http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2015-07-26 08:27:49 - Security : I just released vsftpd-303, as noted on the vsftpd home page It's actually been almost three years since vsftpd-302, so things do seem to be getting very stable and calming down The exception to things getting very stable and calming down seems to be SSL over FTP, which has been a constant source of, uh, joy, for some time now Some issues fixed relate to security and warrant describing here because I think they are interesting Cross-protocol MITM SSL connection rewiring to effect XSS If this description sounds like a crazy weird vulnerability, you're right The best public description is probably in this ProFTPd bug Pretty awesome work by Jann Horn It's a sufficiently involved issue that it's hard to pin down a root cause, but my primary take away would be use different SSL certificates for different protocols It's hard to predict what other cross-protocol confusions might be possible and different certificates for different protocols helps protect against the unknown That all said, vsftpd-303 drops the FTP connection if it sees HTTP command verbs, thus avoiding one known trouble for anyone who has an unfortunate certificate and server setup SSL session re-use workaround can be thwarted Back in 2008, I blogged about a simple yet powerful attack which permitted stealing of in-progress FTP SSL data transfers In the 2008 post, I seem to blame FTP clients but I don't think that's correct the FTP protocol itself is broken for SSL transfers That was 7 years ago so perhaps I could have driven an RFC to fix the protocol by now mea culpa In the face of a broken protocol, I've been working with Tim Kosse of FileZilla fame to try and kludge around the situation for years The most solid solution is client certificate matching but that is not something that FTP clients do by default, and we wanted better security by default Accordingly, vsftpd started to authenticate SSL data connections by requiring session re-use on SSL data connections This did seem to work by default in many FTP clients Unfortunately, you can now go and read how Tim Kosse broke this defense The kludge piled on top of existing kludges is to terminate the full FTP session in the event of an SSL session re-use failure on the data channel Are we done with kludge stacking We hope so but it's hard to be sure SSL upload data connections now must be shutdown correctly at the SSL layer vsftpd-303 flipped a default setting so that SSL upload data connections must now be shutdown correctly at the SSL layer Absent this setting, the FTP server can't tell whether the upload connection was closed with a TCP FIN which any MITM can inject vs a proper shutdown over the SSL channel secure To put it in plainer terms, without this setting, the FTP server can't tell if a network attacker deliberately truncated the upload or not I documented this area in 2008 proposed root cause the OpenSSL API is bad At the time, FTP clients and servers were universally rubbish at SSL connection shutdown integrity Since then, things are better, so I've flipped the default Again, if you're using FileZilla as the FTP client, it goes to pains to do SSL well ECDHE support Thanks again to Tim Kosse this guy is on fire , there's ECDHE support in vsftpd-303 It turns out that you need to incant a few magic lines of OpenSSL API in order to enable ECDHE Also, just to make the point, vsftpd's default cipher list now consists of the single cipher ECDHE-RSA-AES256-GCM-SHA384 This is a modern TLSv12 cipher that is believed pretty solid People needing interoperability with older clients may need to change or disable the cipher list FTP SSL data security is kind of tricky, and probably isn't 100pourcents dealt with yet, but the combination of the latest FileZilla latest vsftpd should be a reasonable start, if you really must use SSL over FTP http://www.secuobs.com/revue/news/578379.shtmlhttp://www.secuobs.com/revue/news/578379.shtml Secuobs.com : 2014-09-27 11:41:02 - Security - Prelude sorry, this has nothing to do with security whatsoever Feel free to bail now if you're not interested in a classic 1980's game, and rest assured that non-security posts to this blog will remain extremely rare The BBC Micro game Exile, released in 1988, has a realistic claim for the best game ever I lost months of my youth to this game I also lost a fair few days recently re-playing the game under emulation in 2014 What the authors were able to do with just 32KB for everything, including video RAM was amazing The art of coding in this way has simply been lost The game features An enormous map featuring fairly open-ended exploration A full physics engine gravity, momentum, conservation of momentum, buoyancy, friction Dozens of fiendish puzzles, characters and objects, with many interactions between entities There's even a great disassembly online I was quite surprised to see that the game really is powered by real 6502 opcodes, and not unicorn tears The claim for best game ever isn't just about packing so much into such a small resource Completing the game, even if you know what you're doing, is hours of immersive play that alternates between solving very varied puzzles and arcade-like blowing stuff up Given how free-form the game is, there are also different solutions and orderings to to the game, so you can put your own personal spin on things If you want to see what all the fuss is about, the best emulator is probably B-em part of a webring, remember those and the Exile game image can be readily found And do feel free to stop reading to avoid the spoilers that now follow There seem to be two solutions published on the web Unfortunately, both have triggered my OCD Both have solutions for some of the more interesting problems that rely on abusing the limits and corner cases of the game engine, such as Using the built-in viewport scrolling to sneak around with the viewport scrolled to the extreme so that an enemy or obstacle does not see the player Abusing the fact that the physics engine forgets objects that are offscreen, causing corner-case and clearly unintentional behavior Give the poor game a break, it's trying to fit everything into 32KB Proposing solutions with low reliability More significantly, these problems have such beautifully elegant solutions that once you see them, it's clear that you've worked out the authors' original intent So without further ado, here is a small collection of videos that illustrates some elegant solutions as well as an easter egg Getting the alien weapon The game features a tricky-to-get alien weapon In fact you can get it from two different places Generally, you can feed different types of imps different gifts and then they might later throw you a gift in return In this video, these cyan imps will accept a blue mushroom Later in the game, dark blue imps accept piranhas I had found this later exchange, but this earlier exchange was a complete surprise to me -- I only noticed it reading the disassembly referenced aboveIt's a real boon to get such a powerful weapon earlier in the game It never runs out of energy and it has good destructive power for some obstacles that are otherwise annoying Just watch out you don't burn yourself and that you don't blow the weapon up, it's destructible Getting the first coronium rocks out of the alcove There's no need to try and force the rock past the blowing bush Speedy throwing and viewport scrolling are not necessary There's a simple, elegant sequence that will rescue it reliably and without dubiousness Blowing open the rune door The first two-thirds or so of the game are building up towards opening a very important door into the bad guy's lair This door is blown open with a nuclear explosion between two radioactive rocks Given the importance of the door, it's not surprising that the final puzzles towards opening it have beautiful solutionsBoth published solutions transport radioactive rocks via a route that is clearly not supposed to be an option, and the route only works on account of abusing game engine quirks Tut tut Here's a less hacky way of getting the required rocks, in three parts There's a lot going on here In part 1, the use of the maggot to wake up the nest of green slimes is fun Note that this doesn't always work Game design bug This is a very busy area of the map and the game engine often decides there's too much on-screen to spawn creatures from the nest I lost a day stepping through 6502 assembler to understand this Then, the green slimes appear attracted to sound So we made some noise The use of buoyancy to avoid the sucking bush is the first and only significant usage in a puzzle Wonderful In part 2 and 3, the presence of the big fish prevents the very dangerous piranhas from coming out the nest and ruining your day In part 3, the piranha is actually immune to damage from acid drops -- I believe the only creature in the game that has this trait You can even check the disassembly - Getting the mushroom immunity pill Again, this puzzle involves blowing a door open with radioactive rocks The published solutions suggest all sorts of hacks here, but there's a really neat solution with the blaster weapon that has been recently collected at this stage in the game Previous weapons were projectile based but this one is force based and it can be used variously at a distance to gently deviate the course of an acid drop, and then at close range to reliably launch a rock past a problem area Happy exploring http://www.secuobs.com/revue/news/537160.shtmlhttp://www.secuobs.com/revue/news/537160.shtml Secuobs.com : 2014-09-25 20:48:23 - Security - AddressSanitizer, or ASAN, is an excellent tool for detecting subtle memory errors at runtime in C C programs It is now a productionized option in both the clang and gcc compilers, and has assisted in uncovering literally thousands of security bugs ASAN works by instrumenting compiled code with careful detections for runtime errors It is primarily a detection tool But what if we attempted to use is as a tool for protection The case for using ASAN-compiled software as a protection is an interesting one Some of the most severe vulnerabilities are memory corruptions used to completely compromise a victim's machine This is particularly the case for a web browser If an ASAN-compiled build can help defend against these bugs, perhaps it has value to some users An ASAN build is slower enough that no production software is likely to ship compiled with ASAN But the slow down is not so bad that a particularly paranoid user wouldn't be able to easily accept it on a fast machine With that trade-off in mind, let's explore does ASAN actually provide protection To answer that, let's break memory corruption down into common vulnerability classes 1 Linear buffer overflow heap, stack, BSS, etc A linear buffer overflow is one where every byte past the end of a buffer is written in sequence, up to some end point example For example, a memcpy or strcpy based overflow is linear Because of the way ASAN works, I believe it will always catch a linear buffer overflow It uses a default redzone of at least 16 bytes, ie touching _any_ address within 16 bytes of a valid buffer will halt the program with an error Under ASAN, a linear buffer overflow condition will always hit the redzone This is great news because linear buffer overflows are one of the more common types of security bugs, and they are quite serious, affording the attacker a lot of control in corrupting program state 2 Non-linear buffer overflow A non-linear buffer overflow is one where data is written at some specific but often attacker-controlled out-of-bounds offset relative to a buffer example These bugs can be extremely powerful Unfortunately, because of their power, they are both favored by attackers and also not stopped by ASAN if the attacker knows they are targeting an ASAN build Example C program int main char p malloc 16 char p2 malloc 16 printf p, p2 pourcentsp, pourcentsp n , p, p2 p2 31 ' 0' Compile it with ASAN clang -fsanitize address and then run it and no error will be detected The bad dereference jumps over the redzone to corrupt p2 via pointer p 3 Use-after-free double-free ASAN does detect use-after-frees very reliably in the conditions that matter for current use cases normal usage, and under fuzzing However, if the attacker is specifically targeting an exploit against an ASAN build, they can pull tricks to still attempt the exploit By churning the memory allocator hard as is trivially possible with JavaScript , the condition can be hidden Example C program int main int n 257 1024 1024 char p2 char p malloc 1024 printf p pourcentsp n , p free p while n p2 malloc 1024 if p2 p printf reused n free p2 n - 1024 n 30 1024 1024 while n p2 malloc 1024 if p2 p printf reused n n - 1024 p 0 'A' The bad reference is not trapped with default ASAN values The default values can be changed such that the bad reference is trapped ASAN_OPTIONS quarantine_size 4294967295 aout It's a shame that setting this value to unlimited may not be possible due to a probable integer truncation in parameter parsing, see how this behaves differently ASAN_OPTIONS quarantine_size 4294967296 aout 4 Uninitialized value Uninitialized values are harder to categorize The impact varies drastically depending on where the uninitialized value is a pointer or an integer For example, for an uninitialized pointer, effects similar to non-linear buffer overflow might even apply Or if the uninitialized value is a copy length then perhaps it's more similar to linear buffer overflow Or, if it's an uninitialized raw function pointer, that's a bigger problem Indirect jumps are not checked The behavior of the following ASAN-compiled program is instructive run it in the debugger void subfunc1 unsigned long long blah 0x0000414141414141ull void subfunc2 int funcptr void funcptr int main subfunc1 subfunc2 If the uninitialized value is a pointer to a C class then similar indirect problems apply 5 Bad cast The effects of a bad cast are fairly varied Perhaps the bad cast involves mistakenly using an integer value as a pointer In this instance, effects similar to non-linear buffer overflow might be achievable Or perhaps if a pointer for a C object is expected, but it is mistaken with a pointer to a raw buffer, then a bad vtable gets used, leading to program flow subversion One final C example to illustrate this Run under ASAN to observe a raw crash trying to read a vtable entry from 0x0000414141414141 class A public long long val class B public virtual void vfunc int main class A a aval 0x0000414141414141ull class B pb class B pb-vfunc Safer ASAN There's certainly scope for a safer variant of ASAN, specifically designed to provide safety rather than detection It would be based on various changes Change the dereference check from is this dereference address ok to is this address in bounds for this specific pointer This takes care of the nasty non-linear buffer overflow as well as some of the worst effects of bad casts This is not an easy change Initialize more variables pointer values on the stack and heap This is not as easy as it sounds, particularly for the heap case, where the casting operator may become a point of action Make the quarantine size for use-after-free unlimited This burns a lot of memory, of course, but may be acceptable if fully unused pages are returned to the system with madvise or even a crazy remap_file_pages trick Remaining risks Of course, even a safer ASAN build would not be bullet-proof Taking the specific case of an safer-ASAN compiled Chromium, there would still be additional attacks possible Plug-ins Many plug-ins are closed source and therefore cannot be replaced with ASANified versions The safer build of Chromium would have plug-ins disabled --disable-plugins or even at compile time Native attack surfaces called by the browser For example, what happens when the browser encounters a web font It'll probably get passed to a system library which parses this dangerous format using native code In extreme cases, such as older Chromium on Windows, fonts were parsed in the kernel --disable-remote-fonts, probably other flags Native attack surfaces triggerable by the browser Less obviously, there can be operating system mechanisms that kick in simply because a file is downloaded or appears on disk Anti-virus is notoriously buggy in this regard The v8 JIT engine Any logic error in the JIT engine resulting in the emission of bad opcode sequences, or sequences with buggy bounds checks, are pretty toxic Pure logic vulnerabilities UXSS vulnerabilities will remain unmitigated In extremely rare but spectacular cases, unsandboxed code execute has been achieved without the need for memory corruption at all That all said, a stock ASAN build -- and even more so a hypothetical safer-ASAN build -- provide significant mitigation potential against memory corruption vulnerabilities One measure of how strong a mitigation is, is whether is totally closes the door on a subset of bug classes or bugs Even for the stock ASAN case, it appears that it does linear buffer overflows for a start There is certainly more room for exploration in this space http://www.secuobs.com/revue/news/536865.shtmlhttp://www.secuobs.com/revue/news/536865.shtml Secuobs.com : 2014-06-06 00:44:12 - Security - A couple of years ago, during an idle moment, I wondered what we could do if we had the hardware CPU primitive of pages with permissions execute-only ie no read and write https twittercom scarybeasts status 174901935340666881 It turns out that aarch64 has exactly such support Here's support heading in to the Linux kernel https gitkernelorg cgit linux kernel git cmarinas linux-aarch64git commit h upstream id bc07c2c6e9ed125d362af0214b6313dca180cb08 The original idea was to defeat ROP by having all of the instructions randomized a bit on a per-install basis You know, the usual tricks such as applying equivalence transforms on the opcode stream Such an approach would have some obvious downsides such as diagnosability and let's face it, implementing this would also feel a bit hacky Can we do better Maybe we can The original idea focused on the attacker knowing where the binaries are in virtual address space, but not knowing or being able to read or otherwise predict the content What if we instead keep the binary content stable but try and make sure the attacker cannot discern the location of the binaries With enough ASLR entropy, this would be an interesting approach For the sake of the exercise, imagine the attacker has the most powerful of bugs an arbitrary read write primitive relative to an existing heap location The attacker can follow heap pointers to the stack, the BSS, vtables, etc At first, this sounds prohibitively hard to deal with But for every way the attacker might try to leak the address of the binary, there currently seems to be a solution The heap is riddled with vtable pointers If the attacker follows a vtable pointer, they get to read function pointers and the location of the binary is revealed We fix this in one of two ways either get sneaky and turn vtables into code jmp 0xblah instead of data, and reuse our exec-without-read primitive Or we burn a register aarch64 has lots as a storage for a secret ASLR base for the binary The heap is riddled with raw function pointers We can redo function pointers as something like single-slot vtables and use the above trick We don't want to directly store function pointers in writable memory as a relative position to our secret register, because the attacker could then easily jump to an arbitrary point in the binary The BSS and data sections are typically stacked adjacent to the binary We need to not do this, so that pointers into the BSS and data sections do not reveal the location of the binary The stack contains saved return addresses These return addresses reveal the address of the binary And for sure, the heap will contain pointers to the stack from time to time Separating your stack into control flow and data will sort this out -- perhaps burning another register to keep the control flow stack separate and at a secret location JIT engines are a pain And your heap is going to contain chains of pointers leading to the JIT pages Depending on the type of JIT engine, there are various tricks that can be pulled Enumerating them here is going to make the post too long Some of the more amusing tricks including having the kernel ban syscalls from a writable page Perhaps at this point we decide that the hacks are piling up and add an indirection to all indirect jumps that uses a secret register for the binary location, and an offset into a table of valid jump locations I think this maybe where comex was heading in a tweet in a discussion today https twittercom comex status 474656633281196032 Such a system isn't going to be invulnerable to memory corruption, but it _is_ going to be a significant pain to attack The most obvious remaining attack is probably to read a couple of different vtable pointers and interchange them, calling an arbitrary attacker-chosen _existing function_ in the binary If your binary has function pointers to system in the heap, you're going to be in trouble But generally, going after the kernel is going to be hard Valid functions in your binary are unlikely to have the side effect of calling syscalls with bad parameters We also find ourselves wondering if we've sort-of re-implemented something like NaCl, although the performance characteristics and granularity of attacker-chosen code blocks will be different Crazy idea Plausible direction Thanks to Lee Campbell for helping with discussions and this blog post http://www.secuobs.com/revue/news/517386.shtmlhttp://www.secuobs.com/revue/news/517386.shtml Secuobs.com : 2014-03-21 22:56:28 - Security - A couple of weeks back, I released a popular spreadsheet which lists many of the Adobe Flash Player 0-days used to harm people in the wild since 2010 I counted 18 and countless kind Twitterers pointed out some I may have missed It was an interesting exercise, of course with an ulterior motive Looking beyond the raw counts, the spreadsheet shouts two items We should want to make a difference The harm done from all these 0-days is just a litany of awfulness We have harm to democracy activists and the human rights organizations that try to help these people We have harm to American defense interests, aka espionage We have harm to corporations, aka theft and economic damage We can make a difference If you look at the data, you'll see 7 memory corruption 0-days in a year, starting mid-2010 After this year, Tavis Ormandy's famous Flash security rampage landed 80 fixes , with follow-up patches such as 7 fixes here Almost a year passes between Flash memory corruption 0-days after Tavis' work You should call him a hero You should also call Mateusz Jurczyk, Gynvael Coldwind and Fermin Serna heroes too They continued Tavis' work, have a look at the CVE count in this Adobe advisory to appreciate their work Whilst it's true that Flash 0-days have seen a resurgence in Dec 2013 - Feb 2014, this does not invalidate the data that the whitehat community made a difference in 2010 - 2011 onwards If anything, the data suggests that attackers have regrouped and refocused their research efforts to target areas that are still fertile We can certainly do the same and put down this resurgence How you can help make a difference Join us in the whitehat world When you entered the greyhat world, they told you you'd be helping catch terrorists, didn't they Recent and ongoing revelations show that no, in fact the biggest use of your work was enabling mass surveillance, the compromise of foreign nations and even the compromise of foreign corporations If you want to make an actual difference, see above for where defensive help is needed Join us working on Flash and other important software Many of us are working hard to provide reasonable avenues of reward for those who work on important software in the whitehat community For example, the Internet Bug Bounty includes Flash as a category For Flash vulnerabilities where exploitability is near-certain, we're rewarding up to 10,000 -- we have rewarded at this level three times already We also anticipate 5,000 as a popular reward level for vulnerabilities that are likely exploitable but not proven I previously blogged about 10,000 example here What are you waiting for Join us and we'll make a difference You'll get some good coin as a side-effect http://www.secuobs.com/revue/news/504293.shtmlhttp://www.secuobs.com/revue/news/504293.shtml Secuobs.com : 2014-02-20 10:17:03 - Security - One of my side projects is as an adviser and panelist for the non-profit Internet Bug Bounty IBB We recently added Adobe Flash Player as in scope for rewards Earlier today, David Rude collected 10,000 for a vulnerability recently fixed in APSB13-28 My thoughts on this are too long to fit into a tweet, so I summarize them here This shows that the IBB is serious about rewarding research which makes us all safer 10,000 is a respectable reward by modern bug bounty program standards It is also shows that when we give the reward range as 2000 - 5000 , we are serious about that little plus character David Rude is a hero This vulnerability was found being exploited in the wild Recent research by Citizen Lab has linked the exploit to a morally dubious company, targeting of journalists and regimes with poor human rights records Getting this bug fixed is a service to all internet users, democracy and human rights The IBB culture is to err on the side of paying Note that David did not discover the vulnerability himself he discovered someone else using it IBB culture is to look mainly at whether a given discovery or piece of research helped make us all safer Our aim is to motivate and incentivize any high-impact work that leads to a safer internet for all The vulnerability was never in fact reported to IBB Wait, wut It's true The vulnerability went via Adobe's standard channels IBB does not want or need details of unfixed vulnerabilities -- that would violate strict need-to-know handling Once a public advisory and fix is issued, researchers or their friends may file IBB bugs to nominate their bugs for reward Or, for important categories such as Flash or Windows Linux kernel bugs, panel members keep an eye out for high impact disclosures and nominate on the researchers' behalf Because we care Join us for the common good of a safer internet You can help by doing your research in the open, targeting high-impact vulnerabilities or even becoming a new corporate sponsor If we all pull together we can make a difference http://www.secuobs.com/revue/news/498860.shtmlhttp://www.secuobs.com/revue/news/498860.shtml Secuobs.com : 2013-12-30 03:08:35 - Security - Recently, there's been a reasonable amount of activity in the vtable protection space Most of it is compiler-based For example, there's the GCC-based virtual table verification, aka VTV There are also multiple experiments based on clang LLVM and of course MSVC's vtguard In the non-compiler space, there's Blink's heap partitioning, enabled by PartitionAlloc It seems, though, that these various techniques require the user to choose between fast or thorough protection This isn't ideal Shortly, I'll document my own idea for how to try and get both fast and thorough But first, a recap on what we mean by fast and thorough Fast vtable protection Protecting vtables typically involves inserting machine instructions around vtable pointer load or virtual calls Going fast is simple only insert a very small number of fast instructions ie no hard-to-predict branches This is the approach taken by vtguard If you look at page 14 in the vtguard PDF linked above, you'll see that there's just a single cmp and a single jne short, and never taken in normal execution added to the hot path Tangentially, another task commonly undertaken when adding vtable protections to a given program is to remove as many virtual calls as possible, by annotating classes and methods with the final keyword and or applying whole-program optimizations Thorough vtable protection Describing what we want in a thorough vtable protection is a little more involved We want Defeating ASLR does not defeat the vtable check vtguard lacks this property, whereas the GCC implementation has it Only a valid vtable pointer can be used Furthermore, only a vtable pointer corresponding to the correct hierarchy for the call site can be used Ideally, only a vtable pointer corresponding to the correct hierarchy level for the call site can be used A fast solution for thorough vtable protection How can we get all of the protections above and get them fast My idea revolves around separating the problem into two pieces 1 Work out whether we can trust the vtable pointer or not 2 Validate that the class type represented by the vtable pointer is appropriate for the call site To trust or not to trust Current schemes trust the vtable pointer or not, based either on an some secret vtguard, xor-based LLVM approach , a fixed table of valid values GCC, some LLVM approaches or by constraining values that might appear in the vtable position heap partitioning The new scheme would be to reserve a certain portion of the address space for vtables We know that nothing else can be mapped there, so by suitably masking any proposed vtable pointer, we know it is valid I haven't fully thought this through for 32-bit, but look at this 64-bit variant Host vtables in the lower 4GB of address space Use the dereference of a 32-bit register to load the vtable entry This provides masking for free and even saves a byte in the instruction sequence It works because loading 4-bytes into a 64-bit register zero extends the result Optionally, save memory by having the compiler use 4-byte vtables This scheme is approximately free, maybe even performance positive in some situations Furthermore, one possible implementation is to stop somewhere around here for a very fast protection scheme that is ok in thoroughness On the downside, you've lost the 64-bit invariant that nothing is mapped in the bottom 4GB , but the percentage of space used is going to