Heartbleed: Let’s All Kick The OpenSSL Developers

 Uncategorized  No Responses »
Apr 152014
 

One of the interesting aspects of Heartbleed are some of the criticisms of OpenSSL, the relevant developers, and open source.

Isn’t this the fault of the OpenSSL developers?

Yes, but …

Whilst it is very easy to blame the OpenSSL developers, and ultimately they were the ones who made the mistake of introducing this vulnerability, it is not quite that simple.

What has become clear is that the OpenSSL is chronically underfunded with less than four active developers (only one of whom is full time). This is despite the fact that OpenSSL is probably in roughly 1/2 of all software products including products from technology giants such as Cisco, IBM, HP, Lenovo, etc.

If OpenSSL is underfunded, everyone who makes use of the library in their products should look into why they should not be contributing towards the product. Surely every one of the technology giants could afford to contribute the cost of one developer each towards the project?

Isn’t this the fault of the open source methodology?

No.

Every time a vulnerability crops up, someone blames the development model for the vulnerability. But when you come down to it, both open source and closed source projects contain vulnerabilities.

In theory it is possible for open source to be more secure. Because the source code is publicly available, it can be audited by independent researchers. And that is effectively what seems to have happened – a Google researcher found the vulnerability and informed the OpenSSL developers of the problem.

What went wrong is that the audit happened after the release of the code. To be more secure than closed source, open source needs to be audited before the code is released. Perhaps some automated system that checks every code check in.

Is it the fault of the C programming language?

No, it’s the programmer’s mistake.

But C does make it easy to make mistakes with memory handling although we have to remember that half of this bug was a different sort of mistake – trusting user supplied data. And no matter what kind of language you are using, if you trust user supplied data then attackers everywhere will be chortling.

Back to C’s memory handling. C is a very old programming language and expects the programmer to safely deal with memory management. The best programmers can do this safely, but even those programmers have the occasional Friday afternoon and most programmers are not that good.

A more modern system programming language such as Go or Rust would be very helpful in reducing the possibility of certain types of errors, and there’s a great deal to be said for switching to one or other.

But OpenSSL is written in C, and switching now would be very difficult especially as the OpenSSL library needs to maintain compatibility with hundreds or thousands of programs written to call functions within a C library. Even if that compatibility problem were overcome, rewriting OpenSSL in some other language is an enormous amount of work which is hard to do with just four developers.

US Citizens Helped Fund a 9/11

 General, Politics  No Responses »
Apr 142014
 

It’s a bit ridiculous to compare the two, but if you look at the number of casualties involved, the 9/11 terrorist incident which caused around 2,900 casualties is very roughly comparable in size to The Troubles (with some 3,500 casualties). Of course the troubles consisted of many small incidents over a period of 30-odd years.

During that time, one of the IRA‘s (the “Official IRA”, the “Provisional IRA” and the INLA) principle source of funds were the groups NORAID and Clan na Gael. Which were based in the USA, and raised funds from supporters in the USA.

Or in other words, some US citizens were helping to fund a 9/11.

What’s more anyone who reads the history of the IRA is made very aware that the IRA regarded the US as a safe haven for their “soldiers”.

It’s interesting to contemplate using some the war on terror’s weapons against some US citizens :-

  • Extra-ordinary rendition of US citizens to concentration camps excluded from the protection of the law – so they could be tortured.
  • Freezing of the assets of some US citizens suspected of helping to fund terrorism.

It is perhaps a useful tool to consider whether certain counter-terrorism tactics are a step too far.

 

The Heartbleed Vulnerability Panic?

 Computing, Security  No Responses »
Apr 092014
 

The interwebs are all a flutter over the latest vulnerability announcement – an OpenSSL vulnerability that has been termed the heartbleed vulnerability. But is it that serious? And what is it anyway?

What Is It?

OpenSSL is a very widely used software component that adds encryption – a web server will very likely use OpenSSL to allow it to encrypt communications between yourself and it. The vulnerable versions of OpenSSL come equipped with new functionality – a “heart beat” that is used to keep connections alive and open.

When this functionality is not disabled and you are using a vulnerable version of OpenSSL, an attacker can make a connection to your server and ready up to 64Kbytes of the process memory. For each and every request.

This is a classic information leakage issue, and the attacker can trawl through a collection of 64Kbyte “chunks” of binary data looking for interesting information. In theory, these chunks of information can contain anything the process (the web server, the mail server, etc) contains within itself. Some examples include :-

  1. A researcher has used this vulnerability to expose Yahoo Mail account passwords.
  2. It is believed to be possible to extract a server’s private key to allow an attacker to decrypt communications traffic and/or impersonate the server.

