OpenSSL Is No Reason To Go All Twitter

Recommendation::Crypto
Audience::Intermediate
UUID: b3ae8f36-426c-4b6c-9464-19033c6808e5

Must...resist...the Power of the Force.

I have never been so tempted to post a few very snappish things that really could be effectively done in 140 characters. Security drama marketeers that were hoping for another major flaw in OpenSSL yesterday, instead of a DoS attack, etc.

On Twitter, security seems to be all about teh drama, and I am on record that Drama Indicates FAIL.

OTOH, OpenSSL does deserve come comment. It is so widely deployed that it might justifiably be regarded as Critical Infrastructure, though that term is also drama-bait. Cyber-attacks. a) Oh noes, run in fear, or b) evaluate it in terms of your threat model, and make rational decisions. I am big fan of b.

It turns out that there is a very good cheat-sheet for OpenSSL. Ivan Ristik has published a revision of OpenSSL Cookbook. It isn't exactly how I would would have done it, but then Ristick has absolutely no need to emulate some random guy that gets a few hundred hits per month. Because Ivan Ristik, who is a major talent. You have to register to get it in one of several formats, but it is a worthy update. You can also download Apache Security, and Modsecurity Handbook after registration

It does lack a few things, such as an explanation of compiler options, which are pretty much out of scope for a brief overview of the high points. And the openssl speed -evh command-line option will not have any effect on at least some Intel Ivy Bridge CPUs. Though -multi (n), which tells 'openssl speed' how many cores to use very much will. In my tests, it scales in a very linear fashion, as expected. I still have to do plots of cores v temp. Maybe next week.

I note that speed(1), on my system, does not document all command-line options. So, for instance, not knowing about '-multi (n)' will cost you a verification test.

TODO: update the OpenSSL Position Paper.

Just Buy Spam Nation

I am still getting traffic to http://fubarnorthwest.blogspot.com/2014/07/you-can-order-pre-order-krebs-spam.html. I'm not sure why that is. The book is out, to good reviews. For those that prefer audio/video discussion, see http://krebsonsecurity.com/2014/11/spam-nation-book-tour-highlights/ where there are numerous links to media that does not specialize in security matters.

Or just generally follow his blog, dammit. He's already back on ATM skimmers, which can be considered as a separate consumer safety area where he has carved out yet another niche as the go-to information source.

Here at casa de FUBAR, things are a bit busy at the moment, with things that will completely fail to interest most of the public, who just want to know how their confidential information became a $1 item in a foreign black-hat market, and what they can do to fix it.

A couple of those issues I will actually get to write about. That is not a common thing, so I am happy when it does manage to happen. But I have to repeat that this is stuff that, unless you operate in the security field, is technical, of little use to you, and will bore you to tears. In short, a waste of your time.

I'll be writing up my opinion of Spam Nation in the near future, but it will have my own twisted twist, in that it will not be a generic consumer review. Those are everywhere, so that shouldn't matter to you, if you are a consumer trying to understand this FUBAR new world. The book completely wins on that score. Really. Just buy it.

What I want to write is a post that discusses why security professionals should regard Spam Nation as important. The book succeeds on both consumer and professional levels. That is more difficult, and as I mentioned, things are a bit busy right now.

You Can Order Pre-order Kreb's Spam Nation Now

It won't be out until November. For me, that is just in time for what is probably a good read during the start of one of Oregon's famously dreary winters. The krebsonsecurity blog post has more information, and the Amazon pre-order page has an editorial review with an excerpt from Chapter 1. Back in February, Bruce Schneier wrote a Krebs post, with a link to a NY Times profile. So it isn't just me.

Brian Krebs is perhaps uniquely qualified to write such a book, as he has long been intimately involved with the field, has a history of painstaking research, and has undoubted talents as a writer.

I also have an immediate selfish interest in hoping that this book is book is as good (and successful) as I hope it to be. Several of his posts are go-to answers to important questions. The Scrap Value of a Hacked PC, Revisited is good example. I don't have to write a careful response to questions of this nature, because Krebs has been there and done that--far better than I could. I can just send a link.

Here's the thing. Pre-orders are important in establishing the size of a print run. Writing any sort of book is an immense amount of work, which can be essentially wasted in terms of ROI if the books aren't available. Ebooks may mitigate this to some extent, but from what I've read, sales of physical books still matters a lot. 

So, ROI. If his track record is any guide, the Investment has been very large. I'd like his Return to be large as well. You can think of this as a non-immediate selfish goal if, you like. Brian Krebs is a very effective Good Guy, and keeping him in the fight is a useful thing to do. 