be small If that bothers us, then we can use the same trick to load a 4-byte vtable pointer and then or it with 0x100000000 use bts if you dare or some other value Validating class type Once you know you trust your vtable pointer, validating the class type becomes a lot simpler Instead of messing with secrets inside the vtable, you can just store a compact representation of the class type inside the vtable, with the aim of satisfying validation needs with a single compare The one trick we want to play is to make it easy to validate various different positions in a class hierarchy with minimal work To do this, we can store class details in a hierarchical format To take a simple case, imagine that we have the following classes in the system A1, A1 B1, A2, A2 B1, A2 B1 C1 We encode these using one byte per hierarchy level, the basemost class being the LSB 00000001, 00000101, 00000002, 00000102, 00010102 Note that this will be an approximation For example, if you have more than 256 basemost classes with virtual functions, you would need to represent the first level with 2 or more bytes Finally, our is this object of the correct type for the callsite check becomes a simple compare Depending on the position in the hierarchy, we may be able to achieve the compare with no masking and therefore a single instruction For example, for a call site expecting an object of type A1, it's just cmpb 1, pourcentseax That's a 4-byte sequence, which is much shorter than the 10-byte sequence noted in the vtguard PDF For a call site expecting an object of type A2 B1, it's cmpw 0x102, pourcentseax Closing notes Will it work well Who knows I haven't had time to implement this, nor am I likely to in the near future Feel free to take this and run with it Note that this idea doesn't cover what to do with raw function pointer calls If you want to head towards complete control flow integrity, you'll want to look at protecting those, as well as return addresses the current canary-based stack defenses do nothing against an arbitrary read write primitive http://www.secuobs.com/revue/news/488817.shtmlhttp://www.secuobs.com/revue/news/488817.shtml Secuobs.com : 2013-02-04 00:30:02 - Security - Back in November 2012, a Chrome Releases blog post mysteriously stated Congratulations to Pinkie Pie for completing challenge 64-bit exploit Chrome patches and autoupdates bugs pretty fast but this is a WebKit bug and not every consumer of WebKit patches bugs particularly quickly So I've waited a few months to release a full breakdown of the exploit The exploit is notable because it is against 64-bit Linux 64-bit exploits are generally harder than 32-bit exploits for various reasons, including the fact that some types of heap sprays are off the table On top of that, Linux ASLR is generally better than Windows ASLR although not perfect For example, Pinkie Pie's Pwnium 2 exploit defeated Win 7 ASLR by relying on a statically-addressed system object That sort of nonsense is generally absent from Linux ASLR Without any further ado, I'll paste my raw notes from the exploit deconstruction below The number of different techniques used and steps involved is quite impressive The bug A single WebKit use-after-free bug was used to gain code execution The logic flaw in WebKit was reasonably simple when a WebCore HTMLVideoElement is garbage collected, the base class member WebCore HTMLMediaElement m_player -- a WebCore MediaPlayer -- is freed A different object, a WebCore MediaSource, holds a stale pointer to the freed WebCore MediaPlayer The stale pointer can be prodded indirectly via Javascript methods on either the JS MediaSource object, or JS SourceBuffer objects owned by the JS MediaSource The exploit The exploit is moderately complicated, with multiple steps and techniques used Pinkie Pie states that the complexity is warranted and generally caused by limited lack of control, and therefore limited options for making progress at each stage The exploit steps are as follows 1 Allocate a large number of RTCIceCandidate objects 100000 and then unreference a small subset of them tempia new Uint32Array 176 4 rtcs rtcstring 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' rtcdesc 'candidate' rtcstring, 'sdpMid' rtcstring for var i 0 i WebCore MediaSource - WebCore MediaPlayer - virtual WebKit WebMediaPlayerClientImpl You ll notice that the call chain bounces through the WebCore MediaPlayer, which is freed However, the only access is to the WebCore MediaPlayer m_private member at offset 72 delete ing the object only interferes with the first 16 bytes on account of tcmalloc writing two freelist pointers and the WebCore MediaPlayer m_mediaPlayerClient member The WebCore MediaPlayer free slot isn t otherwise meaningfully re-used by this point What happens next is fascinating WebCore MediaPlayer sourceSetTimestampOffset dissassembles to 0x00007f61a0ced4c0 mov rdi,QWORD PTR rdi 0x48 0x00007f61a0ced4c4 mov rax,QWORD PTR rdi 0x00007f61a0ced4c7 mov rax,QWORD PTR rax 0x208 0x00007f61a0ced4ce jmp rax This loads the vtable for the WebCore MediaPlayer m_private member and calls the vtable function at 0x208 WebCore MediaPlayer m_private is supposed to be a WebKit WebMediaPlayerClientImpl object but a WebCore SourceBufferList was overlayed there WebCore SourceBufferList objects have a vtable, but a much smaller one Offset 0x208 in this vtable hits a vtable function in a totally different vtable, specifically WebCore RefCountedSupplement RefCountedSupplement, which disassembles to 0x00007ffd9ec51e00 lea rax, rip 0x3276969 0x00007ffd9ec51e07 mov QWORD PTR rdi ,rax 0x00007ffd9ec51e0a jmp 0x7ffd9e5b2c80 As these opcodes execute, rdi is a this pointer for a WebCore SourceBufferList object which the calling code believed was a this pointer to a WebKit WebMediaPlayerClientImpl object As you can see, the side effects of these opcodes are - Trash the vtable pointer of the WebCore SourceBufferList object - Do a free this , ie free the WebCore SourceBufferList object - Return cleanly to the caller 4 Use HTML5 WebDatabase functionality to allocate a SQLStatement as a side effect transactionexecuteSql 'derp', , function , function slength sbllength A WebCore SQLStatement object is 176 bytes in size So it is allocated into the slot just vacated by free ing the WebCore SourceBufferList object in step 3 above This is the same slot that we free d the WebKit WebMediaPlayerClientImpl from There are now two Javascript objects pointing to freed objects a direct handle to a freed WebCore SourceBufferList sbl and an indirect handle to a freed WebKit WebMediaPlayerClientImpl buffer At this time, a call is made in Javascript to sbllength It is not required for the exploit and nothing is done with the integer result, but looking at this call under the covers is instructive To return the length, a 64-bit size_t is read from offset 136 into the WebCore SourceBufferList object Since a WebCore SQLStatement was put on top of the freed WebCore SourceBufferList, the actual value read is a WebCore SQLStatement m_statementErrorCallbackWrapper m_callback member pointer Leaking this value to Javascript might be useful as it is a heap address However, Javascript lengths are 32-bit so only the lower 32-bits of the address are leaked The entropy that s important for ASLR on 64-bit Linux is largely in the next 8 bits above the bottom 32 bits, so the heap address cannot be usefully leaked Exploitation of similar overlap situations would not be a problem on systems with 32-bit pointers 5 Abuse overlapping fields in SourceBufferList vs SQLStatement sb sbl 0xa8 8 Next, the Javascript array index operator is used At this time, the Javascript handle to the WebCore SourceBufferList is actually backed by a WebCore SQLStatement object at the C level The WebCore SourceBufferList m_list member is a WTF Vector and that starts with two important 64-bit fields a length and a pointer to the underlying buffer As covered above, the length now maps to a pointer value A pointer value, when treated as an integer, will be very large, effectively sizing the vector massively And the vector s underlying buffer pointer now maps to the member SQLStatement m_statementErrorCallbackWrapper m_scriptExecutionContext Therefore, the Javascript array operator on JS SourceBufferList will return a JS SourceBuffer object which is backed in C by a pointer pulled from somewhere in a C WebCore ScriptExecutionContent object, depending on the array index The exploit uses array index 21, which corresponds to offset 168, or WebCore ScriptExecutionContext m_pendingExceptions This is a pointer to a WTF Vector So, there is now a Javascript handle to a JS SourceBuffer object which is really backed by a WTF Vector 6 Read vtable value as a Javascript number converterF64 0 sbtimestampOffset In C , the timestampOffset property is read from a 64-bit double at offset 32 of the WebCore SourceBuffer object The WebCore SourceBuffer object is currently backed by a WTF Vector object, which is 24 bytes in size and lives in a 32 byte tcmalloc slot Therefore, a read at offset 32 will in fact read from the beginning of the next tcmalloc slot Looking back to step 1, it was arranged to be likely that the adjacent 32 byte slot will contain a WebCore WebCoreStringResource object Therefore, the WebCore WebCoreStringResource vtable is read and returned to Javascript as a number Javascript numbers are 64-bit doubles so there are no truncation issues like those discussed with reading an integer length above in step 4 That s a lot of effort, but finally the exploit has leaked a vtable value to Javascript For a given build of Chrome, it is now easy to calculate the exact address of all opcodes, functions, etc in the binary 7 Re-trigger use-after-free and back freed object with array buffer buffer2 ms3addSourceBuffer 'video webm codecs vorbis,vp8 ' vid2parentNoderemoveChild vid2 vid2 null gc var ia new Uint32Array 168 4 rtc2 new webkitRTCPeerConnection 'iceServers' This time, the freed WebKit WebMediaPlayerClientImpl is replaced with a 168 raw byte buffer that can be read and written through Javascript This is now a useful primitive because ASLR was defeated and a useful vtable pointer value can be put in the first 8 bytes of the raw byte buffer A WebCore RTCPeerConnection is also allocated 264 bytes to occupy the slot for the freed WebCore MediaPlayer This protects the freed WebCore MediaPlayer from corruption Significantly, it makes sure nothing overwrites the WebCore MediaPlayer m_private pointer This pointer is needed intact It is at offset 72 and WebCore RTCPeerConnection does not overwrite that field during construction 8 Leak address of a heap buffer under Javascript control add64 converterI32, 0, converterI32, 0, -prepdata 'found_vt' add64 ia, 0, converterI32, 0, prepdata 'mov_rdx_112_rdi_pp' add64 ia, 0, ia, 0, -0x1e8 var ib8 new Uint8Array 0x10000 var ib new Uint32Array ib8buffer buffer2append ib8 var ibAddr ia 112 4 , ia 112 4 1 Using knowledge of the binary layout, a vtable value is chosen that will result in the WebCore MediaPlayer sourceAppend vtable call site calling the function v8 internal HStoreNamedField SetSideEffectDominator An appropriate function name It disassembles to 0x00007f153efd7340 mov QWORD PTR rdi 0x70 ,rdx 0x00007f153efd7344 ret As can be seen, the value of rdx the 2nd non-this function parameter is written to offset 112 of this this is backed by a raw buffer pointer for the ia Javascript Uint32Array and rdx in the context of WebCore MediaPlayer sourceAppend is a raw buffer pointer for the ib Javscript Uint32Array Therefore, the address of a heap buffer under the control of Javascript has been leaked to Javascript 9 Proceed as normal The exploit now has control over a vtable pointer It can point the vtable pointer at a heap buffer where the contents can be controlled arbitrarily The exploit is free to start ROP chains etc As it happens, the exploit payload is expressed in terms of valid full function calls This is achieved by bouncing into a useful sequence of opcodes in a template base internal Invoker 0x00007f153fc71d40 mov rax,rdi 0x00007f153fc71d43 lea rcx, rdi 0x30 0x00007f153fc71d47 mov rsi,QWORD PTR rdi 0x20 0x00007f153fc71d4b mov rdx,QWORD PTR rdi 0x28 0x00007f153fc71d4f mov rax,QWORD PTR rax 0x10 0x00007f153fc71d53 mov rdi,QWORD PTR rdi 0x18 0x00007f153fc71d57 jmp raxAs can be seen, these opcodes pull a jump target, a new this pointer and two function arguments from the current this pointer A very useful construct http://www.secuobs.com/revue/news/425537.shtmlhttp://www.secuobs.com/revue/news/425537.shtml Secuobs.com : 2012-09-24 10:25:27 - Security - Web browsers with some form of multi-process model are becoming increasingly common Depending on the exact setup, there can be significant consequences for security posture and exploitation methods Spray techniques Probably the most significant security effect of multi-process models is the effect on spraying Spraying, of course, is a technique where parts of a processes' heap or address space are filled with data helpful for exploitation It's sometimes useful to spray the heap with a certain pattern of data, or spray the address space in general with executable JIT mappings, or both In the good ol' days, when every part of the browser and all the plug-ins were run in the same process, there were many possible attack permutations Spray Java JIT pages to exploit a browser bug Spray Java JIT pages to exploit a Flash bug Spray Flash JIT pages to exploit a browser bug Spray Java JIT pages to exploit Java You could even spray browser JS JIT pages to exploit Java if you wanted to - etc Since the good ol' days, various things happened to lock all this down The Java plug-in was rearchitected so that it runs out-of-process in most browsers IE and Chromium placed page limits on JavaScript-derived JIT pages covered a little in the famous Accuvant paper Firefox introduced its out-of-process plug-ins feature for some plug-ins, most notably Flash and Chromium had all plug-ins out-of-process since the first release The end result is trickier exploitation, although it's worth noting that one worrysome combination remains IE still runs Flash in-process, and this has been abused by attackers in many of the recent IE 0days One-shot vs multi-shot The terms one-shot and multi-shot have long been used in the world of server-side exploitation One-shot refers to a service that is dead after just one crash -- so your exploit had better be reliable Multi-shot refers to a service whereby it remains running after your lousy exploit causes a crash This could be because the service has a parent process that launches new children if they die or it could simply be because the service is launched by a framework that automatically restarts dead services Although moving to a multi-process browser is generally very positive thing for security and stability, you do run the risk of introducing multi-shot attacks In other words, let's say your exploit isn't 100pourcents reliable Wouldn't it be nice if you could just use a bit of JavaScript to run the exploit over and over in a child process until it works Perhaps you simply weren't able to default ASLR and you're in the situation where you have a 1 256 chance of your hard-coded address being correct Again, this could be brute-forced in a multi-shot attack The most likely multi-shot attacks are against plug-ins that are run out-of-process, or against browser tabs, if browser tabs can have separate processes These attacks can be defended against by limiting the rate of child process crashes or spawns Chromium deploys some tricks in this area Broker escalation Once an attack has gained code execution inside a sandbox, there are various directions it might go next It might attack the OS kernel Or for the purposes of this discussion, it might attack the privileged broker The privileged broker typically runs outside of the sandbox, so any memory corruption vulnerability in the broker is a possible avenue for sandbox escape To attack the memory corruption bug, you'll likely need to defeat DEP ASLR in the broker process An interesting question is, how far along are you already, by virtue of code execution in the sandboxed process Obviously, you know the full memory map layout of the compromised sandboxed process The answer, is it depends on your OS and the way the various processes relate to each other The situation is not ideal on Windows due to the way the OS works, certain system-critical DLLs are typically located at the same address across all processes So ASLR in the broker process is already compromised to an extent, no matter how the sandboxed processes are created I found this interesting The situation is better on Linux, where each process can have a totally different address space layout, including system libraries, executable, heap, etc This is taken advantage of by the Chromium zygote process model for the sandboxed processes So a compromise of a sandboxed process does not give any direct details about the address space layout of the broker process There may be ways to leak it, but not directly, and proc certainly isn't mapped in the sandboxed context All this is another reason I recommend 64-bit Linux running Chrome as a browsing platform http://www.secuobs.com/revue/news/401348.shtmlhttp://www.secuobs.com/revue/news/401348.shtml Secuobs.com : 2012-07-04 09:44:21 - Security - Very behind on blog posts so time to crank some out A week or so ago, Chrome 20 was released to the stable channel There was little fanfare and even the official Chrome blog didn't have much to declare apart from bugfixes There were some things going on under the hood for the Linux platform, though Security things, and some of them I implemented and am quite excited by The biggest item is an improvement to Flash security Traditionally, Linux -- across all browsers -- hasn't had great Flash security, due to lack of sandboxing options That just changed so-called Pepper Flash shipped to the stable channel on Linux with Chrome 20 other platforms to follow real soon I went into a little detail about the technical sandbox measures in Pepper Flash for Linux in an older blog post As mentioned in the previous blog post, native 64-bit Flash also gives a useful security boost on 64-bit Linux platforms There's more Perhaps you're running 64-bit Ubuntu 1204 Courtesy of Kees Cook, this release sneaked in Will Drewry's seccomp filter patches, which I blogged about earlier this year in the context of vsftpd-300's usage of seccomp filter sandboxing So why have just one Flash sandbox if you can have two A bit of double-bagging if you like Assuming you're running 64-bit Ubuntu 1204 and Chrome 20 or newer, you'll also have a seccomp filter policy slapped on Flash -- in additional to the chroot and PID namespace This may impede attackers trying to perform a local privilege escalation, who can no longer call crazy brand-new syscalls or use socket to load crazy protocol modules, etc No sandbox or combination of sandboxes will ever be perfect, but some is better than none For people who want to run Flash, Chrome 20 on 64-bit Ubuntu 1204 is one of the more locked-down ways to do it http://www.secuobs.com/revue/news/385377.shtmlhttp://www.secuobs.com/revue/news/385377.shtml Secuobs.com : 2012-04-10 08:48:19 - Security - vsftpd-300 is released Aside from the usual few fixes, I'm excited about built-in support for Will Drewry's seccomp filter, which landed in Ubuntu To give it a whirl, you'll need a 64-bit Ubuntu 1204 beta at time of writing , and a 64-bit build of vsftpd Why all the excitement vsftpd has always piled on all of the Linux sandboxing privilege facilities available, including chroot, capabilities, file descriptor passing, pid network etc namespaces, rlimits, and even a ptrace-based demo never quite production seccomp filter brings a new level of power and granularity in the form of the ability to permit, deny or emulate raw syscalls, with some control over the arguments In many ways it's similar to what can be achieved with a clunky ptrace-based sandbox -- but it will go a lot faster, have a lot less bugs and not be prone to various fail-open conditions In other words, it's designed to be used as a security technology whereas ptrace is not Some of the more compelling points of seccomp filter include Ability to restrict access to the kernel API In all likelihood, a compromise of a vsftpd process wouldn't be much use to an attacker due to the use of chroot and namespaces The attacker would be looking to escalate privileges and the most fruitful way to do this would be going after a kernel bug By only allowing a small subset of syscalls, the number of kernel APIs exposed to attack is minimal Application-defined An unprivileged application can install a filter This has various benefits For example, a future Chromium will likely ship without the need for a setuid helper A future vsftpd might offer robust sandboxing even when not started as root Compatible with syscall emulation Doing access control on user-space pointer arguments is racy with ptrace and impossible with seccomp filter However, a denied syscall can be emulated via a SIGSYS signal In the signal handler, something like an open call can be faked , perhaps even to the extent of sending the filename over a local socketpair for validation and delegated open Very tasty I'll look at writing a general wrapper if no-one else does Defense against glibc vulnerabilities I'll go into this in more detail in another post, but a recent glibc memory corruption vulnerability illustrated that glibc takes an interesting code path in response to detecting bad situations This failure code path ended up making the glibc bug highly exploitable Fortunately, the syscalls needed by the interesting code path don't need to be permitted in a seccomp filter policy, thus blocking much of the problem It's all very powerful, and vsftpd isn't the only exited consumer There's already a patch in OpenSSH, to be released with version 6 Personally, I'm not sure I have the skill to attack vsftpd seccomp filter Even if I were to achieve code execution, the set of permitted syscalls is pretty limited If you look at some of the memorable Linux kernel vulns of recent years AF_CAN by Ben Hawkes, sock_sendpage by Julien Tinnes and Tavis Ormandy, or sys_tee -- all of these would be blocked either at the syscall, or syscall argument validation level If you go back to 2003, there's brk , which would probably have done the trick If you know of any other examples, I'd love to collect them http://www.secuobs.com/revue/news/369055.shtmlhttp://www.secuobs.com/revue/news/369055.shtml Secuobs.com : 2012-04-04 08:52:14 - Security - Just a quick note that vsftpd-300 is imminent The big-ticket item is the new seccomp filter sandboxing support Please test this, particularly on 64-bit Ubuntu Precise Beta 2 or newer or if you use SSL support I would love to get a quick note e-mail or comment here even if just to say it seems to work in your configuration https securityappspotcom downloads vsftpd-300-pre2targz https securityappspotcom downloads vsftpd-300-pre2targzasc http://www.secuobs.com/revue/news/367925.shtmlhttp://www.secuobs.com/revue/news/367925.shtml Secuobs.com : 2012-03-30 10:04:28 - Security - This year's Pwn2Own and Pwnium contests were interesting for many reasons If you look at the results closely, there are many interesting observations and conclusions to be made 60k is more than enough to encourage disclosure of full exploits As evidenced by the Pwnium results, 60k is certainly enough to motivate researchers into disclosing full exploits, including sandbox escapes or bypasses There was some minor controversy on this point leading up to the competitions, culminating in this post from ZDI The post unfortunately was a little strong in its statements including In fact, we don't believe that even the entirety of the 105,000 we are offering would be considered an acceptable bounty , for the 60,000 they are offering, it is incredibly unlikely that anyone will participate and such an exploit against Chrome will never see the light of day at CanSecWest At least we all now have data I don't expect ZDI to make this mistake again Without data, it's an understandable mistake to have made Bad actors will find loopholes and punk you One of the stated -- and laudable -- goals of both Pwn2Own and Pwnium is to make users safer by getting bugs fixed As recently noted by the EFF, there are some who are not interested in getting bugs fixed At face value, it would seem to be counterproductive for these greyhat or blackhat parties to participate Enter VUPEN, who somehow managed to turn up and get the best of all worlds 60k, tons of free publicity for their dubious business model and minimal cost To explore the minimal cost, let's look at one of the bugs they used a Flash bug not Chrome as widely reported , present in Flash 111 but already fixed in Flash 112 In other words, the bug they used already had a fixed lifetime Using such a bug enabled them to collect a large prize whilst only handing over a doomed asset in return Although operating within the rules, their entry did not do much to advance user security and safety -- the bug fix was already in the pipeline to users They did however punk 60k out of Pwn2Own and turned the whole contest into a VUPEN marketing spree Game theory At the last minute at Pwn2Own, contestants Vincenzo and Willem swooped in with a Firefox exploit to collect a 30k second place prize The timing suggests that they were waiting to see if their single 0-day would net them a prize or not It did We'll never know what they would have done if the 30k reward was already sewn up by someone else, but one possibility is a non-disclosure -- which wouldn't help make anyone safer Fixing future contests The data collected suggests some possible structure to future contests to ensure they bring maximal benefit to user safety Require full exploits, including sandbox escapes or bypasses Do not pay out for bugs already fixed in development releases or repositories Have a fixed reward value per exploit http://www.secuobs.com/revue/news/367114.shtmlhttp://www.secuobs.com/revue/news/367114.shtml Secuobs.com : 2012-03-29 01:50:51 - Security - IMAGE The Internet Engineering Task Force IETF has descended upon the City of Light this week to discuss ongoing work so the pipeline spewing out new RFCs and Internet standards doesn't stall Probably close to a hundred working groups, covering topics from routing to various aspects of IPv6 and even IPv4 to Web security, will keep the some 1,300 participants busy throughout the week Because eight groups meet in different rooms at any given time, different people work on different topics Usually, one stands out This time around, Web security seems to be in the air The topic was discussed in the websec working group, but also in a panel during one of the few plenary sessions and in a lunchtime briefing by the Internet Society ISOC Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/366843.shtmlhttp://www.secuobs.com/revue/news/366843.shtml Secuobs.com : 2012-03-28 23:12:25 - Security - For the brave, there now exists a pre-release version of vsftpd-300 https securityappspotcom downloads vsftpd-300-pre1targz https securityappspotcom downloads vsftpd-300-pre1targzasc The most significant change is an initial implementation of a secondary sandbox based on seccomp filter, as recently merged to Ubuntu 1204 This secondary sandbox is pretty powerful, but I'll go into more details in a subsequent post For now, suffice to say I'm interested in testing of this new build, eg Does it compile for you I've added various new gcc flags etc Any runtime regressions Does it run ok on 64-bit Ubuntu 1204-beta2 or newer This last question is key as that is the configuration that will automatically use a seccomp filter The astute among you will note that beta2 is not due out until tomorrow, but an apt-get dist-upgrade from beta1 will pull in the kernel that you need Will Drewry's excellent work on seccomp filter is the most exciting Linux security feature in a long time and the eventual vsftpd combined sandbox that will result should be a very tough nut to crack indeed http://www.secuobs.com/revue/news/366823.shtmlhttp://www.secuobs.com/revue/news/366823.shtml Secuobs.com : 2012-03-18 22:34:21 - Security - I've had cause to be staring at memory maps recently across a variety of systems No surprise then that some suboptimal or at least interesting ASLR quirks have come to light 1 Partial failure of ASLR on 32-bit Fedora My Fedora is a couple of releases behind, so no idea if it's been fixed It seems that the desire to pack all the shared libraries into virtual address 0x00nnnnnn has a catastrophic failure mode when there are too many libraries something always ends up at 0x00110000 You can see it with repeated invocations of ldd opt google chrome chromegrep 0x0011 libglib-20so0 lib libglib-20so0 0x00110000 libXextso6 usr lib libXextso6 0x00110000 libdlso2 lib libdlso2 0x00110000 Which exact library is placed at the fixed address is random However, any fixed address can be a real problem to ASLR For example, in the browser context, take a bug such as Chris Rohlf's older but interesting CSS type confusion Without a fixed address, a crash is a likely outcome With a fixed address, the exact library mapped at the fixed address could easily be fingerprinted, and the BSS section read to leak heap pointers eg via singleton patterns Bye bye to both NX and ASLR Aside in the 32-bit browser context with plenty of physical memory, a Javascript-based heap spray could easily fill most of the address space such that the attacker's deference has a low chance of failure Aside 2 my guess is that this scheme is designed to prevent a return-to-glibc attack vs strcpy , by making sure that all executable addresses contain a NULL byte I'm probably missing something, but it seems like the fact that strcpy NULL-terminates, combined with the little-endianness of Intel, makes this not so strong 2 Missed opportunity to use more entropy on 64-bit If you look at the maps of a 64-bit process, you'll see most virtual memory areas correspond to the formula 0x7fnnxxxxxxxx where