. On the weekend prior to the project’s due date, it is not unusual to find many agitated parents with kids in tow still scouring craft stores for project display boards and other supplies. In our family, however, we’ve come to view this assignment as an important pedagogical opportunity worthy of careful planning and execution.

I am fan of Richard Feynman, and have enjoyed reading “Surely You’re Joking, Mr. Feynman!”.  This book in addition to being an excellent primer for the budding technology hacker, inspired me to instill in my kids the importance of not falling victim to the “Cargo Cult” syndrome, and being honest and original in one’s approach to scientific discovery.

As it turns out, this has been a winning strategy for us. Since we started conducting science projects 4 years ago, we’ve been fortunate to have won several first place awards. Some of our past projects included experiments on bottleneck formation, sound propagation through vacuum, and algorithms and mathematics used by a spider to construct a web.

This year, during a routine morning school drop off, our 4th grader, Sheva, noticed that a traffic bottleneck formed regularly at one of the entrances to her school. After discussing her observations during dinner  she proposed to dedicate her project  to deciphering it.

Over a period of several days, we examined the traffic patterns, (volume, arrival and departure times, vehicle speed, etc.), but it seemed that there was no single significant cause to which we could attribute the formation of the bottleneck. We were stumped and unsure as to how to proceed. It was during one of the site visits that my daughter noticed a hawk hovering over the area. She commented that it would have been great if we could observe the traffic from above. Well, I thought, we may not be able to fly over the site like a hawk, (it is a residential area so a fly-over in an Ultralight would be out of the question), but we could certainly build an airborne observatory to do it for us.

After considering options, we decided that a fixed winged propeller driven aircraft wouldn’t work because the wind gusts at the area can reach up to 40 mph. Another constraint was that we would need a sustained, 30-minute flight to capture the entire bottleneck sequence which would be prohibitive.

In the end, we decided to build a lighter than air aircraft (Image 1) and after an intense weekend of design and fabrication we had a functional observatory. It took several test runs to get the flight characteristics and image quality right, but by Monday we were ready to conduct our operational flight.

Aerial Traffic Observation System (ATOS)
Image 1: ATOS (Airborne Traffic Observation System)

Flight Navigation and Imaging Specifications

  1. 4′ Chloroprene weather balloon with 1.7 lbs. of lifting capacity
  2. Riveted aluminum base cradle
  3. Flight control and stabilization via 2 tethers
  4. Canon FS100 Flash Memory (16 GB) camcorder with image stabilization
  5. Wireless broadcast via an Amimon’s wireless modem, streaming HD 1080P/24 video at 120 Hz over an encrypted connection to a base station laptop

The first flight of ATOS was smooth, producing an excellent video feed.  Back home after evaluating the images, Sheva almost instantly identified the source of the bottleneck.

It was apparent that the two-way traffic at the entrance to school was restricted to only smaller vehicles. As soon as the school buses arrived for their daily drop-off and pick-up, they forced all vehicles into a single file, which resulted in the immediate formation of a bottleneck.

Gate Traffic Set

This discovery was somewhat puzzling because, from the ground, the road (which is nearly 31′) seemed wide enough to comfortably support the passage of two side by side buses. So, on our next field trip we decided to measure the gate (Illustration 1) that blocks the entrance in question.  Armed with the gate’s measurements, we then consulted the traffic calming section in the NY highway design manual and quickly concluded that indeed the gate was at fault.

Yaacov Apelbaum-Gate 
Illustration 1: Gate Dimensions

So science aside, installing a gate that blocked over 30% of a high traffic thoroughfare was clearly a bad idea, not to mention that it violated numerous design codes. The gate and the fences that are attached to each of its sides also posed a series safety hazard because drivers who were unaware of the obstruction might plow directly into the fence, while still others who miscalculated the gate’s clearance could potentially scrape the posts supporting the gate.

On the day of the science fair, I approached the school principal and inquired about the origin of the gate. I explained that it appears that someone had either made a design or installation error because the gate’s posts should have been placed on the sidewalk curbs, off the driveway. The rationale for this being that when the gate was completely open it would allow for unrestricted traffic. The principal told me that the decision to construct the gate preceded her time in office and it had been influenced by the homeowners just down the street who complained that the traffic had become a nuisance. To reduce the traffic in order to appease the homeowners, the school agreed to install the gate as built.

Not satisfied with this explanation, I proceeded to point out the hazards posed by the gate as it stands and began to enumerate various doomsday scenarios. The principal’s otherwise cheerful demeanor suddenly darkened and after a quick and nervous glance at her watch she said that it was unfortunate that our meeting had to end so abruptly, but that she had to run to an important conference.

On the way home, our daughter who had been standing by me during the entire conversation with the principal asked me if, now that we’ve provided a scientific explanation for the formation of the bottle neck, the school would fix the problem. I thought about it for few minutes and said, “Probably not.”  She asked “why?”, I said that unfortunately, sometimes in the short term, politics can trump science. She was visibly disappointed and said that she worked so hard on this project and it all turned out to be a complete waste of our time. I told her that even though we didn’t win, we still conducted a great experiment and independently discovered and solved an interesting puzzle. And by way of analogy, I told her about the Galileo affair and how despite his mistreatment by the inquisition, in the end, his theories eventually won acceptance.

A few days after the science experiment, my wife, while waiting to pickup our daughter from school, struck up conversation with another parent who seemed to be visibly upset. “Why the long face?” she asked. “Well,” said our neighbor, “while driving into the school parking lot, I was being polite and made extra room for the car approaching me, but I miscalculated the width of the opening and scraped the side of my van against the gate post.” She had carved a deep gauge in right hand side of her van from wheel rim to wheel rim.

That evening during dinner, my wife recounted the story of the accident. My daughter at first thought that my wife was making the whole thing up, but after hearing that it was the mother of one of her classmates, she asked for permission to call her friend to verify the facts. When she got back to the dinner table, she had a look of disbelief on her face. “That’s exactly what we told the principle could happen!” she said. “We sure did,” I said.

She remained silent for few seconds and then I noticed a twinkle in her eyes.

© Copyright 2009 Yaacov Apelbaum All Rights Reserved.