Congratulations to Leslie Lamport, winner of the 2013 Turing Award

"Lamport's practical and widely used algorithms and tools have applications in security, cloud computing, embedded systems and database systems as well as mission-critical computer systems that rely on secure information sharing and interoperability to prevent failure."

Many probably think of him mainly as the initial developer of LaTeX, for which I am often personally grateful, but his contributions go far beyond this. Have a look at 

http://amturing.acm.org/lamport and

https://research.microsoft.com/en-us/um/people/lamport/pubs/pubs.html

and form your own conclusions.

During the Ballmer era of Microsoft, there was much heat and noise related to claims that Linux could not innovate. Yet Turing award winners associated with Microsoft were a bit thin on the ground. Not absent: Charles P. Thacker won in 2009, and one of his many accomplishments was helping to establish Microsoft Research Cambridge in Cambridge, England.

Those days are hopefully behind us; it was mostly strategic corporate marketing noise. Microsoft has been been funding his work, by the simple means of employing him, since 2001. Microsoft deserves our thanks as well.

Update: I didn't consider (but should have) that Microsoft would publicize this. That is probably Rule #1 about having a future Turing Award winner on staff, for better than than a dozen years before the award. Everyone involved gets bragging rights for their part in what has always been a demonstrably great hire, the wisdom of which is now getting much wider recognition. Microsoft is justifiably proud. The following video is worth a watch.

Ultimate Adversarial Code Review

Some people hate day-to-day code reviews. I tend to welcome them, and miss them on engagements where I am going it alone. Yes, there is a certain sense of freedom, but some things I miss.

• I will almost undoubtedly learn something
• You can identify people you want to work with (reviewing the reviewer)
• They can save me from an embarrassing 'burning tree' scenario

Sometime politics enters the picture. That is never pleasant, unless you are a politician. I can do politics, but I tend to add fees when dealing with adversarial, politically-charged environments. In short, it is a complete pain in the ass, and I charge more if I have to deal with it on a daily basis.  

That brings up an interesting question. In the limit, what might an engagement that is *all about* an adversarial relationship look like? I have limited (but not zero) exposure to this environment. For instance, it's possible to invisibly (to the user) pre-load objects via Javascript which will then appear in the user's browser cache.

In the context of something like a patent fight, I have an excellent idea of what tools I might need, and how to employ them, but no experience. On the other hand, I know of someone who does. Avi Rubin has a security track record dating back many years, as USENIX members know. His credentials are available at http://avi-rubin.blogspot.com/. Professor of Computer Science and Technical Director of the Information Security Institute at Johns Hopkins University, and it goes back from there...

Avi has spun up another company that specializes in this sort of thing, and has a practical guide on how to procede: http://harborlabs.com/codereview.pdf. This is highly recommended reading.

First Actionionable Item From Snowden NSA Leaks

Here it is, the Fourth of July, and I am putting up a post. That is dedication!

Actually, the barbeque is going, and the spud salad and the rest of it is done. Even though the recent Oregon heat wave has broken, I don't want to be sitting next to that barbeque, since I cleverly placed it in the hottest, most uncomfortable place available. I really need to take care of that. I just spent a couple of hours at a state park, I'll be outside most of the afternoon and evening, and I managed to get a bit of sunburn standing in the river behind my house yesterday, which I do not want to make any worse. So I'm good with being in a nice cool office for a bit, and I'll probably finish up sometime later today.

On June 7, I posted 

NSA overreach: is it actionable, or just random news? in which I intimated that there is little that is actionable from the perspective of a security practioner.

Since then, the revelations have continued, and NSA are about as FUBARed as it is possible to be. The popular press is where much of this is coming from, and this issue is not going away. I may talk about why in another post. I do keep up with this stuff, out of professional interest. Still, you might roughly classify news organizations into members of the

generic mass media,

generic IT media,

pop security media,

technical security media,

though the lines occasionally wander. I use many news sources, which I divide into tiers, based on accuracy, level of detail (these are not the same thing), frequency of update, political skew, etc. Efficiently keeping up with security news (and it must be done efficiently, lest it become a full-time job), is a difficult to do well. Note that this does not include research papers, or what corporate white papers have become over recent years. Those have to be read too, but I don't regard them as media, in the same sense as the above list.

Here is something you do not see every day.  Another piece from The Guardian, New NSA leaks show how US is bugging its European allies, the UK newspaper (generic mass media) which was one the first to take this whole thing public, reveals information on attacks against diplomatic embassies and  missions of the EU and member nations.