all your stuff is piled together in xxxxxxxx and nn is random At least, nothing is in or near a predictable location One way to look at how this could be better is this If you emit a 4GB heap spray, you have a 1 256 chance of guessing where it is Using the additional 7 bits of entropy might be useful, especially for the heap 3 Bad mmap randomization Although the stack, heap and binary are placed at reasonably random locations, unhinted mmap chunks are sort of just piled up adjacent, typically in a descending-vm-address fashion This can lead to problems where a buffer overflow crashes into a sensitive mapping -- such a JIT mapping This is one reason JIT mappings have their own randomizing allocator in v8 4 Heap stack collision likely with ASLR binary On a 32-bit kernel you might see b8105000-b8124000 rw-p 00000000 00 00 0 heap bfae5000-bfb0a000 rw-p 00000000 00 00 0 stack Or on a 64-bit kernel running a 32-bit process f7c52000-f7c73000 rw-p 00000000 00 00 0 heap ff948000-ff96d000 rw-p 00000000 00 00 0 stack In both cases, the heap doesn't have to grow too large before it cannot grow any larger When this happens, most heap implementations fall back to mmap allocations, and suffer the problems of 3 above These things chained together with a very minor infoleak such as my cross-browser XSLT heap address leak could in fact leak the location of the executable, leading to a full NX ASLR bypass Conclusion A 32-bit address space just isn't very big any more, compared with todays large binaries, large number of shared library dependencies and large heaps It's no surprise that everything is looking a little crammed in The good news is that there are no obvious and severe problems with the 64-bit situation, although the full entropy isn't used Applications such as v8 Chromium can and do fix that situation for the most sensitive mappings themselves http://www.secuobs.com/revue/news/364392.shtmlhttp://www.secuobs.com/revue/news/364392.shtml Secuobs.com : 2012-03-01 08:53:04 - Security - Flash on Linux hasn't always been the best experience in the stability and security departments Users of 64-bit Linux, in particular, have to put up with NSPluginWrapper, a technology which bridges a 64-bit browser process to the 32-bit Flash library In terms of sandboxing, your distribution might slap a clunky SELinux or AppArmor policy on Flash, but it may or may not be on by default Given the above, and the fact I'm a 64-bit Linux user, I was really happy to see Chrome's latest dev channel include a native 64-bit Pepper Flash plug-in What does this mean Security sandboxing Pepper plug-ins run inside Chrome's renderer sandbox On Linux, this is chroot and PID namespace based, so Flash in this context has no filesystem access, nor the ability to interfere with other processes Stability native 64-bit build Generally, stability and performance should be better than NSPluginWrapper on account of not having to bounce through an extra layer and process Security 64-bit address space It's harder to heap spray or JIT spray a 64-bit address space Physical memory will typically run out long before the spray achieves a statistical likelihood of being at any particular memory location There are some warts of course Although it works ok on my Ubuntu box, there are lots of comments on the releases blog which indicate Flash is broken, particularly from Fedora users There's also an ASLR failure missing position independent executable which will be fixed in the next revision Overall, though, seems like a promising boost to Linux Flash security is heading towards the Chrome stable channel http://www.secuobs.com/revue/news/360798.shtmlhttp://www.secuobs.com/revue/news/360798.shtml Secuobs.com : 2012-01-29 07:29:12 - Security - Here's a curiousity that's developing in modern browser security The security of a given browser is dominated by how much effort it puts into other peoples' problems This may sound absurd at first but we're heading towards a world where the main browsers will have with a few notable exceptions Rapid autoupdate to fix security issues Some form of sandboxing A long history of fuzzing and security research These factors, combined with an ever more balanced distribution of browser usage, are making it uneconomical for mass malware to go after the browsers themselves Enter plug-ins Plug-ins are an attractive target because some of them have drastically more market share than even the most popular browser And a lot of plug-ins haven't received the same security attention that browsers have over the past years The traditional view in security is to look after your own house and let others look after theirs But is this conscionable in a world where -- as a browser vendor -- you have the power to defend users from other peoples' bugs As a robust illustrative point, a lot of security professionals recently noticed some interesting exploit kit data, showing a big difference in exploitation success between Chrome 0pourcents and IE Firefox 15pourcents The particular exploits successfully targeted are largely old, fixed plug-in bugs in Java, Flash and Reader So why the big difference between browsers The answer is largely the investment Chrome's security team has made in defending against other peoples' problems, with initiatives such as Blocking out-of-date plug-ins by default and encouraging the user to update Blocking lesser-used plug-ins such as Java, RealPlayer, Shockwave etc by default Having the Flash plug-in bundled such that it is autoupdated using Chrome's fast autoupdate strategy this is why Chrome probably has the best Flash security story The inclusion of a lightweight and reasonably sandboxed default PDF viewer not all sandboxes are created equal The Open Type Sanitizer, which defends against a subset of Windows kernel bugs and Freetype bugs Chrome often autoupdates OTS faster than eg Microsoft Apple Linux vendors fix the underlying bug Certificate public key pinning This new technology defends against the generally gnarly SSL Certificate Authority problem, and caught a serious CA compromise being abused in Iran last year In conclusion, some of the biggest browser security wins over the past couple of years have come from browser vendors defending against other peoples' problems So I repeat the hypothesis The security of a given browser is dominated by how much effort it puts into other peoples' problems Funny world we live in http://www.secuobs.com/revue/news/354673.shtmlhttp://www.secuobs.com/revue/news/354673.shtml Secuobs.com : 2011-10-19 00:26:54 - Security - IMAGE IT security experts have long loved to troll through hacker forums to gather intelligence on emerging threats and even as in the ill-fated case of HBGary Federal CEO Aaron Barr try to profile the hackers themselves But as a report from IT security firm Imperva shows, many of the so-called hacker portals out there are more hangouts for newbie hackers and possibly a few budding FBI informants looking at how to get started in the game Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/335539.shtmlhttp://www.secuobs.com/revue/news/335539.shtml Secuobs.com : 2011-10-14 17:43:18 - Security - IMAGE It has been pretty chaotic in German Chancellor Angela Merkel's cabinet ever since the Chaos Computer Club dumped some alarming technology news in her lap Turns out that the German government's lawful interception application, supposedly designed only to monitor IP telephone calls, is just a little more powerful than the police let on Berlin-based CCC released its analysis of Germany's Quellen-TKÜ source wiretapping trojan on Saturday The results weren't pretty Despite a constitutional court ban on the use of malware to crack PCs, the state-sanctioned malware's makers didn't even bother to add technical barriers ensuring that the code would only be used for tapping Internet telephone conversations Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/334823.shtmlhttp://www.secuobs.com/revue/news/334823.shtml Secuobs.com : 2011-10-13 01:25:58 - Security - IMAGE iOS 5, still slowly rolling out to users after its launch on Wednesday, not only brings new features it also brings a number of important security fixes for iPhone, iPad, and iPod touch users The update removes trust for any and all security certificates from hacked certificate authority DigiNotar, and drops support for certs with MD5 hashes and updates TLS to version 12 to improve security of SSL connections Dutch certificate authority DigiNotar was hacked in July by a hacker calling himself ComodoHacker, who used DigiNotar's servers to generate hundreds of fraudulent security certificates Though the company had believed that it had deleted all of them from its servers, the company ended up missing at least one certificate That particular certificate allowed the hacker to put his servers between Gmail users and Google's Gmail servers in order intercept e-mail from a number of Iranian citizens Once news of the hack spread, Mozilla, Google, Microsoft, and others issued patches that blacklisted all DigiNotar certs Effectively, any server using a cert from DigiNotar would not be trusted Apple took almost two weeks to issue a patch for Mac OS X, and it wasn't until today's iOS 5 update that iPhone, iPad, and iPod touch users received a similar patch According to Apple, the DigiNotar issue is addressed by removing DigiNotar from the list of trusted root certificates, from the list of Extended Validation EV certificate authorities, and by configuring default system trust settings so that DigiNotar's certificates, including those issued by other authorities, are not trusted iOS 5 also adds two additional improvements to data security Apple has removed support for X509 certs signed using the MD5 hash algorithm, which has some known vulnerabilities It also updates the TLS protocol to version 12, which addresses a potential man-in-the-middle attack when using otherwise trusted SSL connections Additionally, iOS 5 includes a number of patches for buffer overflows and other potential exploits in libxml, ImageIO, Unicode support, WebKit, and more Full details are posted on Apple's website Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/334457.shtmlhttp://www.secuobs.com/revue/news/334457.shtml Secuobs.com : 2011-10-11 23:47:50 - Security - IMAGE IMAGE Officials at Creech Air Force Base in Nevada knew for two weeks about a virus infecting the drone cockpits there But they kept the information about the infection to themselves keeping the unit that s supposed to serve as the Air Force s cybersecurity specialists in the dark The network defenders at the 24th Air Force learned of the virus by reading about it in Danger Room The virus, which records the keystrokes of remote pilots as their drones fly over places like Afghanistan, is now receiving attention at the highest levels the four-star general who oversees the Air Force s networks was briefed on the infection this morning But for weeks, it stayed you will pardon the expression below the radar a local problem that local network administrators were determined to fix on their own Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/334148.shtmlhttp://www.secuobs.com/revue/news/334148.shtml Secuobs.com : 2011-10-11 21:19:44 - Security - IMAGE Researchers at a German university have published a paper detailing a security exploit of the Mifare DESfire MF3ICD40, a widely used RFID smart card The exploit, which uses an approach previously used to break other wireless crypto systems, demonstrates that even the relatively strong encryption algorithms used in touchless smart cards can be broken with a small investment of time and equipment exposing the shared crypto key and the data stored on them The exploit was revealed by researchers David Oswald and Christof Paar at the recent Workshop on Cryptographic Hardware and Embedded Systems CHES in Nara, Japan The attack uses a templated side-channel attack on the card's crypto, an approach first described in a paper by Suresh Chari, Josyula Rao, and Pankaj Rohatgi of IBM's Watson Research Center in 2002 It requires the attacker to have the card itself, an RFID reader, and a radio probe Using differential power analysis, data is collected from radio frequency energy that leaks out of the card its side channels Through this process, Oswald and Paar were able to retrieve the entire 112-bit secret key from the MF3ICD40, which uses Triple DES encryption Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/334111.shtmlhttp://www.secuobs.com/revue/news/334111.shtml Secuobs.com : 2011-10-07 19:56:10 - Security - IMAGE IMAGE A computer virus has infected the cockpits of America s Predator and Reaper drones, logging pilots every keystroke as they remotely fly missions over Afghanistan and other warzones The virus, first detected nearly two weeks ago by the military s Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas Nor have there been any confirmed incidents of classified information being lost or sent to an outside source But the virus has resisted multiple efforts to remove it from Creech s computers, network security specialists say And the infection underscores the ongoing security risks in what has become the US military s most important weapons system Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/333384.shtmlhttp://www.secuobs.com/revue/news/333384.shtml Secuobs.com : 2011-09-28 16:16:14 - Security - IMAGE Researchers at the Department of Energy's Argonne National Laboratory have demonstrated an electronic man in the middle attack that allows remote tampering with the Diebold AccuVote voting system Argonne's Vulnerability Assessment Team has previously exposed the same sort of vulnerability in Sequoia AVC machines in 2009, and believe the attack could be used against a wide range of voting machines The attack requires tampering with voting machine hardware, and allows for votes to be changed as the voter prepares to commit them But the devices require no actual changes to the hardware the hardware required to make the attacks can be attached and removed without leaving any evidence that it had ever been there The electronics in the demonstrated attack are simply jacked in between two components on the Diebold's printed circuit board using existing connectors VAT team leader Roger Johnston said in a video posted by Brad Friedman of the voting watchdog site The Brad Blog that the physical security measures taken to protect voting machines in many states are inadequate to protect them from pre-Election Day tampering They're often kept a week or two before elections in a school or church basement, Johnston said And the modifications can be made without picking locks or breaking seals on the devices Diebold has a shaky security history In 2004, Johns Hopkins University computer science professor Avi Rubin and a team of researchers revealed a broad set of cyber vulnerabilities in the AccuVote system In the past, there have been suggestions that Diebold itself tampered with elections in Georgia in 2002 But while cyber attacks would require a high level of sophistication, the electronic man-in-the-middle attack demonstrated by Argonne's VAT team requires only basic electronics skills, and about 1050 worth of hardware Anybody with an electronics workbench could put this together, Argonne VAT team member John Warner said in the video Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/331514.shtmlhttp://www.secuobs.com/revue/news/331514.shtml Secuobs.com : 2011-09-27 00:35:26 - Security - IMAGE As if the MySQL community doesn't have enough to worry about, a security firm is reporting that the MySQLcom website has been commandeered by hackers And recent visitors to the MySQLcom website may have downloaded something other than the database software to their systems Web security firm Armorize reported in its blog today that the MySQLcom website has been turned into a launchpad for serving up malware attacks Visitors to the home page of the site are hit with a JavaScript injection attack that has been planted on the site The script opens an IFRAME to a malicious site, which in turn launches a BlackHole exploit pack that probes for known browser and plugin weaknesses and then stealthily installs malware on the visitor's PC There's no warning button or action required by the user other than visiting the site to trigger the download Security blogger Brian Krebs reports that he had seen a post last week on a Russian hacker forum by a member offering to sell root access MySQLcom for 3,000 The site is owned by Oracle Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/331174.shtmlhttp://www.secuobs.com/revue/news/331174.shtml Secuobs.com : 2011-09-26 22:16:37 - Security - IMAGE Hot on the heels of last week's Mac malware posing as a PDF is a new piece of malware posing as something even more insidious a Flash player installer Security firm Intego was the first to post about the new malware on its blog, noting that although the company has only received one report so far from a user who downloaded it, the malware does exist in the wild and may trick Mac users who don't yet have Flash installed The malware in question is a trojan horse called Flashback OSX flashbackA users may end up acquiring it by clicking a link on a malicious website to download or install Flash player If those users also have their Safari settings to automatically open safe files which pkg and mkpg files are considered to be , an installer will show up on their desktops as if they are legitimately installing Flash Continuing through the installation process will result in the trojan deactivating certain types of security software Intego specifically noted that the popular Little Snitch would be affected and installing a dynamic loader library dyld with that can auto-launch, allowing it to inject code into applications the user launched The trojan then reports back to a remote server about the user's MAC address and allows the server to detect whether the Mac in question has been infected or not The threat is currently marked as low, but Mac users are advised to follow safe security practices don't open files or attachments that you don't remember downloading, and turn off Safari's setting for opening safe files automatically It's also worth noting that Apple now updates its malware definition file on a daily basis, and has already updated it to address the PDF trojan discussed last week If you haven't already scoured the Internet for a malicious version of the Flash installer, then it's likely Apple will have added the new malware to the file by the time you run into it Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/331147.shtmlhttp://www.secuobs.com/revue/news/331147.shtml Secuobs.com : 2011-09-23 22:43:08 - Security - IMAGE That Bluetooth car kit you got at the big box store on sale may be opening your phone up to hacking Research by Codenomicon, a Finnish data security company, found that each of a sample of ten new Bluetooth hands-free kits tested this year have critical issues with their security implementations The kits were susceptible to fuzzing attacks by transmissions of malformed data that can crash devices or expose holes in the security of their implentation of the Logical Link Control and Adaption Protocol L2CAP The problem isn't limited to car kits Codenomicon's Tommi Mäkilä says that about 80 percent of devices tested in Codenomicon's plugfests have crashed during testing In crashing, the devices often reveal gaps in their security that, in the case of handsets and computers, can be used to access data or inject malware into the system And because there's a relatively small number of Bluetooth codestacks on the market, any exploit that might be discovered could be applied to a wide range of devices Security gaps in Bluetooth aren't a new concern tools like Blooover have demonstrated an exploit called Bluebug, which allowed remote access to text messages, call records and address books on some handsets, and even allowed eavesdropping and placing of phone calls Changes to phone firmware from handset makers have largely corrected that security hole But they haven t gone away in July, Microsoft issued a patch to fix a Bluetooth vulnerability in Windows 7 and Windows Vista that allows an attacker to transmit packets to remotely execute code allowing them to install programs view, change, or delete data or create new accounts with full user rights But the findings of the Codenomicon researchers indicate that security for Bluetooth devices still has a long way to go, and is perhaps even worse than anyone expects The researchers were particularly concerned about the unreliability of L2CAP implementations, since communication over L2CAP doesn't require Bluetooth devices to pair meaning that attacks can be undertaken without the user being aware Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/330710.shtmlhttp://www.secuobs.com/revue/news/330710.shtml Secuobs.com : 2011-09-23 18:48:46 - Security - IMAGE Malware continues to be a minimal threat to most Mac users, but that doesn't mean attackers aren't constantly trying to come up with new ways to steal information or turn users' machines into botnet drones The latter appears to be the case with a new Mac trojan posing as a PDF file, discovered by security researchers at F-Secure The malware in question has been identified as Trojan-Dropper OSX RevirA, which installs a backdoor, Backdoor OSX ImulerA, onto the user's Mac Currently, however, the backdoor doesn't communicate with anything The command-and-control center for this particular malware is apparently a bare Apache installation, which has been sitting at its current domain since May of this year Because of this, users who might fall victim to this attack aren't likely to see many ill effects for the time being, but that could change if the files end up spreading to a wider audience As mentioned earlier, this trojan spreads by masking itself as a PDF, which displays a Chinese-language document on the screen in an attempt to hide its background activity This isn't a new strategy on the surface, as F-Secure notes, but some deeper digging indicates that it might be stealthier than its Windows counterparts This malware may be attempting to copy the technique implemented by Windows malware, which opens a PDF file containing a 'pdfexe' extension and an accompanying PDF icon, reads the post on F-Secure's blog The sample on our hand does not have an extension or an icon yet However, there is another possibility It is slightly different in Mac, where the icon is stored in a separate fork that is not readily visible in the OS The extension and icon could have been lost when the sample was submitted to us If this is the case, this malware might be even stealthier than in Windows because the sample can use any extension it desires As for how this trojan is spreading, that's a bit of a mystery The researchers noted that they're not yet sure of the methods it uses to propagate, but they believe the most likely explanation is that it's circulating via e-mail attachment Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/330655.shtmlhttp://www.secuobs.com/revue/news/330655.shtml Secuobs.com : 2011-09-22 22:07:46 - Security - IMAGE The Department of Homeland Security and National Institute of Standards and Technology are looking to beat back the kudzu of spam generators, distributed denial of service zombies, and other botnets, and they want your cooperation on a totally voluntary basis, of course After a long and escalating string of high-profile attacks on government and corporate sites using botnets like the Low Orbit Ion Cannon, botnets are obviously high on DHS's to-kill list But while the government has had some success in attacking botnets directly, as it did in April when the FBI went after the Coreflood botnet, McAfee researchers estimate that the number of systems infected with botnet malware is growing at an average of 4 million per month Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/330454.shtmlhttp://www.secuobs.com/revue/news/330454.shtml Secuobs.com : 2011-09-21 18:05:27 - Security - IMAGE On Friday, a pair of security researchers will present a hacking tool which they claim decrypts secure Web requests to sites using the Transport Layer Security 10 protocol and SSL 30, allowing a person or program to hijack sessions with financial websites and other services Juliano Rizzo and Thai Duong are unveiling their Browser Exploit Against SSL TLS tool, dubbed BEAST, at the Ekoparty security conference in Buenos Aires The tool is based on a blockwise-adaptive chosen-plaintext attack, a man-in-the-middle approach that injects segments of plain text sent by the target's browser into the encrypted request stream to determine the shared key The code can be injected into the user's browser through JavaScript associated with a malicious advertisement distributed through a Web ad service or an IFRAME in a linkjacked site, ad, or other scripted elements on a webpage Using the known text blocks, BEAST can then use information collected to decrypt the target's AES-encrypted requests, including encrypted cookies, and then hijack the no-longer secure connection That decryption happens slowly, however BEAST currently needs sessions of at least a half-hour to break cookies using keys over 1,000 characters long The attack, according to Duong, is capable of intercepting sessions with PayPal and other services that still use TLS 10 which would be most secure sites, since follow-on versions of TLS aren't yet supported in most browsers or Web server implementations While Rizzo and Duong believe BEAST is the first attack against SSL 30 that decrypts HTTPS requests, the vulnerability that BEAST exploits is well-known BT chief security technology officer Bruce Schneier and UC Berkeley's David Wagner pointed out in a 1999 analysis of SSL 30 that SSL will provide a lot of known plain-text to the eavesdropper, but there seems to be no better alternative And TLS's vulnerability to man-in-the middle attacks was made public in 2009 The IETF's TLS Working Group published a fix for the problem, but the fix is unsupported by SSL Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/330180.shtmlhttp://www.secuobs.com/revue/news/330180.shtml Secuobs.com : 2011-09-20 19:43:01 - Security - IMAGE A security researcher has discovered that changes to Directory Services in Lion make it much easier to access and potentially crack hashed user passwords Worse yet, it is possible for any user to change any currently logged in user's password, making it much easier to gain root remotely According to researcher Patrick Dunstan, Directory Services' command line utility can be run by any user By itself, this isn't necessarily a security problem, but at least two functions make it trivial to access user password hashes or even change the current user's password without administrator authentication Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/329988.shtmlhttp://www.secuobs.com/revue/news/329988.shtml Secuobs.com : 2011-09-15 18:26:27 - Security - IMAGE Amazon has earned the FISMA security accreditation from the US General Services Administration, a key endorsement for its cloud security model that could increase adoption among federal agencies FISMA, the Federal Information Security Management Act, is the fifth major certification or accreditation Amazon has gained for its Web Services business featuring the Elastic Compute Cloud infrastructure-as-a-service platform FISMA Moderate Authorization and Accreditation requires AWS to implement and operate an extensive set of security configurations and controls, Amazon said in an announcement today This includes documenting the management, operational, and technical processes used to secure the physical and virtual infrastructure as well as conducting third party audits This is the first time AWS has received a FISMA Moderate authority to operate Amazon already counted the likes of NASA s Jet Propulsion Laboratory and Treasurygov as customers, so the company wasn t exactly struggling to land big names But adding to its roster of accreditations could help Amazon EC2 attract more mission-critical use cases FISMA certification had already been obtained by Google for its Apps service and by Microsoft for its cloud infrastructure and its BPOS-Federal service Prior to today, Amazon achieved compliance with the SAS 70 Type II auditing standard, the HIPAA health data privacy act, PCI DSS credit card standards, and the ISO 27001 international security standard The new FISMA certification covers Amazon EC2, Amazon s Simple Storage Service, the Virtual Private Cloud, and the services underlying infrastructure Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/329101.shtmlhttp://www.secuobs.com/revue/news/329101.shtml Secuobs.com : 2011-09-12 18:23:48 - Security - IMAGE Adobe is removing a DigiNotar certificate from its trusted list and pushing out critical security patches to Reader and Acrobat tomorrow The Dutch certificate authority was hacked recently, generating hundreds of fake security certificates for numerous websites, including Google, Yahoo, and others Adobe announced last Thursday that it was in the process of removing the DigiNotar Qualified CA from its Approved Trust List, and offered Reader and Acrobat users manual instructions on removing the certificate themselves Adobe provided a further update on Friday, saying that a security update for Reader and Acrobat will be published September 13 We have delayed the removal of this certificate until next Tuesday at the explicit request of the Dutch government, while they explore the implications of this action and prepare their systems for the change, Adobe said on a corporate blog The rogue certificates known to exist today are related to a different certificate, the DigiNotar Public CA, but Adobe said a Dutch security consultancy has found evidence of the Qualified CA being compromised as well The security updates to be pushed out tomorrow are rated critical and affect Adobe Reader X 101 and Adobe Acrobat X 101 and earlier versions for Windows and Mac Adobe said it is also holding discussions with the Dutch government regarding other certificates