Security

Many people believe that computers are exact devices. That data stored on disk will get back to you unharmed. That data you send over the network can be assumed as correct. That computers are deterministic devices. But they aren't. Not at all. I'm talking about this quite often when talking about ZFS.

Alec Muffet pointed on Facebook to a really interesting presentation that is showing errors due to corruption of data in a different context. It's about a DNS attack without attacking something. It's just waiting for errors to happen. It's something like waiting for typos in DNS names made by users. Just this time the error is introduces by computers. By reserving domains that are just one bit different from the original domain. Of course the probability is really small that such an error will happen, but given the enormous amount of requests the DNS system handles every second of the day, the number of events isn't that small as you would assume at first: "Bitsquatting: DNS Hijacking without exploitation". Really worth a read.

Hai-May Chao created a nice tutorial on the task how to use certificates for SSH authentication: "How to Set Up X.509 Support for SunSSH on Oracle Solaris 11"

One of the features introduced with 11.1 is the Address Space Layout Randomization (ASLR) . And when you work with 11.1 you are already using it. So it's a less known, but frequently used feature: less known in the point that it exists, less known in the point of the methods to control it, frequently used as it's activated per default for selected binaries (and many were selected)

Glenn Faden strikes again: In the article "Oracle Solaris Extended Policy and MySQL" he describes, how to use the Extended Policy feature to lock down the mysql service.

Glenn Faden wrote a really great article about the sandboxing of applications with privileges: Application Containment via Sandboxing. Worth a read.

News like this are the reason why i'm carrying my notebook and my iPad always with me when on travel as i don't trust hotel doors. However i didn't thought it's possible to open a door that fast: "Black Hat hacker gains access to 4 million hotel rooms with Arduino microcontroller"

It's really easy to use ZFS dataset encryption to protect your data in a way so you have to know something and to own something to get access to encrypted data.

Darren Moffat wrote a great blog article about the internals of the ZFS encryption - "ZFS encryption what is on disk ?":

This article is about what is and isn't stored encrypted on disk for ZFS datasets that are encrypted and how we do the actual encryption. It does require some understanding of Solaris and ZFS debugging tools.

Darren wrote three really interesting articles about ZFS encryption: The first one is Introducing ZFS Crypto in Oracle Solaris 11 Express. This blog entry gives you a first overview how to use encryption for ZFS datasets. The second one titled "Assured delete with ZFS dataset encryption" explains how you can use the encryption feature to implement assured deletion with the "throwing the keys away" technique. Last but not least the article "Having my secured cake and Cloning it too (aka Encryption + Dedup with ZFS)" explains how deduplication and encryption work together in Solaris 11 Express.

One of the hidden gem of Solaris is the kssl feature. Long-time readers know this feature, as i wrote a tutorial about it. For the uninitiated: It's a in-kernel SSL proxy. Why should you put this in the kernel. Well, especially when you use a SSL-accelerator you have to jump from user space to kernel space and back several times as the SSL library (OpenSSL e.g) is in user space and the driver for the card is in kernel space. That jumping costs you a lot of time. There is an interesting article about Weblogic SSL performance in the BestPerf blog.

When you just want to take one thing out of this whole article, then just look at the first chart at the red and the blue line: Red is the system configured to provide SSL via kssl, blue is the system configured to provide SSL via Weblogic itself. Both systems are using the SSL hardware. I don't know how you would call it, but the difference is pretty significant. A good example, why kssl is such a nice tool. And it's just there in Solaris 10.

The german IT news portal Heise linked to an interesting paper: "Anonymous Bluetooth Probes for Measuring Airport Security Screening Passage Time: The Indianapolis Pilot Deployment".

An interesting concept: Anybody who just start the Bluetooth scan on her/his notebook knows that there are several mobile phones on almost any given location with a large audience propagating a unique id to the world by their MAC address. Using this information to derive some useful facts from it (for example: Duration of the average TSA massage) looks like as one of the more worthy targets for tradeoffs on privacy vs. useful services in favor to the second one. Especially as it's really easy to evade from this data collection: Just switch off the bluetooth function of your mobile.

PS: I would like a bluetooth scanner in the aircraft itself ... it's really interesting how many mobile phones are running inflight. Such a scanner could send a vcard containing "Just switch off your fscking mobile phone". Did that once a few minutes before takeoff ... that was very effective

There was some discussion about possible attack vectors for checksum-only deduplication. However i don't think the proposed vectors are really feasible. The first attack tries to create data corruption by foiling deduplication into using a thoughtfully created block, with the same checksum but different data. Another, less discussed attack vector, is gaining knowledge of a block by using a thoughtfully created block to foil dedup to show you a different block than the one you have actually written, as the checksum-only variant didn't stored your block, but just created a pointer to data written beforehand.

This is a nice example, why those backscatter airport scanners are not the solution of all problems in airport security. The interesting part starts at 18:05 of this video available in the ZDF mediathek (an public broadcasting network in Germany). Despite being scanned they are not able to find the thermite the scientist is carrying. The guy demoing the scanner doesn't look amused as well as Mr. Bosbach, a german politician who thinks that we should use such scanners, if they are able to protect the privacy of the scanned peoples.

It turned out that the images of a story about "What a nude scanner" in germanys favorite gossip catapult and tabloid were faked: BildBlog - a watchblog dedicated to this tabloid - reports in "Kehraus 2009" that this newspaper just used a "Negative" plugin of their favorite photo alteration application to create such photos from a cd containing photos of a nude woman...

There is a lot of discussion about the backscatter scanners (or as the media calls them: "nude scanners") in Germany at the moment. Technically it's in discussion for a long time. I wrote about it in 2005 after Bruce Schneier wrote about it. My thought at this moment was "Okay, they will need an aircraft blown out of the sky to force this into the public".

Personally i think the this is lobby at work at the moment. It's a big business to implement backscatter at all airports in germany alone. Just think about the central security area in Hamburg.10 entries ... ka-ching .... and Hamburg is a relatively small airport.

At first: I have no problem with backscatter scanning. Technically the current metal detectors look through my clothing as well. So if a backscatter scanner makes no images and instead just make "boink" (as we all know, scientific progress goes "boink") and then get a TSA massage, i'm fine with that.

I'm not fine with high resolution nude photos of every one just want to fly, i'm not fine with spending millions for back scatter scanners, while the people at security can decide to flip burgers or searching people at almost the same wage, i'm not fine with dumbed down version of this scanners with software to protect the privacy as the bad-guys will find ways to use this dumbing-down to fool this device (i want just simple logic .. there is something else than your leather underpants or your latex bra under your clothing .... "boink" -> TSA massage). I'm not fine with with maximal invasive security counter measures, that just helps against past attacks, but not against future attacks.

The same politicians that force us into this back scatter scannings will be the first ones that will cry when the "Bild Zeitung" will publish the length of their private parts. Who prevents someone who can flip burgers for the same wage to get bribed for not seeing a bomb in his or her shift or for writing down interesting information about prominent people. In former times we used well-paid public servant for this task to reduce this risk ... but today.

And at the end those back scatter scanning is somehow futile anyways: Drug dealers found out that it's quite simple to hide drugs inside a person. Backscatter can't detect it, as it stops at the first layer of the skin. So what's the problem to substitute the cocaine with Semtex to create a not-so-intelligent bomb?