The generic IT media and pop security media have already begun to lump this entire thing into PRISM. It's easy to remember and search for, which is an advertising revenue win. Without which, they do not exist. Meanwhile, the generic mass media Guardian is more accurate than generic IT media, or pop security media  in their code names for attacks (NSA will have changed all these the moment they were revealed, but they may become useful search terms, if only for students of history).

BLACKFOOT: French diplomatic mission to the UN

WABASH: French embassy in Washington

BRUNEAU, HEMLOCK: Italian embassy in Washington

POWELL: Greek UN diplomatic mission

KLONDYKE: Greek embassy in Washington

PERDIDO: EU UN diplomatic mission

Crucially, they also provide a graphic related  to DROPMIRE, an attack against secure FAX. Specifically against Cryptofax, a product of the Swiss firm Crypto AG. As an aside, there have been rumors and accusations (since confirmed to my satisfaction) since the 1980s of collusion between Crypto AG and NSA. I am surprised that The Guardian didn't pick up on that.

This where things get actionable, in two areas. The first depends on how technically well-resourced your likely adversaries may be in a pure security context.

That image was enough for Dr. Markus Kuhn, of the Computer Laboratory, University of Cambridge to go on. In a convincing post to Light Blue Touchpaper (technical security media published by the Computer Lab) he has convinced me that this was a TEMPEST attack. Another codename, referring most commonly to radio emanations. Specifically, in this case, to monitoring the radio-frequency energy emitted as the FAX machines laser was switched on and off. That may be very much actionable.

TEMPEST attacks have a long history. I am actually a bit disappointed in the EU, and EU member states for allowing a TEMPEST attack to succeed; note that the home of the University of Cambridge is the UK, an EU member state.

The second area that might be actionable depends on whether you are in the midst of, for instance, sensitive negotiations with German counterparts.

In the real world, even friendly or allied governments spy on one another. Despite the public expressions of shock and dismay that you can expect to hear from members of EU governments, they almost have to. At the nation-state level, even friendly or allied governments do not have completely aligned interests (it's almost as if they are different countries or something), and you need to know if a friendly or allied government is about to stop being friendly or allied. Even if it is limited to a single issue, if that issue is important enough. An intelligence agency that gets this wrong will be said to have suffered an intelligence failure (Google that), and will be barbequed. 

In this case, the other guys have a bit of egg on their faces, as the expertise to prevent this was available to them, but wasn't effectively used. Of course, politicians being much the same in any Western nation, they will hope it blows over, and to attempt to cover with indignation if it does not. Or cover with the 'hackers on steroids' defense that was used by so many US organizations who were hacked to the bone by the script-kiddies of Anonymous. This is entirely predictable.

Make no mistake: this is not going away soon, even if the leaks stopped immediately. The politicians, and NSA, will be disappointed. It is not going to blow over, and will feel the need to be perceived as Doing Something, even if it is The Wrong Something. Repercussions seem likely to be large and long-lived -- consider that a federal election will occur September 22 in Germany. Germany is a NATO ally, the leading economic power of the EU, and a justifiably privacy-sensitive nation. Particularly given what came out about the East German Ministry for State Security (Stasi) before reunification. It has been revealed that NSA collected against Germany, and has classified them as a valid target.

Nor is Germany the only trouble spot that lies ahead.

On a final note, I am not defending all that NSA have done; their surveillance of US citizens, and lying to all and sundry to cover it up are heinous. NSA have a history of doing things that are either dubious, or simply illegal, and they need to be reigned in periodically. I am not defending the politicians who failed to do what they were elected to do, though at least Senators Ron Wyden and Mark Udall of the Senate Intelligence Oversight Committee tried.

There is a far greater likelihood of a whistleblower going to prison than an NSA official who breaks the law. We need to fix that if we intend to become a more just society. Possibly some of the more damaging leaks may have been intended to find a sympathetic ear; to find a safe haven after the hue and cry went up from the US government. If that is the case, a trustworthy whistleblower program would have prevented the majority of the damage to our foreign relations that has so far occurred. 

Whether the service that he has undoubtedly rendered to his fellow citizens by revealing the latest NSA overreach event is outweighed by the damage that he has done to foreign relations is for history, and more practically, a jury of his peers to determine.

Wednesday, August 28, 2013 Update

And the NSA has indeed become an election issue in Germany, according to Der Spiegel, Peer Steinbrück, Chancellor Angela Merkel's challenger in Germany's September general election, called for a suspension of trans-Atlantic free trade Peer Steinbrück, Chancellor Angela Merkel's challenger in Germany's September general election, called for a suspension of trans-Atlantic free trade talks.