related to DigiNotar and is planning changes to Reader and Acrobat and its Approved Trust List to react more quickly to such problems in the future Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/328378.shtmlhttp://www.secuobs.com/revue/news/328378.shtml Secuobs.com : 2011-09-09 20:46:37 - Security - IMAGE IMAGE Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months The intercepted correspondence included employee usernames and passwords, sensitive security information about the configuration of corporate network architecture that would be useful to hackers, affidavits and other documents related to litigation in which the companies were embroiled, and trade secrets, such as contracts for business transactions Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/328068.shtmlhttp://www.secuobs.com/revue/news/328068.shtml Secuobs.com : 2011-09-07 00:45:06 - Security - IMAGE The hack of Dutch certificate authority DigiNotar already bore many similarities to the break-in earlier this year that occurred at a reseller for CA Comodo Bogus certificates were issued for webmail systems, which were in turn used to intercept Web traffic in Iran Another similiarity has since emerged the perpetrator of the earlier attacks is claiming responsibility for the DigiNotar break-in Calling himself ComodoHacker, the hacker claims that DigiNotar is not the only certificate authority he has broken into He says that he has broken into GlobalSign, and a further four more CAs that he won't name He also claimed that at one time he had access to StartCom Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/327395.shtmlhttp://www.secuobs.com/revue/news/327395.shtml Secuobs.com : 2011-09-01 21:48:07 - Security - IMAGE Those using Safari on Mac OS X are still vulnerable to man-in-the-middle attacks using fraudulent security certificates that hackers generated from Dutch certificate authority DigiNotar The problem lies in the way Mac OS X handles a new type of certificate called Extended Validation, or EV certificates Fortunately, however, there is a relatively easy fix DigiNotar had been hacked earlier this week in order to generate hundreds of fake security certificates for numerous websites, including Google, Yahoo, and others An Iranian hacker appears to have used the certificates for googlecom to spy on Iraninan Gmail users' conversations Microsoft and Google revoked trust in certificates issued by DigiNotar, and Mozilla issued patches for Firefox and Thunderbird to no longer trust certificates from the company These changes meant that Chrome, Internet Explorer, and Firefox users would no longer accept secure HTTPS connections from sites using DigiNotar issued certs Apple has yet to provide a patch for its Safari browser or Mac OS X, so users were told to use the Keychain to mark any certs issued by DigitNotar as Never trust Unfortunately, according to developer Ryan Sleevi, Mac OS X will still accept newer Extended Validation certs used to help prevent phishing attacks even from authorities that are marked as untrusted When Apple thinks you're looking at an EV Cert, they check things differently, Sleevi told Computerworld They override some of your settings and completely disregard them Security experts, including WhiteHat Security CTO Jeremiah Grossman, consider the flaw troubling Since Apple tends to not release any information about browser insecurity until it releases the relevant patches, users could potentially be exposed to further exploits in the meantime There is still a relatively simple fix to the problem until Apple issues a patch to Mac OS X, however Using Keychain Access, users can simply delete any DigiNotar certs from the Keychain instead of marking them untrusted Since the authority has already revoked all the fraudulent certs, they will no longer validate when Safari or other Mac OS X programs encounter them again Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/326582.shtmlhttp://www.secuobs.com/revue/news/326582.shtml Secuobs.com : 2011-09-01 15:55:22 - Security - IMAGE The Linux kernel archive website, which is located at kernelorg, was compromised by attackers last month According to a statement posted yesterday on the website, unauthorized parties successfully seized root access to several kernelorg servers and planted a trojan The site hosts the source code of the Linux kernel, and a number of other projects The intrusion was reported to kernelorg users earlier this week by site administrator John Hawley The attack is believed to have occurred on August 12 but wasn't detected until August 28 The attack vector isn't known for certain, but it is thought that the attacker somehow obtained a legitimate user's login credentials and then exploited an unknown privilege escalation vulnerability The attack was discovered when an Xnest error message was found in the system logs on a server that did not have Xnest installed Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/326497.shtmlhttp://www.secuobs.com/revue/news/326497.shtml Secuobs.com : 2011-08-30 05:59:48 - Security - IMAGE Earlier this year, an Iranian hacker broke into servers belonging to a reseller for certificate authority Comodo and issued himself a range of certificates for sites including Gmail, Hotmail, and Yahoo Mail With these certificates, he could eavesdrop on users of those mail providers, even if they use SSL to protect their mail sessions It's happened again This time, Dutch certificate authority DigiNotar has issued a fraudulent certificate for googlecom and all subdomains As before, Gmail appears to be the target The perpetrator also appears to be Iranian, with reports that the certificate has been used in the wild for man-in-the-middle attacks in that country The certificate was issued on July 10th, and so could have been in use for several weeks prior to its discovery DigiNotar has revoked the certificate, which provides some protection to users though many applications do not bother checking for revocations However, the company has so far not disclosed how the certificate was issued in the first place, making it unclear that its integrity has been restored As a result, Google and Mozilla have both made patches to Chrome and Firefox respectively that blacklist the entire certificate authority DigiNotar's silence also means that little is known about the perpetrator Responsibility for the Comodo hack was claimed by a person claiming to be an Iranian sympathetic with, but independent of, the country's government This latest hack could just as well be another independent effort, or a government action The absolute trust given to certificate authorities, and the susceptibility of that trust to abuse, has long been considered a problem We wrote about the problem in March, and there has been no material improvement in the situation since then The certificate authorities remain a weak link in the entire public key infrastructure, and though cryptographic systems can be created that reduce this possibility, the scheme we have remains firmly entrenched, regardless of its flaws Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/325951.shtmlhttp://www.secuobs.com/revue/news/325951.shtml Secuobs.com : 2011-08-29 23:49:44 - Security - IMAGE Nokia has issued a statement confirming that the security of its developer forum website was compromised by an attacker who successfully obtained a database table with user account information Nokia has taken down its developer community site while it conducts further analysis The attack exploited a SQL injection vulnerability in the website's forum software The statement issued by Nokia indicates that the attackers gained more account records than the company initially believed, but that the information was not particularly sensitive in nature The breached data includes user e-mail addresses and public profile information, but apparently not passwords or password hashes Nokia says that only 7 percent of the forum users had supplied profile information, which may include instant messaging usernames and date of birth The only material threat posed to individual users, according to Nokia, is unsolicited e-mail The company apologized for the incident and sent out messages to inform users The Nokia developer community website was also defaced changed to display a picture of cartoon character Homer Simpson and a message indicating that the site was Owned by pr0tect0r AKA mrNRG It has also had a text marquee which chastised Nokia for its lax Web security and warning that the company could be a future antisec target if it doesn't seek to improve The end of the message says that there will be no dumping or leaking, suggesting that the attacker doesn't intend to publish the compromised data The individual or group that identifies itself as pr0tect0r is also connected with a recent attack against Defensepk, an independent news and forum website that discusses Pakistan's military The attack is an embarrassment for Nokia, but doesn't appear to pose any major threats to the users of the company's developer community site The situation would have been worse if the target was one of Nokia's more sensitive sites such as Nokia's Ovi Store, which keeps credit card information on file Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/325910.shtmlhttp://www.secuobs.com/revue/news/325910.shtml Secuobs.com : 2011-08-19 17:38:43 - Security - Keith Watson from Purdue University's Center for Education and Research in Information Assurance and Security has published a PDF guide on Facebook security Read More Facebook Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/324089.shtmlhttp://www.secuobs.com/revue/news/324089.shtml Secuobs.com : 2011-08-18 02:37:27 - Security - IMAGE Security researchers have spotted a new strain of malware that targets Bitcoin, the peer-to-peer virtual currency that exploded onto the tech scene earlier this year In a report issued last week, Symantec researchers described a Trojan that uses the user's computer to mine Bitcoins on behalf of the intruder They estimate that, at current exchange rates, a fast computer could generate as much as 150 worth of Bitcoins per month This is not the first Bitcoin-related malware spotted in the wild In June, security researchers discovered malware that acts as a virtual pickpocket, scanning an infected computer for Bitcoin wallets and sending their contents to the attacker There have also been previous reports of Bitcoin-mining malware, but estimates had suggested that most botnet owners would make more money renting their machines out for other uses Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/323772.shtmlhttp://www.secuobs.com/revue/news/323772.shtml Secuobs.com : 2011-08-04 03:12:50 - Security - IMAGE IMAGE LAS VEGAS A security researcher has uncovered a slew of vulnerabilities in Siemens industrial control systems, including a hardcoded password, that would let attackers reprogram the systems with malicious commands to sabotage critical infrastructures and even lock out legitimate administrators The vulnerabilities exist in several models of Siemens programmable logic controllers, or PLCs the same devices that were targeted by the Stuxnet superworm and that are used in nuclear facilities and other critical infrastructures, as well as in commercial manufacturing plants that make everything from pharmaceuticals to automobiles Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/320949.shtmlhttp://www.secuobs.com/revue/news/320949.shtml Secuobs.com : 2011-08-04 00:26:16 - Security - IMAGE The governments of the United States, Canada, and South Korea, as well as the UN, the International Olympic Committee, and 12 US defense contractors were among those hacked in a five-year hacking campaign dubbed Operation Shady RAT by security firm McAfee, which revealed the attacks Many of the penetrations were long-term, with 19 intrusions lasting more than a year, and five lasting more than two Targets were found in 14 different countries, across North America, Europe, India, and East Asia The infiltration was discovered when McAfee came across a command-and-control server, used by the hackers for directing the remote administration tools RATs, hence the name Operation Shady RAT installed in the victim organizations, during the course of an invesigation of break-ins at defense contractors The server was originally detected in 2009 McAfee began its analysis of the server in March this year On the machine the company found extensive logs of the attacks that had been performed Seventy-two organizations were positively identified from this information the company warns that there were likely other victims, but there was not sufficient information to determine what they were Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/320928.shtmlhttp://www.secuobs.com/revue/news/320928.shtml Secuobs.com : 2011-08-03 05:55:09 - Security - IMAGE Microsoft has restricted its Wi-Fi-powered geolocation database after a researcher investigating Wi-Fi geolocation and position tracking raised privacy concerns about the information recorded This follows a similar move from Google, amidst identical privacy complaints A number of companies including Microsoft, Google, and Skyhook operate Wi-Fi geolocation databases as a means of providing quick and reasonably effective location information to phones, tablets, and laptop computers Every Wi-Fi and Ethernet device has a unique identifier called a MAC address Wi-Fi access points broadcast their MAC addresses so that any nearby machines can see the access point and connect to it Companies building geolocation databases collect access point MAC addresses and GPS locations, then publish this information online Community projects such as Wigle accumulate similar databases Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/320736.shtmlhttp://www.secuobs.com/revue/news/320736.shtml Secuobs.com : 2011-07-29 02:08:39 - Security - IMAGE The Metropolitan Police claimed yesterday that they had arrested prominent Lulz Security and AnonOps member Topiary The initial report claimed that a 19-year-old man was arrested in the Shetland Islands and was being flown down to London for questioning That report has now been adjusted, saying that he was in fact an 18-year-old man But there's a lot of speculation some rather bombastic, other more reserved that, however old this man actually is, there's one thing he isn't Topiary Attempts to dox people find out their real identities and publish their documents on the Web have long been a tool in Anonymous' arsenal Many people, whether they be animal abusers who've posted videos to YouTube or Sony executives and their families, have found themselves doxed after provoking Anonymous' wrath Turn about is fair play, and so many groups who oppose Anonymous, and its high profile spin-off, Lulz Security, have attempted to dox members of that collective Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/319861.shtmlhttp://www.secuobs.com/revue/news/319861.shtml Secuobs.com : 2011-07-27 20:28:49 - Security - IMAGE Anonymous has resumed its fight with PayPal, but this time with a twist instead of engaging in more denial-of-service attacks against the online payment processor, the group is exhorting its supporters to close their PayPal accounts and cease using the service This new OpPayPal comes in the wake of arrests the FBI announced last week that were made in response to the large denial of service attacks made against PayPal after PayPal stopped processing donations to WikiLeaks The statement issued by Anonymous denounces PayPal for acquiescing to government pressure and blocking payments to WikiLeaks The statement also expresses the group's outrage that the FBI has arrested suspected criminals, who face the possibility of 15 years in prison and fines of up to 500,000 As punishment for this Anonymous-unapproved action, the statement encourages everyone to use alternative services to PayPal, close their PayPal accounts, and post pictures of the closures to Twitter Those who can't close their accounts for any reason are invited to complain to the company instead Reports on Twitter of account closures in response to Anonymous' boycott number in their hundreds, and Anonymous itself is claiming that some 35,000 accounts have been closed eBay, owner of PayPal, saw its share price drop by around 2 percent when the markets opened this morning, and Anonymous is taking credit for this decline However, given that the NASDAQ as a whole has dropped by about 18 points at the time of writing, this fall in price looks more likely to be a reflection of prevailing market trends, rather than any specific response to the PayPal boycott Meanwhile, the arrests have continued The Metropolitan Police in the UK are claiming to have arrested Topiary, a key player in both AnonOps and Lulz Security The report says that a 19-year-old male was arrested in the Shetland Islands as part of continuing investigation into the denial-of-service and hacking attacks made under both the Lulz Security and Anonymous banners Other addresses in the north of England are being searched, and a 17-year-old male is also being interviewed in connection with the inquiry Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/319586.shtmlhttp://www.secuobs.com/revue/news/319586.shtml Secuobs.com : 2011-07-25 19:11:22 - Security - Results from Fermilab are consistent with the possible Higgs signal seen at the LHC Read More via the BBC Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/319107.shtmlhttp://www.secuobs.com/revue/news/319107.shtml Secuobs.com : 2011-07-20 21:02:13 - Security - IMAGE Google's search engine has started warning users that they've installed certain malware Your computer appears to be infected, a banner will proclaim across the top of every Google search whenever the malware is detected Clicking a link in the banner leads to instructions on how to find an appropriate anti-virus program to remove the software The malware that Google is detecting routes certain Web requests through proxy servers controlled by the criminals behind the malware Any search made through one of these proxies will receive the warning message Use of the proxies is generally transparent to users typically, the malware modifies the user's hosts file The hosts file is used to map domain names to IP addresses, so that domain names can be looked up without having to use a DNS server It's likely that the malware authors will respond to this measure soon enough, however The malicious proxy servers are already used to rewrite pages to include ads and interfere with access to anti-virus software those proxy servers can equally remove Google's warning message One potential problem is that rather than recommend or link to specific anti-virus software, Google refers users simply to a Google search for antivirus Such searches can direct users to the abundant fake anti-virus software that is available on the Web in attempting to fix the problem, users may just end up making things worse Specific recommendations or hardcoded links to genuine anti-virus software might risk claims of favoritism, but it would probably be safer Worse, these warning messages run counter to training and advice that's often given to Web users Due to the proliferation of fake anti-virus scams, users are strongly advised to ignore any Web site that's telling them they have a virus and that they should just download a program to fix their computer To be effective, Google's new malware detection requires and encourages them to ignore this usually sound advice taken in isolation, Google's warnings are sensible progress, but the broader implications could yet be negative Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/318213.shtmlhttp://www.secuobs.com/revue/news/318213.shtml Secuobs.com : 2011-07-20 03:12:14 - Security - IMAGE The FBI has made a series of raids at addresses across the US and arrested 16 people accused of participating in Anonymous-branded cyberattacks Arrests were made in Alabama, Arizona, California, Colorado, the District of Columbia, Florida, Massachusetts, Nevada, New Jersey, New Mexico, and Ohio, with further raids and equipment seizures conducted in New York 14 of those arrested have been charged with conspiring with others to damage computer systems belonging to PayPal PayPal was the victim of a distributed denial of service attack performed by Anonymous after the site blocked the ability to donate money to WikiLeaks, an action named Operation Avenge Assange The defendents range in age from 20 to 42 years old, with 11 males and two females the 14th defendent has had his or her name withheld Separately, a 21-year-old man was arrested for breaking into the InfraGard Web site, tweeting about what he did, and providing instructions so that others could also break in Finally, another 21-year-old man was arrested for stealing confidential information from AT T's systems while working as a customer support contractor This is the data that was published as part of LulzSec's retirement from the public eye The statement issued by the Department of Justice says that in concert with the arrests in the US, one arrested was made in the UK, and four in the Netherlands Fox News is reporting that the arrest in the UK was of an unnamed 16-year-old whose online handle is tflow tflow was prominent within Anonymous' denial of service and hacking operations, and a member of LulzSec too Prior to news of tflow's arrest, the handful of people behind breakaway Anonymous splinter group LulzSec which yesterday came out of retirement to break into News International's servers said on their IRC channel that they are unaffected by the arrests and raids Members of the group have speculated that the DoS participants are being targeted because they're readily traced, especially if they use the LOIC tool that Anonymous has often used to perform such attacks Typical usage of this tool does nothing to mask identities, making it relatively easy to track down its users LulzSec members, in contrast, have used software such as Tor and anonymous VPN connections to mask their identities If tflow has indeed been arrested, he would be the first member of LulzSec to be apprehended his arrest might also indicate that LulzSec wasn't as anonymous as it thought it was Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/318034.shtmlhttp://www.secuobs.com/revue/news/318034.shtml Secuobs.com : 2011-07-19 18:27:51 - Security - The FBI has raided three addresses in New York, looking for hackers belonging to the Anonymous group Agents have seized computers claimed to have been involved in distributed denial of service attacks against several corporations Read More Fox News Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/317896.shtmlhttp://www.secuobs.com/revue/news/317896.shtml Secuobs.com : 2011-07-19 02:09:15 - Security - IMAGE LulzSec is back making headlines for itself with an attack aimed at Rupert Murdoch, beleaguered boss of News Corporation Hackers broken into into servers belonging to News International's, the News Corp subsidiary that owns Murdoch's UK newspapers, and published a fake report of the media mogul's death Masquerading as a copy of daily tabloid The Sun, the report claimed that Murdoch ingested a large quantity of palladium before stumbling into his garden and dying The bogus page was published on a hacked server used to host a preview of upcoming changes to another News International paper, The Times The hackers then forced The Sun's homepage to redirect to the hacked server The influx of traffic rapidly overwhelmed the preview server, causing it to generate errors and subsequently get taken down The redirect currently goes to LulzSec's Twitter page The reason for this peculiar scheme is apparently that the The Times system has been rooted the The Sun machine has not Individuals affiliated with LulzSec and Anonymous are also claiming to have hacked into News International's mail servers, with a press release due tomorrow News International is, of course, being targeted in the wake of the News of the World phone hacking scandal that has already caused the resignation of several high-ranking executives within the Murdoch empire, and the closure of the newspaper in question Earlier in the day, tweets were also made purporting to be the e-mail addresses and password of various News International employees, including former Chief Executive Rebekah Brooks Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/317760.shtmlhttp://www.secuobs.com/revue/news/317760.shtml Secuobs.com : 2011-07-18 19:05:28 - Security - Microsoft is offering a reward of up to 250,000 for information that leads to the identification, arrest, and conviction of the person or people behind the Rustock botnet Read More Official Microsoft blog, Previous coverage, Previous coverage, Previous coverage Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/317615.shtmlhttp://www.secuobs.com/revue/news/317615.shtml Secuobs.com : 2011-07-16 06:12:25 - Security - IMAGE Mozilla aims to simplify account registration and authentication on the Web with a new technology called BrowserID It is a decentralized authentication system allows the Web browser to manage the user's identity The system relies on asymmetric keys and ties the user's identity to their e-mail address rather than conventional usernames and passwords The browser handles the authentication process for the user, enabling relatively secure single-click logins on websites that support the scheme Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/317341.shtmlhttp://www.secuobs.com/revue/news/317341.shtml Secuobs.com : 2011-07-15 04:04:11 - Security - IMAGE Passwords are a perennial problem in computer security We all know that we're meant to pick secure passwords and never reuse them, but few of us actually bother One consequence this can cause is losing access to our accounts some bad guy figures out the password to our World of Warcraft, Steam, or e-mail account, and then proceeds to trash it To try to ensure that Hotmail accounts don't fall prey to such attacks, Microsoft will soon be changing its password policy, to forbid the use of particularly common passwords This means that anyone creating a new Hotmail account or changing the password of an existing account won't be able to use obvious and common passwords like 123456 or password The system will also block common phrases, like ilovecats In the future, Microsoft may also extend this ban on obvious passwords to existing accounts at a later date This is a wise move As data from the Gawker password hack, the HBGary Federal hack, the Booz Allen Hamilton hack, and many others have shown, obvious passwords are abundant People consistently choose poorly Blocking the use of these obvious passwords might be a little annoying for those who want to use them, but it's a move that's in everyone's best interest And if an account does get compromised There's a new feature to handle that situation too If a friend on Hotmail sends you spam or fraudulent mail, you can now report that their account is hacked The feature, called My friend's been hacked , will block their account so the spammer can no longer use it, and next time your friend tries to log in, they'll have to go through the account recovery process Now, if only every service that used passwords could do this Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/317115.shtmlhttp://www.secuobs.com/revue/news/317115.shtml Secuobs.com : 2011-07-14 19:30:34 - Security - IMAGE Hackers have reverse engineered the femtocells used by British mobile operator Vodafone, and discovered that they can be used to eavesdrop on callers and used to fraudulently place calls and send text messages Femtocells are being used increasingly often to provide better phone reception in areas with a weak signal They contain short-range mobile base stations typically with a range of 30-60 feet paired up with Internet connections Users within the range of the femtocell have their calls routed over a home Internet connection to the mobile operator's system Vodafone calls its femtocells Sure Signal The Sure Signal costs 50, and supports up to 32 phone numbers belonging to 3G phones or Internet dongles They can be used by any Vodafone customer, whether contracted or pay-as-you-go, with an Internet connection of 1Mbps or faster Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/317017.shtmlhttp://www.secuobs.com/revue/news/317017.shtml Secuobs.com : 2011-07-13 00:09:03 - Security - IMAGE The Do Not Track efforts led by self-managed advertising groups aren't going as well as some might hope, with at least eight participating companies continuing to track users across the Web even after they opt out The finding highlights the weaknesses of an entirely voluntary system just because the companies say they will do it doesn't necessarily mean that they will The Network Advertising Initiative NAI is one of several self-regulating groups aimed at adopting voluntary codes of conduct when it comes to advertising to users online Late last year, those groups including the NAI announced that they would begin pushing the Advertising Option Icon, an icon that is meant to let users know which sites are participating in behavioral tracking Users would then be able to easily opt out of any behaviorally targeted advertising if they so choose Collectively, the groups represent some 5,000 other companies that advertise online, though use of the icon itself is voluntary as long as they offer the opt-out functionality Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/316610.shtmlhttp://www.secuobs.com/revue/news/316610.shtml Secuobs.com : 2011-07-11 22:55:59 - Security - IMAGE Servers belonging to IRC Federal, a West Virginia IT company whose clientele included NASA, the Departments of Justice and Defense, and the US Army and Navy, have been broken into, with documents, databases, and e-mails published in yet another hack performed under the AntiSec banner The announcement of the hack and release of the documents was named Fuck FBI Friday II The original Fuck FBI Friday was Lulz Security's announcement that it had hacked a local affiliate of the FBI's cybercrime community InfraGard