Whilst trawling through binary chunks of data looking for interesting data is the sort of activity that seems to normal people to be so difficult that it would be almost impossible for someone. However it is possible, and for something like passwords is even easy. And for private keys, there are hints out there on how to do it.

But How Does This Affect Me?

If you are not a server administrator, this will all seem a bit geeky and not have much meaning for you.

It is probably better to ask: What should I do about this? And the answer is to do nothing unless you are advised to do so by a trusted source. Whatever damage has taken place already and service providers will be busy fixing the vulnerability.

The only addition to that is to make sure you update your software on your computers – your laptop, phone, tablet, etc. Whilst the media is concentrating on the server side of the problem, OpenSSL is also used on client machines, and that means that your computers are vulnerable in some way – whilst no exploits are known to exist today, it is still worth being proactive in making sure you apply updates.

Because sooner or later, attackers will use this vulnerability to attack you directly rather than via servers.

But How Serious Is This?

Very.

But perhaps not as much as some of the more extreme possibilities might suggest.

There is a great deal of probability involved here. For example, was it possible that this vulnerability was known to the “bad people” before the announcement this week? The vulnerability has existed for a year or two so it is possible it was known about. But probably not widely known.

Was it exploited? Possibly, but it’s probable that it wasn’t widely exploited – the activities of “bad people” tends to leak. If it was exploited, it was quite possible that it was limited to the NSA and GCHQ.

As to over-reaction, there was a comment on a blog entry about this that claimed that his Yahoo Mail account password had been compromised three times in the last month by this method. Well, possibly but it seems far more likely that his password had been compromised via other methods – such as using a weak password. Using this method against Yahoo’s servers may reveal some account passwords, but it is likely to reveal random account passwords each time. Meaning that an attacker will find it quite hard to compromise the password for a single account more than once.

Going forwards, it is very likely that this vulnerability will be used by “bad people” – there are already indications that they may be starting to try this.

So it is important and urgent for server administrators to look at this problem and fix :-

  1. Update vulnerable OpenSSL versions.
  2. Revoke the old SSL certificates
  3. Issue new SSL certificates.
  4. If passwords are known to have been compromised, issue a notice to suggest people change their passwords.

It is also important that client machines are updated as and when fixes are released.

Morecambe Images

 Photography  No Responses »
Apr 022014
 

Not that many images but the idea is to go for quality and not quantity. Boring old black and white too. And no, there’s no colour versions of these.

#1: The Three Scarecrows of Morecambe

The Three Scarecrows of Morecambe

#2: Across The Bay

Across The Bay

#3: The Bird

The Bird

Yes there is a bird flying within this image.

#4: Disappearing Sea

The Disappearing Sea

#5: The Bare Family

The Bare Family

To “get” the pun in the title, it is worth pointing out that this statue was found in Bare … a sub-district of Morecambe.

#6: The Stone Thumb

The Stone Thumb

How To Totally Miss The Point (#nomakeupselfie & #manupandmakeup)

 General, Politics  No Responses »
Mar 222014
 

You would have thought that people would have reacted to the grass roots Cancer awareness campaigns known by their hash tags of #nomakeupselfie and #manupandmakeup either by joining in, or by thinking it’s a bit silly and ignoring it. But no, someone has to miss the point and run off at a tangent.

Now it’s possible that what she writes about women wearing makeup is true … I’m not qualified to judge, although it’s interesting to note that men and women have both been wearing makeup for thousands of years. There’s no signs that women or men started first.

Oh! And just for the record, if a woman pops down the shops early in the morning without wearing makeup and happens to look like a zombie that’s been that way for three weeks, men do not stop, gawk, and then run off down the street shouting “The zombie apocalypse is here”.

But what I do have to take exception to is the idea that the men behind (and in front) of #manupandmakeup are mocking femininity. I don’t think femininity was in their heads at the time, except when looking at a #nomakeupselfi picture and wondering “how can I get involved”.

Because it’s self evident that a campaign that involves taking off your makeup is somewhat tricky for most men to get involved with. Making the switch from taking makeup off to putting makeup on, is a simple and indeed brilliant way of changing that.

If there is any mocking involved, it’s self-mockery. Men are deliberately making themselves look ridiculous to make a point.

And just for the record, it’s noticeable just how many #nomakeupselfie pics come complete with a statement along the lines of “nothing you haven’t seen before”.

 Older Entries  Newer Entries