IRC Federal's connection with the FBI is rather more tenuous the company is privately held, providing services to the government Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/316343.shtmlhttp://www.secuobs.com/revue/news/316343.shtml Secuobs.com : 2011-07-11 17:41:53 - Security - IMAGE IMAGE It was January 2010, and investigators with the International Atomic Energy Agency had just completed an inspection at the uranium enrichment plant outside Natanz in central Iran, when they realized that something was off within the cascade rooms where thousands of centrifuges were enriching uranium Natanz technicians in white lab coats, gloves, and blue booties were scurrying in and out of the clean cascade rooms, hauling out unwieldy centrifuges one by one, each sheathed in shiny silver cylindrical casings Any time workers at the plant decommissioned damaged or otherwise unusable centrifuges, they were required to line them up for IAEA inspection to verify that no radioactive material was being smuggled out in the devices before they were removed The technicians had been doing so for more than a month Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/316274.shtmlhttp://www.secuobs.com/revue/news/316274.shtml Secuobs.com : 2011-07-11 15:01:06 - Security - We need to start focusing on improving the application deployment processes that all too often are the bulk of time spent trying to get an application out the door image The application deployment process is broken Oh, I know it looks like it s actually improving, but it s not Virtualization came along and took the low hanging fruit off the application deployment tree and paid no never mind to those still waiting in the upper branches While applications are easy to provision today thanks to the wonders of virtualization, the rest of the infrastructure still is not That s problematic, because while we ve made it easy to spin up an application, we haven t made it easy to spin up the services required to actually deliver it to the consumer whether that be internal or external end-users One could actually view the provisioning of an application instance as the event that triggers a series of other events, all required to provide for the security, scalability and availability of that application We ve automated the beginning, but we re still for the most part manually configuring the nitty-gritty infrastructure details Within the industry we hear the term application development lifecycle but we rarely hear the term application deployment lifecycle and that s an important distinction to make The development lifecycle is only one piece of a much larger and too often lengthier process Consider all the services existing within the infrastructure and then which of those services might need to be updated, changed or otherwise modified to support a new application CheckMark DNS Some applications will be delivered via their own host name If so, DNS must be configured to support it If the application is being deployed across multiple sites for resiliency or performance-related global load balancing, those systems, too, must be configured CheckMark Firewall Services If the application in question may be running on an unusual port, that needs configuration Too, there may be request rate monitoring that needs to be configured to recognize possible attacks, as well as other edge security services CheckMark Load Balancing Service If the application requires high availability or will need to scale to support high volume, load balancing services must be configured Algorithms, strategies for fail over, and persistence settings will all need to be determined and configured CheckMark Web Application Platform If the topology demands it, the web application platform the OS and even the hypervisor if it s virtualized may need tweaks to its network stack to ensure proper routing through the infrastructure CheckMark Web Access Management Service Web access management is today often centralized outside the application If access to the application is restricted in any way or single-sign on is required, additional configuration may be necessary CheckMark APM Application Performance Management Services Services providing performance monitoring both internal and external may need to be configured to recognize the application, thresholds for alerting may need to be set and schedules for reports configured CheckMark web application firewall Services If the application is protected against SQLi and other malicious inbound attack patterns by a web application firewall, those policies must be created and tested before going live CheckMark Event and Log Correlation Event and log correlation, especially in large enterprise deployments, is a necessity to assist in troubleshooting and auditing Configuration may be necessary to uniquely identify the application and any noteworthy event notifications and alerts configured appropriately This is by no means an exhaustive list and it is already lengthy There are many, many moving parts that need to be configured and tested before deployment of the application can be considered complete These are concerns for which developers have little visibility and little input One might claim they have very little interest in such aspects of the deployment as infrastructure services are often outside their realm of not only expertise but experience and control Yet many of these services require information and an understanding of the application that is best gathered from the application expert the developer Thus the cooperation and collaboration of development with operations during the application deployment lifecycle becomes critical to ensuring the successful deployment of that application imageBut even if we assume we can get the cooperation, that still leaves us with a mostly manual-intensive deployment process While devops has begun leveraging development methodologies such as agile as a way to improve operational deployment of applications, it has not embraced the reality that deployment processes are about architectures, not applications, and a much more infrastructure-inclusive approach is necessary to making more efficient and repeatable the rest of the deployment lifecycle processes REPEATABLE ARCHITECTURES are the FUTURE We ve seen the efficiency gains from repeatable application provisioning that come from devops It s an excellent affirmation of the positive impact of applying development methodologies to operations But we can t stop at the application platform we need to keep moving the concept of repeatable and therefore consistent architectures into the infrastructure services that make up the bulk of the deployment lifecycle The problem, many might say and they d be right is that infrastructure itself does not adequately support the notion of repeatable Configurations are often unwieldy, difficult to parse files full of component-specific language that makes it difficult to automate While certainly Infrastructure 20 components with their service-enabled control planes are capable of being configured in a more granular fashion these methods, like infrastructure in general, use component specific language that is difficult for operations to translate, let alone developers completely unfamiliar with the inner workings of network and infrastructure devices to adopt This is why we can t have nice things Infrastructure must support a more services and application-friendly means of configuration it must treat policies more like services that are invoked during the application delivery process based on context It needs to use language that s familiar to developers and operations and allow for management based on the particular management paradigm of the organization PACKAGING is KEY One of the ways in which virtualization has aided this style of operational configuration management is to allow the entire application stack from OS to platform to be configured specifically to support a single application It s a self-contained, fully configured, working environment That s part of what devops creates today during the initial stages of the deployment process We need to extend that concept to infrastructure A load balancing service needs to scale and provide availability for an application not an IP address and it must be able to describe itself in terms more common to both operations and development It may be that virtualization will again come to the rescue whether through an architectural infrastructure approach that leverages virtual network appliances as the core unit of infrastructure deployment or virtual instances initiated within hardware The reason auto-scaling works is that repeatable deployment of applications became possible by packaging up the application and its immediate environs the web and application platforms along with its configuration We need the same style of deployment packaging in infrastructure either in a similar fashion to that of application packaging through virtualization of a configured environment or through ability to create, manage and maintain application delivery and network policies as a package that is easily repeated on-demand Only by extending the notion of services into the network can we hope to reduce and make more efficient the most time eroding portions of the application deployment process Only by extending the notion of services to policies and processes within the infrastructure components can we make deployments consistent and thus repeatable and ultimately provisionable as a service It will be these building block services that form the foundation for IT as a Service and lay the potential for developers to self-service the entire application deployment process in the future --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 google o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles Document-icon Sometimes It Is About the Hardware Document-icon Intercloud Are You Moving Applications or Architectures Document-icon IT as a Service A Stateless Infrastructure Architecture Model Document-icon Now Witness the Power of this Fully Operational Feedback Loop Document-icon Cloud is the How not the What Document-icon Challenging the Firewall Data Center Dogma Document-icon Cloud-Tiered Architectural Models are Bad Except When They Aren t Document-icon Cloud Chemistry 101 Document-icon You Can t Have IT as a Service Until IT Has Infrastructure as a Service Technorati Tags MacVittie,F5,v11,cloud computing,virtualization,devops,infrastructure 20,dynamic infrastructure,infrastructure services,architecture,application delivery IMAGE http://www.secuobs.com/revue/news/316243.shtmlhttp://www.secuobs.com/revue/news/316243.shtml Secuobs.com : 2011-07-08 17:09:34 - Security - IMAGE Microsoft is only issuing four bulletins for Patch Tuesday this month, but it will fix a hefty 22 vulnerabilities Three bulletins update Windows, the fouth addresses a number of flaws in Visio 2003 One of the Windows bulletins is ranked critical, with the remainder all merely important Unusually, the critical bulletin is only applicable to Windows Vista and Windows 7 Windows XP and the server operating systems won't need it The critical Windows bulletin and the Office update both fix remote code execution issues the other two Windows fixes resolve elevation of privilege flaws All three Windows updates need a reboot to apply, though the Visio one should not Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/315862.shtmlhttp://www.secuobs.com/revue/news/315862.shtml Secuobs.com : 2011-07-08 03:02:44 - Security - IMAGE After 32 raids across Italy and one in Switzerland , 15 alleged members of Anonymous have been arrested The detainees, aged between 15 and 28 with five under 18, have been accused of performing denial of service attacks on Italian Web sites belonging to the government, and on both state and private broadcasters The Italian authorities are describing one of the suspects, a 26-year-old Swiss-Italian going by the monkier Phre, as a leader of the hacking group A further 30 suspects are still being sought Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/315765.shtmlhttp://www.secuobs.com/revue/news/315765.shtml Secuobs.com : 2011-07-03 12:49:29 - Security - With thanks to Mathias Kresin for being the first to notice An incident, what fun Earlier today, I was alerted that a vsftpd download from the master site vsftpd-234targz appeared to contain a backdoor http pastebincom AetT9sS5 The bad tarball is sha256sum 2a4bb16562e0d594c37b4dd3b426cb012aa8457151d4718a5abd226cef9be3a5 vsftpd-234targz And, of course, the GPG signature notices gpg vsftpd-234targzasc gpg Signature made Tue 15 Feb 2011 02 38 11 PM PST using DSA key ID 3C0E751C gpg BAD signature from Chris Evans Check your signatures Ideally, you'll see something like gpg Signature made Tue 15 Feb 2011 02 38 11 PM PST using DSA key ID 3C0E751C gpg Good signature from Chris Evans Primary key fingerprint 8660 FD32 91B1 84CD BC2F 6418 AA62 EC46 3C0E 751C Signatures aside, I also took the liberty of moving most of the vsftpd site and latest download to a hosting provider I have more faith in https securityappspotcom vsftpdhtml https securityappspotcom downloads vsftpd-234targz https securityappspotcom downloads vsftpd-234targzasc The backdoor payload is interesting In response to a smiley face in the FTP username, a TCP callback shell is attempted There is no obfuscation More interestingly, there's no attempt to broadcast any notification of installation of the bad package So it's unclear how victims would be identified and also pretty much guaranteed that any major redistributor would notice the badness Therefore, perhaps someone was just having some lulz instead of seriously trying to cause trouble http://www.secuobs.com/revue/news/314929.shtmlhttp://www.secuobs.com/revue/news/314929.shtml Secuobs.com : 2011-07-01 19:33:07 - Security - IMAGE Researchers at Kaspersky Labs analyzing the 45 million-strong Alureon botnet also known as TDL and TDSS have branded it practically indestructible Law enforcement agencies have had some success recently at disrupting and bringing down botnets, with Coreflood, Rustock, and Waledac all successfully disrupted The design of TDL's underlying rootkit is going to make similar retaliatory action much harder to pull of TDL-4 has been specifically designed to avoid destruction whether by law-enforcement, anti-virus software, or competing botnets On installation, TDL-4 will remove other rootkits, an act which both deprives competing operators of income and reduces the chance that the user will notice that their system is behaving strangely and attempt to repair it The goal of a rootkit is to remain undetected, and that includes noticing that a computer simply isn't behaving correctly Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/314769.shtmlhttp://www.secuobs.com/revue/news/314769.shtml Secuobs.com : 2011-07-01 13:19:59 - Security - f5friday Pop Quiz In recent weeks, which of the following attack vectors have been successfully used to breach major corporation security choose all that apply CheckMark Phishing CheckMark Parameter tampering CheckMark SQL Injection CheckMark DDoS CheckMark SlowLoris CheckMark Data leakage If you selected them all, give yourself a cookie because you re absolutely right All six of these attacks have successfully been used recently, resulting in breaches across the globe International Monetary Fund US Government Senate CIA Citibank Malaysian Government Sony Brazilian governmentand Petrobraslatest LulzSecvictims That s no surprise attacks are ongoing, constantly They are relentless Many of them are mass attacks with no specific target in mind, others are more subtle, planned and designed to do serious damage to the victim Regardless, these breaches all have one thing in common the breach was preventable At issue is the reality that attackers today have moved up the stack and are attacking in the data center s security blind spot the application layer Gone are the days of blasting the walls of the data center with packets to take out a site Data center interconnects have expanded to the point that it s nearly impossible to disrupt network infrastructure and cause an outage without a highly concerted and distributed effort It does happen, but it s more frequently the case that attackers are moving to highly targeted, layer 7 attacks that are far more successful using far fewer resources with a much smaller chance of being discovered The security-oriented infrastructure traditionally relied upon to alert on attacks is blind unable to detect layer 7 attacks because they don t appear to be attacks They look just like normal users quote-badge The most recent attack, against wwwciagov, does not appear to be particularly sophisticated LulzSec described that attack as a simple packet flood, which overwhelms a server with volume Analysts at F5, which focuses on application security and availability, speculated that it actually was a Slowloris attack, a low-bandwidth technique that ties up server connections by sending partial requests that are never completed Such an attack can come in under the radar because of the low volume of traffic it generates and because it targets the application layer, Layer 7 in the OSI model, rather than the network layer, Layer 3 IMAGE emphasis added -- Ongoing storm of cyberattacks is preventable, experts say It isn t the case that organizations don t have a sound security strategy and matching implementation, it s that the strategy has a blind spot at the application layer In fact, it s been the evolution of network and transport layer security success that s almost certainly driven attackers to climb higher up the stack in search of new and unanticipated and often unprotected avenues of opportunity imageELIMINATING the BLIND SPOT Too often organizations and specifically developers hear the words layer 7 anything and immediately take umbrage at the implication they are failing to address application security In many situations it is the application that is vulnerable, but far more often it s not the application it s the application platform or protocols that is the source of contention, neither of which a developer has any real control over Attacks designed to specifically leech off resources SlowLoris, DDoS, HTTP floods simply cannot be noticed or prevented by the application itself Neither are these attacks noticed or prevented by most security infrastructure components because they do not appear to be attacks In cases where protocol HTTP exploitation is leveraged, it is not possible to detect such an attack unless the right information is available in the right place at the right time image The right place is a strategic point of control The right time is when the attack begins The right information is a combination of variables, the context carried with every request that imparts information about the client, network, and server-side status If a component can see that a particular user is sending data at a rate much slower than their network connection should allow, that tells the component it s probably an application layer attack that then triggers organizational policies regarding how to deal with such an attack reject the connection, shield the application, notify an administrator Only a component that is positioned properly in the data center, ie in a strategic point of control, can properly see all the variables and make such a determination Only a component that is designed specifically to intercept, inspect and act on data across the entire network and application stack can detect and prevent such attacks from being successfully carried out BIG-IP is uniquely positioned topologically and technologically to address exactly these kinds of multi-layer attacks Whether the strategy to redress such attacks is Inspect and Reject or Buffer and Wait , the implementation using BIG-IP simply makes sense Because of its position in the network in front of applications, between clients and servers BIG-IP has the visibility into both internal and external variables necessary With its ability to intercept and inspect and then act upon the variables extracted, BIG-IP is perfectly suited to detecting and preventing attacks that normally wind up in most infrastructure s blind spot This trend is likely to continue, and it s also likely that additional blind spots will appear as consumerization via tablets and mobile devices continues to drive new platforms and protocols into the data center Preventing attacks from breaching security and claiming victory whether the intent is to embarrass or to profit is the goal of a comprehensive organizational security strategy That requires a comprehensive, ie multi-layer, security architecture and implementation One without any blind spots in which an attacker can sneak up on you and penetrate your defenses It s time to evaluate your security strategy and systems with an eye toward whether such blind spots exist in your data center And if they do, it s well past time to do something about it More Info on Attack Prevention on DevCentral User-Group-icon DevCentral Security Forums User-Group-icon DDoS Attack Protection in BIG-IP Local Traffic Manager User-Group-icon DDoS Attack Protection in BIG-IP Application Security Manager --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles Document-icon Anonymous group's DDoS attacks lead to a fresh interest in how to secure against an invasion Document-icon The Many Faces of DDoS Variations on a Theme or Two Document-icon What We Learned from Anonymous DDoS is now 3DoS Document-icon F5 Friday Multi-Layer Security for Multi-Layer Attacks Document-icon Cure Your Big App Attack Document-icon Custom Code for Targeted Attacks Document-icon And The Hits Keep Coming pdf-icon TheInfoPro Emergence of Application Firewalls pdf-icon Web Application Firewalls - Application protection and much more pdf-icon Intelligent Layer 7 DoS and Brute Force Protection for Web Applications Technorati Tags F5,F5 Friday,MacVittie,security,web application security,multi-layer security,SQLi,XSS,DLP,BIG-IP,infosec,phishing,DoS,DDoS IMAGE http://www.secuobs.com/revue/news/314680.shtmlhttp://www.secuobs.com/revue/news/314680.shtml Secuobs.com : 2011-06-28 22:37:15 - Security - IMAGE A group that calls itself YGN Ethical Hacker Group has identified potential security holes in Apple's website for Mac and iOS developers Those security holes could allow malicious hackers to use the Apple Developer Connection in phishing attacks to gain access to users' login and password information According to information supplied to Networkworld, the group identified three potential security issues on the site, including arbitrary URL redirects, cross-site scripting, and HTTP response splitting In particular, the ability to arbitrarily redirect to other URLs could make phishing attacks against developers login credentials more likely to succeed By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials, the group said Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance In other words, even though the redirect will cause users to end up at a malicious site, the original link would appear to come from developerapplecom Since developers use their Apple ID to access password-protected areas of Apple's developer website, such as forums, beta OS releases, and SDKs, a successful phishing attack could give hackers access to a user's iTunes Connect account, iTunes Store purchases, and more If the e-mail address is valid, hackers could also try using password cracks to get into a user's e-mail as well YGN said that it alerted Apple to the problem in late April, and that the company quickly acknowledged getting the report We take the report of a potential security issue very seriously, Apple told YGN However, it doesn't appear Apple has closed the security holes To encourage Apple to act, the group says that it will release its discoveries to the security mailing list Full Disclosure in a few days Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/314090.shtmlhttp://www.secuobs.com/revue/news/314090.shtml Secuobs.com : 2011-06-28 20:43:50 - Security - IMAGE A group that calls itself YGN Ethical Hacker Group has identified potential security holes in Apple's website for Mac and iOS developers Those security holes could allow malicious hackers use the Apple Developer Connection in phishing attacks to gain access to users' login and password information According information supplied to Networkworld, the group identified three potential security issues on the site, including arbitrary URL redirects, cross-site scripting, and HTTP response splitting In particular, the ability to arbitrarily redirect to other URLs could make phishing attacks against developers login credentials more likely to succeed By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials, the group said Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance In other words, even though the redirect will cause users to end up at a malicious site, the original link would appear to come from developerapplecom Since developers use their Apple ID to access password-protected areas of Apple's developer website, such as forums, beta OS releases, and SDKs, a successful phishing attack could give hackers access to a user's iTunes Connect account, iTunes Store purchases, and more If the e-mail address is valid, hackers could also try using password cracks to get into a user's e-mail as well YGN said that it alerted Apple to the problem in late April, and that the company quickly acknowledged getting the report We take the report of a potential security issue very seriously, Apple told YGN However, it doesn't appear Apple has closed the security holes To encourage Apple to act, the group says that it will release its discoveries to the security mailing list Full Disclosure in a few days Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/314075.shtmlhttp://www.secuobs.com/revue/news/314075.shtml Secuobs.com : 2011-06-27 01:36:42 - Security - IMAGE Lulz Security, the group of hackers that have made a name for themselves with hacks of Sony, Nintendo, PBS, and more, claimed yesterday that it was calling it quits, with no more hacking or releases of stolen documents under the LulzSec name planned for the future To celebrate the end of LulzSec, the group released final torrent of pilfered material more documents and user credentials from a range of sources including AOL and AT T The press release claims that LulzSec only planned to operate for fifty days, and hence that this decision to ditch the LulzSec name was not being made in response to the continued pressure the group is coming under from both law enforcement and other hacking groups This claim is a little hard to reconcile with the release of documents stolen from the Arizon DPS that the group made on Friday That publication was claimed to be the first of many, with more documents due to arrive on Monday, and subsequent documents on a weekly basis If such releases are made, they won't be under the LulzSec brand The documents released on Friday were collected as part of Operation Anti-Security , the name LulzSec has given to a bunch of attacks made on law enforcement and private security companies In the press release announcing the retirement of the LulzSec name, the group expressed the hope that AntiSec would continue, and that security organizations would continue to come under attack AntiSec was itself somewhat contradictory LulzSec always maintained that it was motivated by amusement rather than political principles, and yet the decision to specifically make law enforcement agencies the target was an apparently political one These political motivations are also hard to reconcile with many of the releases the group has made even the last torrent of information contained usernames and password hashes for gaming forums and the game Battlefield Heroes As a result of that security breach, EA has taken Battlefield Heroes offline until the problem can be remedied The torrent itself has been pulled by The Pirate Bay after it was found that the files taken from AT T included malware One factor that may have encouraged LulzSec to retire its name and perhaps keep a lower profile is the continued efforts by the group's opponents to uncover the identities of those behind the LulzSec name and publish as much personal information about them as possible A group calling itself The A-Team posted a substantial amount of data about members of LulzSec yesterday, and this release may have been the straw that broke the came's back, forcing LulzSec to drop out of the public eye Though the LulzSec name may now be dead, former members are promising that its AntiSec mission will continue, albeit in a less centralized way Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/313685.shtmlhttp://www.secuobs.com/revue/news/313685.shtml Secuobs.com : 2011-06-24 20:35:04 - Security - NATO is warning users of its online e-Bookshop that it has suffered a data breach, and that passwords should be changed Read More NATO alert Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/313445.shtmlhttp://www.secuobs.com/revue/news/313445.shtml Secuobs.com : 2011-06-24 15:12:35 - Security - IMAGE Hacking group Lulz Security has released a torrent of documents stolen from the Arizona Department of Public Safety in what it says will be the first release of information accumulated as part of Operation Anti-Security, a campaign to hack, disrupt, and embarrass law enforcement agencies and private security contractors LulzSec claims that it targeted Arizona law enforcement in response to Arizona's controversial anti-immigration law, saying that it opposes the law itself, and the racial profiling anti-immigrant police state that is Arizona The torrent, entitled Chinga La Migra which translates as f k the police or f k the border patrol contains documents pertaining to border patrol and counter-terrorism operations and describe the use of informants to infiltrate various gangs, cartels, motorcycle clubs, Nazi groups, and protest movements The documents themselves are variously marked law enforcement sensitive , not for public distribution , and for official use only Many of the documents appear to be mundane There are bulletins describing suspects with outstanding warrants, court documents, and interdepartmental e-mail correspondence The presumed source of the files are the e-mail accounts of seven police officers listed in LulzSec's press release The officers' e-mail passwords are also included, and demonstrate a very low level of awareness of computer security passwords include 12345 , rosebud , and officers' badge numbers The Arizona DPS has confirmed that it has been hacked, and has disabled its Web-based e-mail and Web site in response DPS spokesman Steve Harrison confirmed that the documents seemed to be authentic, and said that the agency's IT people were investigating the attack He also claimed that the agency had heard rumors or a tip that its systems were going to be attacked The group promised that it would make new Operation Anti-Security releases each week that will reveal private law enforcement and military documents, with intent being to purposefully sabotage their efforts to terrorize communities fighting an unjust 'war on drugs' The next set of documents can be expected on Monday Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/313379.shtmlhttp://www.secuobs.com/revue/news/313379.shtml Secuobs.com : 2011-06-23 03:52:16 - Security - IMAGE Hacking group Lulz Security has found itself coming under attack from all angles, drawing unwanted attention from both law enforcement and other hackers groups Though the group's antics have won it many fans who appreciate LulzSec's anti-establishment leanings, they've also earned plenty of enemies, and those enemies have started to fight back So far, they've posted LulzSec's dox the names, pictures, and addresses of the people claimed to be the ringleaders of the group Since LulzSec first gained prominence, pro-US hacker th3j35t3r The Jester has worked to uncover their identities and embarrass them th3j35t3r, who has made a name for himself by knocking pro-jihad Web sites offline, has butted heads with Anonymous in the past, opposing the faceless collective's support for WikiLeaks He worked to disrupt the activities of the AnonOps faction taking servers offline and revealing names of the participants Since many of AnonOps' key players moving on to form LulzSec, th3j35t3r's focus has shifted accordingly Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/313012.shtmlhttp://www.secuobs.com/revue/news/313012.shtml Secuobs.com : 2011-06-23 00:25:10 - Security - IMAGE Google has created a new tool that allows those who install it to see security holes on websites, the company announced on their security blog Tuesday Named DOM Snitch, the Chrome extension uses various ways of intercepting Javascript calls to spot the use of functions that can inject code from outside sources Google intends it to help show developers where their client-side code needs work The company notes that, as Web applications become more complex, the number and kinds of attacks that can be successfully launched against them will increase Google hopes that the tool will help developers, testers, and security professionals tie up more loose ends with their code and prevent client-side attacks While it's still in an experimental phase, DOM Snitch can intercept many different kinds of Javascript calls and then record the URLs accessed by a document and a complete stack trace This set of information lets developers and testers see if any interlopers who intercept a call would be able to progress to cross-site scripting, mixed content, or insecure modifications to the same-origin policy for DOM access Users can see DOM modifications in real time, and can export the results of the test to share with colleagues DOM Snitch seems like more of a teaching tool or sanity check than a must-have security essential, but it may still see wide use among those still learning how to write secure Javascript code At least a few users won't be able to resist using the tool for a little public shaming of popular, security-negligent websites Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/312969.shtmlhttp://www.secuobs.com/revue/news/312969.shtml Secuobs.com : 2011-06-22 13:16:34 - Security - Don t get so focused on the trebuchets, mangonels and siege towers that you forget about the sappers mangonetWe often compare data center security to castles and medieval defenses If we re going to do that, we ought to also consider the nature of attacks in light of the military tactics used to perpetrate such attacks, namely siege warfare It s likely more apropos today than it was when the analogy was first made because today organizations are definitely under siege from a variety of attack methods Most of them are obvious if you have someone on the walls monitoring traffic You can see the ammunition being fired from the trebuchets and mangonels and feel the walls shaking as they are pounding, again and again, by the large rocks network layer attacks hurled with great force You might even notice a siege tower or two being hauled closer and closer to the walls in an attempt to get atop the walls, take out the archers that are waiting, and penetrate deeper into the keep s defenses ultimately hoping to loot the keep applications and steal the treasure data In medieval times siege warfare could last weeks, months and even years In the data center, attacks may not last as long but the impact of the modern digital siege - measured in downtime and dollars can be just as devastating Interestingly, siege warfare became more interesting and dangerous with the introduction of mining Mining was the process of digging tunnels underneath the walls surrounding the keep with the intention of weakening or in later years destroying its supports, thus bringing down the primary obstacle between the attackers and their intended target In later years the men who were at first called simply miners became known as sappers and would eventually take on broader engineering tasks unsuitable for the typical siege warfare combatant The trick for the defenders was to figure out where the sappers might mine the walls and prevent it - often by collapsing the tunnel before the attackers could do damage to the supports or walls In many sieges, the sappers were the primary means of breaching the walls The rest of the attacks the big stones, flaming pitch, and arrows coming from the main body of the army were merely a distraction A method of tying up the defender s resources while the real attack went hopefully unnoticed underneath the walls Modern attacks leverage much the same style of attack against the data center the network and infrastructure-focused attacks are siege weapons, designed to detract you from the real attack that s going on at other layers of the stack trebuchet BEWARE the APPLICATION LAYER SAPPERS Now, the sappers today aren t actually attacking under the floor but like ancient sappers they are more focused in their attack and are definitely more dangerous to the health and well-being of the application While the network is besieged by a variety of network-layer attacks, the sappers are going after the applications, using more modern and infinitely more difficult to detect methods of bringing it down They re turning the application protocols against the application, using fewer resources to accomplish the same results The problem is that you can t ignore the siege and focus solely on the sappers, and neither can you can ignore the sappers and focus wholly on the siege There needs to be protections up and down and across the data center that can detect and or prevent such attacks from having an impact on the availability of applications and their supporting infrastructure The wall does work, as long as it is strong enough and has enough resources and intelligence to be able to stand despite the barrage of attacks it experiences We need to extend the wall up and down, to cover applications in a way that also makes them able to stand against attacks that would sap resources regardless of how quickly that may occur The motte and bailey, moat and keep, is no longer enough You need to put into place protections at the application layer, as well, recognizing that it s not just about data theft but about resource theft And while the former is more easily detected through the use of a web application firewall, the latter is more subtle and may go undetected Protection from such attacks are necessary to prevent the rapid reduction in capacity that ultimately leads to outages Solutions capable of shielding the application from the impact of slow, transport and application layer attacks is just as necessary as being able to deflect network layer attacks Multi-layer security is not a nice to have these days, it is a must have if one is to properly protect the data center from the increasingly hostile hordes attempting to bring down, take out and steal data from applications in the data center The term sapper is wholly fit to be applied to the application layer attackers today because what they re trying to do is sap the resources of an application and bring it down by slowly but surely consuming those resources, all the while undetected by the operators manning the data center walls It s time to re-evaluate your siege plans and if necessary put into place those protections that not only deflect the attacks of modern siege weapons, but prevent the sappers from sneaking under the data center walls and taking out the application directly --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles Document-icon The Many Faces of DDoS Variations on a Theme or Two Document-icon Spanish police website hit by Anonymous hackers June 2011 Document-icon What We Learned from Anonymous DDoS is now 3DoS Document-icon Custom Code for Targeted Attacks Document-icon Defense in Depth in Context Document-icon The Big Attacks are Back Not That They Ever Stopped Document-icon IP Identity Theft in Cloud Computing Environments Document-icon If Security in the Cloud Were Handled Like Car Accidents Document-icon F5 Friday Multi-Layer Security for Multi-Layer Attacks Document-icon Challenging the Firewall Data Center Dogma Document-icon The True Security Company Red Herring Technorati Tags MacVittie,F5,security,web application security,multi-layer security,DDoS,network,firewall,application layer attack,web application firewall IMAGE http://www.secuobs.com/revue/news/312823.shtmlhttp://www.secuobs.com/revue/news/312823.shtml Secuobs.com : 2011-06-21 18:51:04 - Security - IMAGE A 19-year-old alleged member of the Anonymous and LulzSec hacking groups has been arrested in the UK The Metropolitan Police Central e-Crime Unit announced that Ryan Cleary, of Wickford, Essex, was arrested last night on suspicion of offenses under the Computer Misuse Act and Fraud Act He's currently being held in a central London police station Cleary was responsible for running one of the IRC servers used by AnonOps, a faction of the Anonymous group that co-ordinated attacks on both perceived enemies of WikiLeaks and various Middle Eastern governments, until an acrimonious split last month Subsequently, he is believed to have been a member of Lulz Security, responsible for running that group's IRC server The police, working in co-ordination with the FBI, have seized a significant amount of material from Cleary's address which is now undergoing forensic examination LulzSec, for its part, is denying that any member of their group has been arrested, wondering which poor bastard had been taken in However, their IRC server is offline, which would be consistent with claims that it was operated by Cleary Concurrent with this, a post made to Pastebin that purports to be a LulzSec press release claims that the group has stolen the data collected in the UK's recent census The post claims that the data will be published once it has been suitably formatted Collecting the data was outsourced to defense contractor Lockheed Martin itself the victim of recent attacks Speaking to Channel 4 News, a spokesperson for the census claimed that there was no evidence to suggest that the data had been compromised LulzSec this morning sought to distance itself from the census claims The group pointed out that anyone can paste the Lulz Boat ASCII art into Pastebin, and said that only releases that were promoted via Twitter should be trusted There was no tweet publicizing the census post Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/312657.shtmlhttp://www.secuobs.com/revue/news/312657.shtml Secuobs.com : 2011-06-18 18:06:56 - Security - IMAGE Why Microsoft has made developers horrified about coding for Windows 8 Microsoft's Windows 8 demonstration at the D9 conference looked pretty, but carried a chilling message for developers if they wanted to write for the new operating system, they'd have to use HTML5 and JavaScript This might seem a crazy move from a company that prides itself on backwards compatibility, but the warning signs have been there for quite some time now Titanic Takeover Tuesday LulzSec's busy day of hacking escapades It's not just leaking private data that amuses the hackers of Lulz Security today their quest for lulz led them to knock over websites and game servers in a series of distributed denial of service attacks 4chan users are upset, but LulzSec is dismissing them as a bunch of b tards Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/312144.shtmlhttp://www.secuobs.com/revue/news/312144.shtml Secuobs.com : 2011-06-17 03:43:38 - Security - IMAGE Though Internet Explorer 9 has made great strides in improving Internet Explorer's standard support, and version 10 is similarly set to include a whole range of new features, one thing that Microsoft hasn't even touched is WebGL, a specification that allows webpages to create 3D graphics using an API based on the venerable OpenGL API A blog post today from the company's security engineers may explain why they don't think there's any way to implement it safely Three main concerns are enumerated in the post WebGL exposes too much sensitive, privileged, or unhardened code to the Web depends too heavily on third-party code for security and is too susceptible to denial of service attacks The first of these is perhaps most significant Video hardware and video drivers are traditionally only exposed to relatively trusted code programs that the user has explicitly chosen to install Display drivers are notoriously unstable and buggy, and developers of 3D software have to go to quite some effort to ensure their programs do not use or misuse the 3D hardware in such a way as to cause problems Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/311809.shtmlhttp://www.secuobs.com/revue/news/311809.shtml Secuobs.com : 2011-06-16 20:11:11 - Security - IMAGE Hacking group Lulz Security is continuing to amuse itself at the expense of others, with the release today of 62,000 e-mail addresses and associated passwords The group didn't say where it got the information, or how it got it instead, it exhorted its Twitter followers to create lulz of their own, and use the information to break into Facebook, Twitter, World of Warcraft, and much more a task often made easy by the use of shared passwords The tweets that followed suggest that their followers have risen to the challenge, with numerous tales of multiple e-mail break-ins and account compromises, vandalism of Facebook and dating site profiles, and more This comes after another day of distributed denial of service attacks Following on from Titanic Takeover Tuesday, LulzSec yesterday continued to DDoS various game login servers In a more daring move, the group brought down ciagov under a flood of traffic If its past actions haven't got the attention of law enforcement, the CIA attack is sure to have done so The group also embarked on a rather more old-school denial of service attack, flooding not just Web servers but phone switchboards too They set up a phone number and redirected it to various targets of their choosing apparently including an FBI office in Detroit and then asked their Twitter followers to call it The result Switchboards swamped with thousands of calls The CIA attack, along with a bunch of tweets today mocking HBGary, and the earlier PBS hack, shows that perhaps the group is a little more politically motivated than it lets on Though ostensibly motivated merely by lulz, seeking amusement from the trouble caused for others, LulzSec's members do seem to retain political leanings similar to their Anonymous forbears Indiscriminate as they may be it doesn't matter what line of business you're in, if your systems suffer from basic security flaws, they're happy to exploit you and publish the results being part of the establishment and acting against the interests of WikiLeaks are both grounds for extra attention from the LulzSec crew LulzSec's escapades have also been immortalized in a video from NMA Never before has the true spirit of 4chan, Anonymous, and LulzSec been captured on film NMA's LulzSec goes on hacking rampage for Lolz Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/311703.shtmlhttp://www.secuobs.com/revue/news/311703.shtml Secuobs.com : 2011-06-15 16:55:27 - Security - Help Net Security has published a list of the top 10 most common iPhone passcodes after analyzing 204,508 of them Is yours one of the common ones Read More Help Net Security Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/311394.shtmlhttp://www.secuobs.com/revue/news/311394.shtml Secuobs.com : 2011-06-15 00:21:19 - Security - IMAGE Lulz Security, the hacking group apparently motivated by nothing more than their desire to laugh at the mayhem they cause, has had a busy day in an event they called Titanic Takeover Tuesday Taking a break from their dumps of user data and server break-ins, today saw the group perform a bunch of distributed denial of service attacks against a range of targets First up and still only intermittently available at the time of writing was gaming magazine The Escapist, with no apparent reason for the attack LulzSec boasted that taking down the site required just 04 percent of its DDoS capacity Next in line were the login servers for the game EVE Online The effect of this attack was to bring down the EVE Online website at the same time, though LulzSec insists that this was not the actual target In response to the DDoS, CCP Games, makers of EVE, have taken all their systems offline, for fear that they might be hacked The company has also issued a statement to assure customers that their personal information remains secure The third target and the only one for which the group has offered a rationale beyond lulz is an IT security company named Finfisher Their site was taken down, briefly, because apparently they sell monitoring software to the government or some shit like that Gamers were once more in the crosshairs with the fourth target more login servers, this time for Minecraft Just as with EVE Online, going after the login servers also took out the game's website The pattern was repeated for the fifth target login servers for the game League of Legends were knocked offline, a move which also brought down the game's website The result of all this Lot of enraged gamers complaining about the downtime, and hence, many lulz for Lulz Security Going after gaming targets hasn't made the group universally popular posters on 4chan's b forum, who might normally be sympathetic to lulz-motivated shenanigans, attempted to hunt LulzSec down LulzSec dismissed the b tards as damn furries, saying that they were the cream of the b crop from 2005, distancing themselves from the b tards of today Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/311228.shtmlhttp://www.secuobs.com/revue/news/311228.shtml Secuobs.com : 2011-06-13 22:41:01 - Security - Lulz Security has published data gleaned from a senategov Web server that they shouldn't have access to Read More senategov Web server configuration and other data Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/310912.shtmlhttp://www.secuobs.com/revue/news/310912.shtml Secuobs.com : 2011-06-13 22:41:01 - Security - IMAGE Turkish police have detained 32 people, five of them under 18, on suspicion of involvement in Anonymous-led distributed denial of service attacks against Turkish government websites Sites taken down include Turkey's Telecommunications Presidency and the Ministry of Labor The DDoS attacks were a response to plans by Turkey's Information and Communications Technologies Authority BTK to implement a Web censoring system starting August 22 The country is already no stranger to such censorship, and in the past has demanded ISPs block access to sites such as YouTube, often for prolonged periods, due to real or perceived breaches of Turkish law Anonymous believes that the filters will allow the government to go further, and record and monitor the activity of citizens, allowing the intervention and disruption of political protest and dissent The arrests were made in 12 cities around Turkey Of the 32 arrested, 13 were claimed by Turkish police to be planning an attack on the site of the Supreme Election Board YSK , to coincide with the publication of the results of yesterday's election The response of the Turkish authorities seems remarkably swift, with arrests coming just days after the original attacks This may be a result of Anonymous' widespread use of the LOIC denial of service tool, which offers no anonymity or identity masking the only protection it offers is sheer weight of numbers, and the hope that if thousands of people are attacking a site then law enforcement agencies won't single out any individuals These latest arrests come just days after Spanish authorities arrested three Anonymous hacktivists in response to attacks on banking and government websites AnonOps responded almost immediately with a DDoS attack on the site of the National Police, taking it offline for an hour yesterday Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/310911.shtmlhttp://www.secuobs.com/revue/news/310911.shtml Secuobs.com : 2011-06-12 23:47:00 - Security - IMAGE The International Monetary Fund suffered a major breach earlier this year that allowed hackers to access a large quantity of data, staff and board members were told by e-mail last week The organization has made no public statement, but sources speaking to the New York Times said that breach lasted several months, with a source familiar with the attack telling Bloomberg that the attack was the work of an unspecified foreign government Staff were told that suspicious file transfers were detected two weeks ago, and that these were linked to a compromised desktop computer within the IMF They were also reassured that there was no evidence that personal data was taken or that they would be victims of fraud The hacks predate the arrest of IMF Managing Director Dominique Strauss-Kahn on charges of sexual assualt The IMF holds detailed financial data about foreign economies, as well as documentation of negotiations and discussions with those countries, much of which is private and sensitive, and it's this information that was the most likely target Other financial institutions such as the French Ministry of Finances and Canadian Finance Department and Treasury Board have also been the victim of data-theft hacks this year Perhaps indicative of the hacktivist group's growing reputation, the internal memo said that the intrusion was not connected to Anonymous The IMF uses RSA SecurID tokens, and though they are due to be replaced after RSA was attacked and critical SecurID was compromised, the memo said that there is no indication that the SecurID compromise played a role As a precautionary measure, the World Bank shut down its network connections to the IMF In a statement, the IMF said that it was fully functional and was currently investigating the incident, and the IMF has been joined in this investigation by the FBI Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/310720.shtmlhttp://www.secuobs.com/revue/news/310720.shtml Secuobs.com : 2011-06-12 18:42:44 - Security - IMAGE Lots of bulletins spanning an unusually diverse set of products this month Microsoft is going to ship 16 bulletins in total, patching not just the familiar faces of Windows, Office, and Internet Explorer, but also Silverlight, Visual Studio, SQL Server, and components in the Forefront range A total of 34 different security issues will be fixed Nine bulletins are critical, seven important The critical flaws are all remote code execution bugs the important break-down is one remote code execution, two information disclosure, two denial of service, and two elevation of privilege Though not every patch needs a reboot, there are enough reboot-demanding patches that no-one is likely to escape a little downtime Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/310698.shtmlhttp://www.secuobs.com/revue/news/310698.shtml Secuobs.com : 2011-06-10 21:40:01 - Security - IMAGE Three people suspected of being involved in attacks against websites belonging to Sony, Spanish banks BBVA and Bankia, Italian energy company Enel, and the governments of Egypt, Algeria, Libya, Iran, Chile, Colombia, and New Zealand have been arrested in Spain All three were claimed to be the leadership of hacktivist organization Anonymous in Spain The individuals are accused of performing and organizing large distributed denial of service DDoS attacks that took their victims' Web servers offline The detainees were also claimed to have attacked the websites of Spain's Central Electoral Board on May 18, and later the sites of the Catalan police and the UGT trade union The arrests were made after investigation work by the Brigada de Investigación Tecnológica BIT , the cybercrime division of Spain's civilian police force With these arrests, Spain joins the UK, US, and Netherlands in having taken police action against Anonymous members During the investigation, more than 2,000,000 lines of IRC logs were examined to track down the people involved The three were arrested in Almeria, Barcelona, and Valencia One of those arrested was said to have set up an IRC server in their home, and this server was used by all three to coordinate their various hack attacks Those attacks were DDoS attacks, performed using Anonymous' preferred LOIC tool LOIC has an automatic mode that uses IRC for command and control Also found were malware creation tools and WiFi cracking software two of the people arrested apparently had no Internet connection themselves, instead depending on the WiFi connections of others Though Sony was one of the organizations victimized by the hacktivists, the official statement issued by the police did not indicate any suspicion of involvement in the hacks that forced Sony to take Playstation Network offline for weeks, nor the subsequent hacks made on Sony Web properties by LulzSec Rather, the three hackers appear to have been involved with the denial of service attacks of early April Vocal Anonymous faction AnonOps has long denied that Anonymous had any involvement with the broader, more serious attack against Playstation Network When news of the arrests became public, AnonOps was swift to issue a warning to the Spanish authorities Expect us Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/310519.shtmlhttp://www.secuobs.com/revue/news/310519.shtml Secuobs.com : 2011-06-09 18:52:46 - Security - IMAGE Citigroup has announced that personal information belonging to some of its credit card customers had been compromised by hackers In total, about 1 percent of Citi's 21 million customers had their data taken The system breached was Citi Account Online, which contains names, addresses, account numbers, and similar information Citi claimed that more sensitive data such as dates of birth, social security numbers, and the CVV card security codes was held elsewhere, and has not been compromised Citi also says that only credit card customers were affected however, the Financial Times, which first reported the story, said that it had been contacted by debit card customers whose cards had been compromised The company said that the hacking was detected in early May by routine account monitoring, but offered no information on how the information was taken or by whom it might have been taken Nor did Citi state whether the information had been used to perform fraudulent transactions Citi says that it is in the process of contacting customers about the problem The FT reports that some cardholders discovered the issue when trying to make purchases, only to find the transactions refused and their cards blocked Industry guidelines require the bank to inform its regulator of data breaches as soon as they are detected, but do not require it to inform customers if it is believed that doing so would jeopardize law enforcement investigations Though theft of credit card data is not unusual, taking it directly from a bank is rare More often, hackers go after retailers, who have to physically handle cards and often store card details in their customer databases, or card-holders directly, using keyboard loggers embedded into malware Bank systems are assumed to be more robust and better-protected against attacks This data breach shows that that confidence may be misplaced Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/310206.shtmlhttp://www.secuobs.com/revue/news/310206.shtml Secuobs.com : 2011-06-08 22:02:10 - Security - Sony has acknowledged Lulz Security's hack of sonypicturescom, and says that the dates of birth, names, phone numbers, and addresses of some 37,500 users were compromised, but no credit card information was exposed Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/310020.shtmlhttp://www.secuobs.com/revue/news/310020.shtml Secuobs.com : 2011-06-08 12:34:30 - Security - Driving a car in a circle, even at high speed, may sound easy but it s not a one-man job it takes a team with visibility to avoid accidents and enable a successful race nascar-driver-communicate-4 Optimization and visibility, on the surface, don t seem to have much in common One is about making something more efficient usually faster and the other is about, well, being able to see something It s the difference between driving in a race and watching a race But if you ve ever looked into racing high speed, dangerous racing like NASCAR you know that the driver of a car in the race does better if he s got an idea of what the track looks like while he s driving He needs visibility, and for that reason he s constantly in contact with his crew, who can see the entire race and provide the driver with the information he needs to make the right moves at the right time to win quote-badge Team members carrying a two-way radio tuned to the team frequency during a NASCAR race may include the owner, team manager, driver, crew chief, team spotter, crew members, competition director, engineers, mechanics and specialists Even more people are involved in a multi-car team The driver most often consults with his team's race spotter and crew chief during a race Of course, the owner or team manager can intervene whenever he or she feels it's necessary The team spotter provides essential information to help the driver get the car around the racetrack and, with any luck, into Victory Lane Even as NASCAR race cars have become safer in recent years, the driver's ability to see to the sides and rear of the car has been diminished by full-face helmets and head-and-neck-restraint devices The spotter often serves as a second set of eyes for the driver during the race He watches the blind spots to the sides and rear of the car and confirms via radio when the track is clear for a pass or maneuver It is not surprising that many spotters are former drivers IMAGE -- How does a NASCAR driver communicate with the pit crew Drivers in a race with high stakes like NASCAR know they can t do it alone and they can t do it without a clear, on-demand understanding of where they are, where other racers are, and what s going on They can t optimize their next move go high drop inside speed up slow down unless they understand how that will impact their position in the race based on conditions around them They need visibility to optimize their moves Inside the data center is a similar story without the fancy high-tech helmets and beer DATA CENTER OPTIMIZATION The ultimate goal of a data center is the delivery of an application Security, availability and performance concerns operational risks are all addressed through the implementation of products and policies and processes In order to optimize the delivery of an application, it s necessary to have visibility into the interconnections and interdependencies of each gear in the cog to understand how they all work together and collaborate in a way that allows the dynamic adjustment of policies related to security and access management, performance and availability in such a way as to encourage successful delivery, not impede it image Optimizing applications has to be about optimizing the data center and its components, because applications, like NASCAR drivers, aren t islands and they don t operate in a vacuum There s a lot of other moving pieces that go into the delivery of an application and all must work together to ensure a successful implementation and a positive operational posture That visibility comes from many positions within the data center but the most important one may be the most strategic the spotter, the application delivery controller that is generally deployed at what is certainly the pole position Just as the spotter in a race is able to see the conditions of the track as well as the car, the application delivery controller sees the conditions of the applications, the network, the client and the environs as a whole and is able to better share contextual strategic point of control - definitiondata necessary to make the right moves at the right time in order to optimize delivery and win the race This strategic point of control, like the spotter, is vital to the success and well-being of the application Without the visibility afforded by components in the data center capable of making contextual decisions, it s possible the application may fail crash or be otherwise unable to handle the load Unlike NASCAR, application failures can be more easily addressed through the use of virtualization and rapid provisioning techniques, but like a pit-stop it still takes time and will impact the overall performance of the application Visibility is essential to optimization You can t optimize what you can t see, you can t react to what you don t know, and you can t adjust to conditions of which you aren t aware Strategic points of control are those locations within the network at which it is most beneficial and efficient to apply policies and make decisions that enable a positive operational posture without which application security, performance or reliability may be negatively impacted THE BLIND SPOTS of cloud computing This is the reason cloud computing will continue to be difficult and outages so frustrating resources leveraged in a cloud are cheaper, easier to provision and certainly take a weight off operators shoulders, but it denies those operators and network admins and application developers the visibility they need to optimize and successfully deliver applications Deploying applications is easy, but delivering them is a whole other ball game, fraught with difficulties that are made more onerous by the creation of architectural blind spots that cannot be addressed without a spotter It is these blind spots that must be addressed, the ability to see behind and in front and around the application that will enable optimization It may be that the only way to address those blind spots is through the implementation of a hybrid cloud computing model one that leverages cloud computing resources without sacrificing the control afforded by existing enterprise architectural solutions Through the extension of the visibility that already exists in the enterprise to the cloud, in a way that enables flexibility and scale without sacrificing control --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles Document-icon When Black Boxes Fail Amazon, Cloud and the Need to Know Document-icon Don t Let Automation Water Down Your Data Center Document-icon Solutions are Strategic Technology is Tactical Document-icon Now Witness the Power of this Fully Operational Feedback Loop Document-icon What CIOs Can Learn from the Spartans Document-icon Public, Private and Enterprise Cloud Economy of Scale versus Efficiency of Scale Document-icon Cloud Chemistry 101 Document-icon The Zero-Product Property of IT Document-icon Operational Risk Comprises More Than Just Security Technorati Tags F5,MacVittie,NASCAR,data center,optimization,stratgic point of control,cloud computing,application delivery IMAGE http://www.secuobs.com/revue/news/309885.shtmlhttp://www.secuobs.com/revue/news/309885.shtml Secuobs.com : 2011-06-07 05:07:49 - Security - IMAGE RSA Security is to replace virtually every one of the 40 million SecurID tokens currently in use as a result of the hacking attack the company disclosed back in March The EMC subsidiary issued a letter to customers acknowledging that SecurID failed to protect defense contractor Lockheed Martin, which last month reported a hack attempt SecurID tokens are used in two-factor authentication systems Each user account is linked to a token, and each token generates a pseudo-random number that changes periodically, typically every 30 or 60 seconds To log in, the user enters a username, password, and the number shown on their token The authentication server knows what number a particular token should be showing, and so uses this number to prove that the user is in possession of their token Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/309539.shtmlhttp://www.secuobs.com/revue/news/309539.shtml Secuobs.com : 2011-06-07 02:00:20 - Security - IMAGE Lulz Security, the hacking group that broke into a number of Sony servers and then denied any moral responsibility for repercussions of that hack, is at it again The group discovered a security issue on one of Nintendo's Web servers, published the user database of an FBI information sharing program, and for good measure, published the source code to another Sony Web property The Nintendo hack was minor LulzSec found a configuration issue and exploited it to retrieve an Apache configuration file, which it duly published The group said that the issue has since been fixed while expressing its love for the company, and said that it would never harm Nintendo, or one-time Nintendo rival Sega Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/309522.shtmlhttp://www.secuobs.com/revue/news/309522.shtml Secuobs.com : 2011-06-06 23:33:06 - Security - IMAGE The North Atlantic Treaty Organization contains the combined military might of 28 member countries, including Germany, the United Kingdom, and France All three of those nations, and the United States, possess huge armies, nuclear weapons, and are committed to Article Five of NATO's charter Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/309458.shtmlhttp://www.secuobs.com/revue/news/309458.shtml Secuobs.com : 2011-06-06 22:41:19 - Security - Lockheed Martin has confirmed that the RSA hack and subsequent compromise of SecurID tokens was instrumental in the hacking attempts it suffered The company is replacing 45,000 SecurID tokens in response Read More Business Day Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/309450.shtmlhttp://www.secuobs.com/revue/news/309450.shtml Secuobs.com : 2011-06-04 17:46:55 - Security - IMAGE The Oatmeal vs FunnyJunk webcomic copyright fight gets personal Matthew Inman, creator of webcomic The Oatmeal, tried to ignore the rampant online copying of his work until he found that his entire output was mirrored on a user-generated content site called FunnyJunk Microsoft gives the first official look of Windows 8 touch interface Microsoft today unveiled the new touch interface for Windows 8 Though still far from release, it looks like Redmond will finally have a truly worthy competitor to the iPad The crooks who created modern wiretapping law During Prohibition, the government tapped telephones without warrants after all, the lines left the home It took 40 years, and the arrest of a bookie, for the Supreme Court to conclude that privacy wasn't a matter of physical location Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/309169.shtmlhttp://www.secuobs.com/revue/news/309169.shtml Secuobs.com : 2011-06-03 19:30:48 - Security - The Pakistani Cyber Army is claiming responsibility for a hack against computer manufacturer Acer that resulted in the compromise of 40,000 user accounts and source code Read More The Hacker News Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/309049.shtmlhttp://www.secuobs.com/revue/news/309049.shtml Secuobs.com : 2011-06-03 03:46:30 - Security - IMAGE I've lost count of how many times Sony's online properties have been hacked now I just don't have that many fingers but it's happened again Databases used to operate sonypicturescom, sonybmgnl, and sonybmgbe have been compromised by a group calling itself Lulz Security, or LulzSec for short This is the same group that earlier in the week hacked PBS's servers in retaliation for a documentary felt to be critical of Wikileaks they also hacked sonymusiccojp last week Just as was the case with the sonymusicgr hack and LulzSec's sonymusiccojp hack, the latest hack was performed using SQL injection a rudimentary technique that depends on improper handling of Web site URLs Being susceptible to SQL injection is embarrassing enough techniques to prevent it are well-known, and easy to apply to any database-driven Web site but what makes this hack even worse is the data that has been compromised The hackers retrieved account information from the database They claim there are more than a million accounts in total their BitTorrented dump just contained a sample The database contained information about a variety of different account types, apparently related to different promotions and features operated by the company Different sets of accounts, but with one major feature in common they included plaintext passwords Anyone who can read the database can read the passwords And given that password reuse is rampant many, many people use the same passwords for Web sites as they do their e-mail or online banking many of those who have had their Sony accounts compromised now risk having their e-mail accounts attacked Some accounts also included names, phone numbers and full postal addresses At some point, one has to imagine that Sony will realize that it's a major target for hackers and it will wise up, and fix its multitudinous broken Web applications Until then, Lulz Security's Lulz Boat will continue to find rich plunder wherever it sails Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/308917.shtmlhttp://www.secuobs.com/revue/news/308917.shtml Secuobs.com : 2011-06-02 20:11:41 - Security - IMAGE Did Congressman Anthony Weiner really tweet a photo of his, well, wiener It's possible, but he also might have been hacked via an image service vulnerability that makes it easy for anybody to send a photo to a user's account The incident happened over Memorial Day weekend Weiner's official Twitter account sent a link to a photo on ImageShack's yFrog service of a man's bulging underpants Weiner immediately denied sending the photo, claiming that his account was hacked As this is a common defense used by politicians and celebrities against Twitter and Facebook boo-boos, many Weiner-watchers took the hacking claim with a grain of salt Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/308797.shtmlhttp://www.secuobs.com/revue/news/308797.shtml Secuobs.com : 2011-06-02 17:33:52 - Security - IMAGE The Security Update 2011-003 that Apple released on Tuesday directly addressed the Mac Defender malware threat in two ways it changed the way malware files are detected by enabling automatic daily updates, and included code to remove at least two of its variants Despite this, malware developers had a version available that skirts past Apple's protections within about eight hours Apple's patch suggests it plans on being more active in addressing possible malware threats, but is Apple ready to take on the role formerly limited to vendors like Norton, Intego, and Sophos We'll try to answer that question by first detailing what specific malware protections exist in Mac OS X, and what changes Apple implemented in the latest security update Then we'll consider how Apple may plan to take over malware protection for its platform Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/308754.shtmlhttp://www.secuobs.com/revue/news/308754.shtml Secuobs.com : 2011-06-02 00:27:27 - Security - IMAGE Scammers based out of China have been hijacking the personal Gmail accounts of hundreds of users, Google revealed on Wednesday The company wrote in a blog post that the attacks appear to be originating out of Jinan, China and that the main goal appears to be to covertly monitor the contents of users' e-mail accounts Some of the targeted users include Chinese activists, military personnel, journalists, senior US government officials, and officials in other Asian countries It s important to stress that our internal systems have not been affected these account hijackings were not the result of a security problem with Gmail itself, wrote Google Security Team's Eric Grosse, who noted that the scammers are likely obtaining people's passwords through phishing But we believe that being open about these security issues helps users better protect their information online Grosse said that Google detected and has disrupted the campaign through its own abuse detection systems combined with user reports and a report by contagio about targeted attacks against military and government employees The revelation comes a year and a half after Google revealed that attacks originating out of China were targeting Google's own corporate infrastructure, and that the attackers were accessing the Gmail accounts of Chinese human rights activists Google eventually pulled most of its operations out of China and began redirecting its Chinese search engine towards Hong Kong, but that apparently hasn't stopped those interested in monitoring the communications of interesting parties Google advises that users turn on two-step verification, use strong passwords, and check their forwarding addresses in case someone's getting a copy of all your e-mail good advice for anyone, not just Chinese rights activists Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/308603.shtmlhttp://www.secuobs.com/revue/news/308603.shtml Secuobs.com : 2011-05-31 20:52:38 - Security - IMAGE Defense contractor Lockheed Martin issued a statement over the weekend saying that it was the target of a significant and tenacious attack against its computer systems on May 21 The company claims that the attack was detected almost immediately and that thanks to aggressive action by its information security team, no customer, program, or employee data was compromised The company's statement followed an earlier Reuters report that two defence contractors had been hacked The report claimed that the hacks were enabled by the creation of duplicate RSA SecurID tokens SecurID tokens produce a sequence of unpredictable numbers, with the exact sequence determined by a seed value Both the seeds and the algorithms used to generate the numbers are supposed to be secret however, RSA was hacked earlier this year leading to speculation that the seeds may have been compromised RSA, a subsidiary of information management firm EMC, has never publicly disclosed what information was actually taken in the attack the company claims only that systems using the tokens used in tandem with passwords will remain secure Lockheed Martin's statement did not provide any specific information about the attack, nor did it confirm that the RSA attack may have been a factor If the Lockheed Martin attack was indeed a result of the RSA attack, this would be a strong indication that the RSA hack was very damaging indeed, to the extent of nullifying the additional security protection that the tokens are supposed to provide The Department of Defense issued a statement saying that the impact of the attack was minimal and that it did not expect any adverse effect as a result Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/308232.shtmlhttp://www.secuobs.com/revue/news/308232.shtml Secuobs.com : 2011-05-28 23:55:32 - Security - A while ago, I was playing with grammar-based XPath fuzzing and I found and fixed an interesting libxml bug The commit, for the curious, is here http gitgnomeorg browse libxml2 commit id d7958b21e7f8c447a26bb2436f08402b2c308be4 The trigger for this bug was the XPath expression preceding node ancestor node ancestor foo 'foo' which for some reason I haven't yet analyzed leads to a pathologically large collection of nodes within libxml As the nodeset is grown and grown, things get interesting when the system runs out of memory whilst trying to double the size of the nodeset cur-nodeMax 2 temp xmlNodePtr xmlRealloc cur-nodeTab, cur-nodeMax sizeof xmlNodePtr if temp NULL xmlXPathErrMemory NULL, growing nodeset n return cur-nodeTab temp Notice how the max number of allocated nodes in the cur structure is doubled before doing, checking and assigning the reallocation This means that in the event of a realloc failure, one of two things will happen If you malloc implementation exits the process upon alloc failure such as Chromium , lucky you You dodged a bullet More typically, you'll exit this function with cur in an inconsistent state, ie it indicates it can hold more data than it really can Despite the call to xmlXPathErrMemory , XPath processing continues with cur in an inconsistent state, leading to a heap-based buffer overflow The fix is to only update the structure's max size member after a successful expansion of the underlying array libxml already did this in most places, using a paradigm such as temp xmlNodePtr xmlRealloc cur-nodeTab, cur-nodeMax 2 sizeof xmlNodePtr if temp NULL xmlXPathErrMemory NULL, growing nodeset n return cur-nodeMax 2 cur-nodeTab temp which leads us nicely into part 2 Interesting integer issues Even with the fix applied, there are some really interesting integer issues going on here The astute will have noticed a possible integer overflow in the argument to xmlRealloc , which is a general hazard with the common pattern of double the size of the array if we ran out of room Digging in to more detail, we see a fascinating difference in behaviour between 32-bit and 64-bit builds and maybe even learn a thing or two about integer promotion rules On 32-bit builds First, let's quickly note that cur-nodeMax is of type int That's likely the wrong type for a couple of reasons, but we will run with it for our analysis On 32-bit, sizeof int sizeof size_t so we're looking at a fairly basic possible integer overflow But can it ever be triggered Does the 32-bit address space offer enough room The case with the least space requirements for the 32-bit address space is the case where we already have a 2GB 2 31 allocation and are attempting to double it -- leading to an integer overflow at 2 32 and an attempt to realloc to 0 bytes But to arrive at the 2 31 allocation, we need to have a 1GB - 2GB realloc succeed first This is actually unlikely on 32-bit Linux -- which typically has just the lower 3GB of address space usable 1GB 2GB program text etc won't simultaneously fit, so the only way 1GB - 2GB realloc will succeed is if the allocation can be expanded in-place glibc malloc will typically use mmap for large allocations, and put them towards the top of address space in order to reserve room for standard heap expansion So realloc on such an mmap ed chunk typically won't have room to mremap to a larger size All in all, this seems to be a hard-to-exploit bug, unless the attacker has a lot of control over other allocations to influence the placement of the 1GB mmap lower down in the address space and then free whatever chunks were needed to do that, before the realloc Further research might be merited for other allocators eg tcmalloc and 32-bit-process-on-64-bit-host 3GB address space available On 64-bit builds With 64-bit, we have a much larger address space This means that we should be able to successfully allocate the growing array -- and the objects contained within it -- right up until the fault condition The fault condition is that cur-nodeMax 2 will eventually become negative This negative int is then multiplied by sizeof xmlNodePtr Remember that sizeof returns a size_t, so we have an int - size_t promotion at this point This will result in sign-extension to a 64-bit size, which will end up massive and the system allocator will not be able to satisfy an allocation of that size Therefore, a lucky lack of impact on 64-bit Finally, note that there's a real subtlety in the ordering of the expression given to xmlMalloc cur-nodeMax 2 sizeof xmlNodePtr Things would be very different if we had cur-nodeMax sizeof xmlNodePtr 2 Promotions for left-to-right operator sequences are done in strict left-to-right ordering, as opposed to some kind of overall max precedence promotion Therefore, in this latter case, the initial negative-related failure will be avoided we're looking at int 2 30 - int - 2 31 - size_t 0xffffffff80000000 8 size_t 0xfffffffc00000000 vs int 2 30 - size_t 2 30 8 - size_t 2 30 8 2 size_t 2 34 Seeing that nodeNr is just an int, we would likely see subsequent memory corruption if nodeNr goes subsequently negative after its increment in a statement such as cur-nodeTab cur-nodeNr xmlXPathNodeSetDupNs node, ns http://www.secuobs.com/revue/news/307804.shtmlhttp://www.secuobs.com/revue/news/307804.shtml Secuobs.com : 2011-05-27 18:35:56 - Security - IMAGE Senator Ron Wyden D-OR has called the PROTECT IP Act a threat to our economic future and to our international objectives He characterized its predecessor as a bunker-busting cluster bomb when what you really need is a precision-guided missile The bill would force Domain Name System DNS operators to stop correctly resolving the names of so-called rogues sites Is this sort of monkeying with the DNS a problem Yes, say DNS experts in a new report PDF on the practice In their view, DNS filtering provisions would make the Web less secure and do little to stop illegal filesharing sites Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/307623.shtmlhttp://www.secuobs.com/revue/news/307623.shtml Secuobs.com : 2011-05-26 02:36:47 - Security - IMAGE The Rustock botnet, taken down earlier this year in a Microsoft-led action, appears to have been operated by Russians according to evidence collected by the company Court action by Microsoft saw the Rustock botnet taken offline in March, causing an almost immediate drop in global spam volumes The Rustock action was unusual in that Microsoft made claims not only of spamming, but also of trademark infringement Trademark infringement allows the wronged party to seize the property of the infringer, and it is this seized property specifically, hard disks used in the botnet's command and control servers that has enabled the company to determine who was responsible for the network Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/307220.shtmlhttp://www.secuobs.com/revue/news/307220.shtml Secuobs.com : 2011-05-25 20:47:21 - Security - IMAGE Move over Mac Defender there's a new malware variant in town, and it doesn't require the administrator password for installation Security research firm Intego issued a new warning to Mac users on Wednesday, heavily cautioning users that a new variant on Mac Defender, called Mac Guard, is making the rounds via SEO poisoning online Intego initially warned users about a fake antivirus program called MAC Defender it has since gone through several name and capitalization changes earlier this month The Mac-like app posed as an antivirus program and asked users for their credit card numbers in order to purge viruses on their machines or protect them from new ones Although Intego initially gave Mac Defender a low risk rating because of its admin password requirement, it soon became apparent that Mac Defender was indeed beginning to make the rounds among the Mac-using community We spoke with a number of third-party support reps, as well as several Apple Store Geniuses, who vouched for an apparent increase in Mac Defender malware reports Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/307133.shtmlhttp://www.secuobs.com/revue/news/307133.shtml Secuobs.com : 2011-05-25 14:21:16 - Security - I'm just back from the fun that was HiTB Amsterdam 2011 Plug you should check out one of the HiTB series if you haven't yet Dhillon and crew invariably put a good, intimate conf together I sat on the day 2 keynote panel on The economics of vulnerabilities As usual, talking about this topic was great fun and the audience asked some great questions Predictably, the topic strayed on to black market sales as an interesting sub-discussion With 6 people on the panel, it was hard to cover this in the detail it deserves, and I think a few important subtleties were missed I'll try to cover some of them here Vulnerability reward programs do not buy bugs, nor do they aim to compete with the black market Remember that the black or grey markets buy exploits, not vulnerabilities The latter are just the first step towards exploits, which are hard to write on modern software Also remember that reward programs are not buying even vulnerabilities Typically, they are a thank you mechanism for talented researchers who used their skills to make things better Also, there's often a separation of which researchers participate where, along ethics lines see below A vulnerability reward program will indirectly compete with black market sales It's interesting to note that a reward program doesn't have to outbid dubious markets in order to have a benefit in this area These days, there's a lot of independent rediscovery of the same vulnerabilities -- ZDI quoted 22 collisions for the most recent year So any motivation you can provide for white hats to discover vulnerabilities will inevitably kill the occasional black market vulnerability A quick story in support the WebKit vulnerability used by VUPEN to pwn Safari at this years' pwn2own competition was independently reported to the Chromium project by researcher Martin Barbella Thanks to Inferno's lightning quick fix, Chrome entered pwn2own without that bug Martin, of course, received a 1000 Chromium Security Reward on top of all his others Black grey market sales are a dangerous alternative to consider Each researcher has to set their own ethics, of course Hopefully, most of us get into this industry to make users safer and software more secure Aside from reward programs and ZDI, there's also a large number of well-paid security jobs sponsored by corporations, so no need to start selling exploits to feed the family If you sell an exploit to someone, it's basically going to be used to exploit end users of the software This could harm a lot of people if the target is mass malware for financial gain Or it could seriously harm some targeted individuals if a government of dubious human rights commitment gets their hands on it Credit , whilst important, is not a full replacement for a monetary reward To be clear about it if you launch a vulnerability reward program, you will receive more vulnerability reports from a wider range of researchers The power of credit and prestige is often cited as an argument to not launch a reward program, but the fact remains that you will get more reports if you have a program in place And as long as you have a culture of fixing security bugs promptly, your users will be safer thanks to having a reward program http://www.secuobs.com/revue/news/306992.shtmlhttp://www.secuobs.com/revue/news/306992.shtml Secuobs.com : 2011-05-25 04:38:07 - Security - IMAGE The first commercially available set of tools for cracking the encryption and passwords on iOS devices has been made available by Russian security company ElcomSoft One part of their software is a password breaker, while another part, available only to law enforcement and forensic agencies, is able to extract numbers used to create the encryption keys for iOS data to render decrypted images of the device The decryption tool requires access to the device in question, but once it's in hand, a few different kinds of keys need can be scraped from it, including the unique device key UID and escrow keys calculated using the UID and escrow pairing records If the device is only protected by a 4-digit passcode, the program then only needs to brute-force its way through that to get access to all of the decryptable information iOS was never much of a security fortress as we've noted numerous times and even this new tool uses a variation of a previously discovered method Charlie Miller, of Pwn2Own fame and a principal research consultant with Accuvant, even pointed out to Ars that the Fraunhofer Institute for Secure Information Technology detailed a very similar method in a research paper they put out in February However, their tools are not for sale If your phone or tablet regularly comes under scrutiny of the law, Miller adds that this commercially available toolset is fairly simple to route by using a long, complex password rather than a 4-digit code to protect your data The ElcomSoft method comes with a password breaker, but much of its efficiency is derived from defining limits on the possible guesses, such as variations on a certain word While beating it out of you will remain the superior method of password obtainment for the average law enforcer, the password breaker could still come in handy for when you can't remember which characters in your leetspeak password were numbers, and which were letters Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/306940.shtmlhttp://www.secuobs.com/revue/news/306940.shtml Secuobs.com : 2011-05-25 02:53:03 - Security - IMAGE Apple has decided to publicly acknowledge the Mac Defender malware that seems to be creeping onto Mac users' computers The company posted an online support document Tuesday evening that outlines how to identify and get rid of the program, which attempts to trick users into handing over their credit card information The company also promised to issue a software update soon that will specifically hunt out and remove Mac Defender and its variants A recent phishing scam has targeted Mac users by redirecting them from legitimate websites to fake websites which tell them that their computer is infected with a virus, Apple wrote in its support document In the coming days, Apple will deliver a Mac OS X software update that will automatically find and remove Mac Defender malware and its known variants The update will also help protect users by providing an explicit warning if they download this malware The much-welcome acknowledgement from Apple comes less than a week after it came out that real users were beginning to see this malware in the wild a little more often than usual When we investigated the issue, we were told by several Apple Store Geniuses that they had also seen a spike one Genius at a large Apple Store said he had seen malware reports in his store go from approximately 02 to percent to 58 percent in a matter of weeks, with the large majority of those being Mac Defender or its variants, often known as Mac Security or Mac Protector Smaller, third-party support folks were somewhat split on whether there had been a spike in malware reports At the time, one of the more controversial aspects of Apple's reaction was that there was none Apple had instructed its AppleCare and retail staff not to even acknowledge Mac Defender's existence, and not to remove it from users' infected computers Now, however, the company has apparently had a change of heart In the support doc, Apple says to trash the app immediately if you haven't installed it yet, but if you have, there's a series of steps to follow in order to get rid of it And, of course, there's also the lazy route if you have Mac Defender installed but haven't given it your credit card information yet, you could just wait for Apple to issue its software update and have it removed automatically Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/306922.shtmlhttp://www.secuobs.com/revue/news/306922.shtml Secuobs.com : 2011-05-23 17:23:37 - Security - SonyMusicgr, Sony BMG's Greek presence, has been hacked The site fell prey to an SQL injection attack, with the hackers releasing thousands of account names, e-mail addresses, and unencrypted passwords Read More The Hacker News, Sophos security Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/306576.shtmlhttp://www.secuobs.com/revue/news/306576.shtml Secuobs.com : 2011-05-20 17:23:31 - Security - Facebook will soon start its own bug bounty program in order to get help closing up vulnerabilities Read More Softpedia Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/306154.shtmlhttp://www.secuobs.com/revue/news/306154.shtml Secuobs.com : 2011-05-20 17:23:31 - Security - IMAGE With Anonymous Denial of Service attacks and then the twin hacks of PlayStation Network and Sony Online Entertainment, Sony's online infrastructure has been taking a battering over the last few weeks and it's not over yet Another successful hack against the company is being reported by security firm F-Secure A Web server used to host Sony's Thai site has been broken into, and is now being used to host a phishing site that targets customers of an Italian credit card company Unlike the PSN and SOE break-ins, this hack is not likely to have any serious consequences it should be restricted to a relatively unimportant Web server that has no access to sensitive customer information Still, it shows that Sony's online troubles aren't over yet and that the entire company needs to take online security more seriously Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/306153.shtmlhttp://www.secuobs.com/revue/news/306153.shtml Secuobs.com : 2011-05-19 21:26:58 - Security - IMAGE Malware on the Mac is it mostly hype or a real problem faced by real people If you ask John Gruber, the answer might be the former there are lots of proof-of-concept scenarios and virtually none that manifest themselves beyond a slow news day If you ask Ed Bott, however, the answer would be the latter he recently interviewed an AppleCare employee who claimed that the recent release of fake antivirus app MAC Defender has caused a spike in malware reports among Mac users The truth is hard to tease out Partly because Mac OS X still makes up a comparatively small percentage of the global OS market share, and partly because Apple itself is a secretive company, it's not easy to find out whether malware on the Mac is indeed becoming more common, or it's simply being reported on more often Still, we tried to do exactly that Ars spoke with 14 different Mac support specialists including several Apple Store Geniuses in order to get a handle on whether things have changed when it comes to dealing with malware Their experiences are all over the map, but the general consensus does seem to lean towards a low amount of malware problems until you get to the Geniuses Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/305966.shtmlhttp://www.secuobs.com/revue/news/305966.shtml Secuobs.com : 2011-05-16 13:11:42 - Security - devops infosec Shared resources do benefit organizations, there s no arguing about that But when resources forming the basis of identity are trusted and then inadvertently shared, you may find your IP identity misappropriated In the past two years there have been interesting stories floating around about what happens when IP addresses are shared in public cloud computing environments You ve no doubt heard how someone spun up an instance and was immediately blacklisted by some other website because the last application assigned that IP address was naughty on the Internets Organizations have struggled with such issues and admittedly they are somewhat unique to the shared, up and down nature of cloud computing In the history of Internet this type of scenario has certainly happened with dynamically assigned IP addresses from ISPs and even statically assigned addresses that were formerly assigned to someone who got the IP address listed as a SPAMmer or otherwise tagged as a carrier of illegal or malicious intent But these are not the only issues with shared IP addresses It s not really that the organization dealing with such skeletons in their IP address closet are experiencing reputation damage, it s that technical and often very static security systems are tightly coupled to IP addresses They haven t adequately, yet, evolved to deal with the reality of highly volatile IP address assignment We still use IP address as a unique identifier even though today, particularly with public cloud computing, it s anything but And if you thought being tagged as guilty by IP association was bad enough, you haven t considered the potential for application identity theft that could leave applications open to back-door attacks MISTAKEN IDENTITY So let s assume that two applications are deployed in a cloud computing environment Let us further assume that both use multiple instances and a load balancing service to maintain availability and scalability What happens when Application A drops an instance and therefore its associated IP address and that IP address is subsequently assigned to Application B imageUsually nothing bad, that s for sure That s just another minutes work in a public cloud computing environment But what if the load balancing service for Application A did not drop the IP address Yeah Isn t that interesting Application A is going to break assuming a rudimentary but commonly used in cloud computing round robin algorithm 25pourcents of the time Every fourth request will result almost assuredly in either an error or the wrong content But that s would actual be a good thing, considering the alternative possibilities 1 The customer who now owns the IP address is a legitimate customer whose only intention is to deploy an application in the cloud The customer is angrified because this case of mistaken IP identity is costing them money in terms of bandwidth and processing power to constantly field requests that should not be directed to them in the first place Those requests are not valid for their application, but they pay to process and reject them nonetheless 2 The customer who now owns the IP address is an evil genius with a plan to now use the mistaken IP identity to serve up malicious traffic Perhaps a browser vulnerability-based injection Perhaps some content that looks like it belongs on the site that tricks the user into confirming their login details, providing an easy means of credential theft Or perhaps it s the perfect means of delivering what looks like valid content to the page that s nothing more than a phishing attack Oh, the options if you re an evil genius just go on and on After all, the IP address is trusted by the application it is serving content to, so a lot of the obstacles that attackers must navigate to deliver malicious content on other sites are eliminated in this scenario Think such a scenario is far-fetched It s not It s not widespread yet , either, and it s difficult to target an application in such a manner because of the seemingly random nature of IP assignment in cloud computing environments, but mass SQL injection attacks aren t exactly targeted, either They re designed to take advantage of a vulnerability when one is found, and part of its usage is the discovery of such an existing vulnerability A maliciously minded person could certainly set up such an attack method and then sit back and wait After all, most attackers aren t using their money to perpetrate such attacks anyway, so they re unlikely to care that they ll wrack up a lot of money in instance costs while waiting for a successful scenario to come about HOW IT HAPPENED image There are a couple of possibilities for how such a scenario could and did happen Based on the nature of load balancing and dynamic environments, however, it is easy enough to extrapolate how such a situation could easily arise First and foremost this scenario is enabled by a tight-coupling between application and IP address This tight-coupling is a dependency that is no longer necessary in well-architected high-availability environments and, as we are learning, can be dangerous to the health and security of applications in highly dynamic environments such as cloud computing where IP addresses are shared and cannot be relied upon as a definitive identifier of anything This is particularly impactful in load balanced environments, where IP addresses are still used to identify nodes and where operations has failed to separate the application identity from an IP address Load balancing works by applying an algorithm to choose a resource from a pool of resources dynamically There are numerous algorithms that can factor in a number of variables resource capacity, performance, connection limits, etc but all rely upon information gathered from the application to determine suitability to fulfill any given request In healthy load balanced environments there is a very nearly symbiotic relationship between the load balancing service and the applications, as it is from the application and its supporting infrastructure that the load balancing service receives the status information crucial to making decisions In this particular scenario, it is likely a failure to properly monitor the application compounded a failure of process to remove a resource from the pool in the first place In a cloud computing style environment, this may have been the result of an automation failure 1 AUTOMATION FAILURE The load balancing service was either local to the cloud provider or at the customer s site and upon release of the instance IP address, whatever automation or process that was in place that should have removed that IP address from the pool of available resources did not This could have been due to a disconnect between the way in which the instance was de-provisioned perhaps the customer used a method that was unanticipated by the provider and thus no corresponding entry point into an automated process was provided for, making it impossible for an automated response from the load balancing service Or perhaps the load balancing service was external to the provider, and the resources integrated into an existing load balanced system internal to the customer s data center, in a hybrid-style architecture and no such automation exists and instead relied upon manual intervention Human error is a common instigator of operational failures so this is a distinct possibility as well 2 MONITORING FAILURE All load balancing solutions use some kind of monitoring to ensure that a resource is actually available This monitoring occurs on a fixed interval basis as determined by the service configuration, and can be implemented using a variety of techniques from ICMP replies to advanced content verification ICMP, the most rudimentary but least costly in terms of bandwidth and processing method, is wholly inadequate to determine the availability of an application because it is designed only to garner a response at the network IP layer TCP-based monitoring, as well, is designed to garner a response at the application or web server layer, and is better than ICMP but still fails to determine whether an application is actually available in the sense that it is 1 running and 2 returning valid responses Advanced health monitoring that verifies the availability at the network, server and application layer is the only certain method to guarantee true application availability Such methods involve making a request and receiving a response from the application and then verifying the content is what was expected If it is not, the node member, resource can be marked as unavailable and taken out of the rotation for the load balancing algorithm, ensuring that no further requests to that resource are made AUTOMATION needs CONTEXT Regardless of what disconnect caused the load balancing service to fail to remove the instance when it was decommissioned, proper health monitoring techniques would have caught the problem and resolved it such that neither the original assignee of the IP address was serving up invalid content or failures and the inheritor of the IP address would not be inundated with requests that resulted in extraneous and unnecessary costs More importantly, however, proper health monitoring would prevent a scenario in which the application identity of what may be a trusted service can be misappropriated and used to further some evil genius plans Automation of any kind and make no mistake, health monitoring that can automatically pull a resource out of a pull is a form of automation requires context to ensure it makes the right decisions at the right time It s simply not enough to PING or open a TCP connection and assume that means anything other than basic networking and application platform services are available In an environment where networks and resources are shared, the ability to ascertain availability of an application is critical not only to the successful delivery of an application but as we are learning, its security as well --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles Document-iconDon t Let Automation Water Down Your Data Center Document-iconThe IP Address Identity Disconnect Document-iconCall Me Crazy but Application-Awareness Should Be About the Application Document-iconWILS Layer 7 Protocol versus Layer 7 Application Document-iconWILS A Good Hall Monitor Actually Checks the Hall Pass Document-iconCloud Computing Makes Servers Obsolete Document-iconNot all application requests are created equal Document-iconManaging Virtual Infrastructure Requires an Application Centric Approach Technorati Tags MacVittie,cloud computing,devops,load balancing,security,application delivery,monitoring,automation,dynamic infrastructure IMAGE http://www.secuobs.com/revue/news/305045.shtmlhttp://www.secuobs.com/revue/news/305045.shtml Secuobs.com : 2011-05-13 13:11:57 - Security - vcmp It s great to be fast and furious, but if your infrastructure handles like a boat you won t be able to take advantage of its performance f5friday We recently joined the land of modernity when I had a wild urge to acquire a Wii Any game system is pretty useless without games, so we got some of those too One of them, of course, had to be Transfomers The Game because, well, our three-year old thinks he is a Transformer and I was curious as to how well the game recreated the transformation process image The three-year old obviously doesn t have the dexterity or patience to play, but he loves to watch other people play, people like his older brother The first time our oldest sat down and played he noted that Bumblebee, in particular, handled like a boat Oh, he s a fast car alright, but making it around corners and tight curves or around objects is difficult because he s not very agile when you get down to it Jazz, for the record, handles much better Handling is important, of course, because the faster you go the more difficult it is to maneuver and be accurate in your driving Handling impacts the overall experience because constantly readjusting direction and speed to get through town makes it difficult to efficiently find and destroy the evil forces of the Decepticons Now while the infrastructure in which you re considering investing may be fast and furious, with high speeds and fat feeds, the question you have to ask yourself is, How does she handle Is she agile, or is she a boat Because constantly readjusting policies and capacity and configuration can make it difficult to efficiently deliver applications VIPRION 2400 High Speed, Fat Feeds and Agile to Boot This week at Interop F5 announced the newest member of our VIPRION family, the VIPRION 2400 aka Victoria At first glance you might think the VIPRION 2400 is little more than a scaled down version of the VIPRION 4000, our flagship BIG-IP chassis-based application delivery controller In many respects that s true, but in many others it s not That s because at the same time we also introduced a new technology called vCMP virtual Multi-Clustered Processing that enables the platform with some pretty awesome agility internally which translates into operational and ultimately business agility If the network can t go virtual, then virtual must come to the network It s not just having a bladed, pay-as-you-grow, system that makes VIPRION with vCMP agile It s the way in which you can provision and manage resources across blades, transparently, in a variety of different ways If you re an application-centric operations kind of group, you can manage and thus provision VIPRION-Vcmpapplication delivery resources on VIPRION based on applications, not ports or IP addresses or blades If you re a web-site or domain focused operations kind of group, manage and provision application delivery resources by VIP Virtual IP Address instead If you re an application delivery kind of group, you may want to manage by module instead It s your operations, your way What s awesome about vCMP and the VIPRION platforms is the ability to provision and manage application delivery resources as a pool, regardless of where they re located Say you started with one blade in a VIPRION 2400 chassis and grew to need a second There s no disruption, no downtime, no changes to the network necessary Slap in a second blade and the resources are immediately available to be provisioned and managed as though they were merely part of a large pool Conversely, in the event of a blade failure, the resources are shifted to other available CPUs and memory across the system Not only can you provision at the resource layer, but you can split up those resources by creating virtual instances of BIG-IP right on the platform Each guest on the VIPRION platform can be assigned its own resources, be managed by completely different groups, and is for all purposes an isolated, stand-alone version of BIG-IP Without additional hardware, without topological disruption, without all the extra cables and switches that might be necessary to achieve such a feat using traditional application delivery systems VIPRION 2400 has the speeds and feeds necessary to support a growing mid-sized organization Mid-sized from a traffic management perspective, not necessarily employee count The increasing demands on even small and medium sized businesses from new clients, video, and HTML5 are driving high volumes of traffic through architectures that are not necessarily prepared to handle the growth affordably or operationally The VIPRION 2400 was designed to address that need both to handle volume and provide for growth over time, while being as flexible as possible to fit the myriad styles of architecture that exist in the real world The explosion of virtualization inside the data center in medium-sized businesses, too, is problematic These organizations need a solution that s capable of supporting the security and delivery needs of virtualized desktops and applications in very flexible ways VIPRION 2400 enables these organizations to take advantage of what has traditionally been a large-enterprise class only solution and enable the implementation of modern architectures and network topologies that can greatly assist in virtualization and cloud computing efforts by providing the foundation of a dynamic, agile infrastructure VIPRION 2400 RESOURCES slideshare VIPRION 2400 and vCMP Presentation f5-red-125 VIPRION Platform Resources f5-red-125 F5 Introduces Midrange VIPRION Platform and Industry s First Virtual Clustered Multiprocessing Technology video_icon VIPRION 2400 - Quantum Performance pdf-icon Virtual Clustered Multiprocessing vCMP Document-icon Medium is the New Large in Enterprise Document-icon Sometimes It Is About the Hardware --------------------------------------------------------------------- VIPRION and vCMP ENABLE YOU TO TAKE ADVANTAGE OF MORE OF THE 50 Ways to Use Your BIG-IP System Share how you use your BIG-IP, get a free T-Shirt, and maybe more Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles Document-icon Medium is the New Large in Enterprise Document-icon Sometimes It Is About the Hardware Document-iconIf a Network Can t Go Virtual Then Virtual Must Come to the Network Document-iconData Center Feng Shui Architecting for Predictable Performance Document-iconF5 Friday Have You Ever Played WoW without a Good Graphics Card Document-icon All F5 Friday Posts on DevCentral Document-icon Data Center Feng Shui SSL Document-icon When Did Specialized Hardware Become a Dirty Word Technorati Tags MacVittie,F5,F5 Friday,vcmp,VIPRION,v1022,performance,virtualization,cloud computing,application delivery,hardware IMAGE http://www.secuobs.com/revue/news/304559.shtmlhttp://www.secuobs.com/revue/news/304559.shtml Secuobs.com : 2011-05-11 12:21:07 - Security - A recent power outage in the middle of the night reveals automation without context can be expensive for aquariums and data centers You may recall from several posts Cloud Chemistry 101, The Zero-Product Property of IT and The Number of the Counting Shall be Three Rules of Thumb for Application Availability that one of my hobbies is reefing No, it s not that kind of reefer madness, it s the other kind the kind associated with aquariums and corals and all manner of strange looking ocean-living fish I only recently re-engaged after years of avoiding the hassle and enjoyment and have been learning a lot, especially in terms of what s been learned by others during my off-years When I set up my most recent aquarium adventure a 150 gallon reef I decided to use an external sump Think of it like an external reservoir in which all sorts of interesting filtering and water quality activities can be handled without all the tubes and equipment that might otherwise clutter up the main display tank It s also handy for setting up things like automated top-off systems, which automatically add fresh water to the system to compensate for evaporation Such systems can, it turns out, be imageproblematic if they aren t enabled with the proper context in which to automatically kick in It s loose coupling of a system, much in the same way application delivery can abstract policy enforcement and infrastructure services from the applications it delivers, making the system more agile and able to be adapted to problems without disrupting the main tank, er, application MAINTAINING EQUILIBRIUM I talked about achieving dynamic equilibrium in a previous post so suffice to say that as water evaporates from an aquarium only water is lost This is not so critical a point in a freshwater system, but in a salt-water system it is absolutely important to understand The more salt per gallon in a salt-water aquarium, the higher the salinity Obviously if salt is not evaporating but water is, then salinity increases Conversely, if too much fresh water ie 0 salinity is added, salinity decreases You might guess that a rather narrow range of salinity is required to support a reef Too low or too high, and things start suffering rather quickly The balance needs to be maintained in order to maintain a healthy ecosystem Now, the relationship between all the moving parts in my reef setup are very much like the complex relationships between components and resources in a data center Water requests and responses flow out of the display tank and into the sump application delivery controller , are filtered by a protein skimmer web application firewall , and then returned via a return line to the main tank As water evaporates it reaches a minimum level on an automated sensor application health monitors that trigger a response that forces additional fresh water compute resources into the sump, which re-establishes equilibrium and maintains salinity by sustaining a specific water-salt ratio in the ecosystem Flow rates are equalized between input and output, and when the power is on everything runs smooth as pie But when power went out not once, but three times last week, that automation that saves me so much time under normal operations, bit me in the proverbial derriere AN EXCESS of RESOURCES So what happens when the power goes out Well, if not for the protein skimmer C in the lovely diagram to the left nothing The pumps stop pumping and water in the display tank A which continues to drain from the overflow until it hits the siphon break and then stops That s about 13 gallons of water When added to the sump s level of 10 gallons, that s about 23 gallons of a 25 gallon capacity container But add in the approximately 2 gallons from the protein skimmer combined with natural water displacement from the equipment and wet floor Water overflow Once might not be too bad, but twice Three times in one night But it wasn t just the wet floor that was the problem See, once the power returned the automated top-off system, recognizing the water level was down, did what it does best pumped fresh, desalinated water into the sump It did it so well, in fact, that the salinity levels in the entire system dropped from a comfortable 1025 to a rock-bottom minimum of 1023 Luckily that s not rock-bottom in terms of survival, and everything that was alive is still doing well and in fact flourishing, but it pointed out a flaw with the automation I d put into place it s not contextually aware It s not intelligent It just is A more experienced reefer with these kinds of complex systems would point out that salinity monitoring is essential and that a secondary system designed to ensure the maintenance of a specific specific gravity another way to say salinity is vital to maintaining the proper water chemistry I would be inclined to agree after recent events, and find that this is a fine example of potentially similar problems with data center automation CONTEXT is CRITICAL Let s assume a data center that uses monitoring of application performance and has in place an auto-scaling or server flexing system that, when triggered, automatically adds new resources to a given application to improve performance, assuming resource consumption high volume of users is the core factor in performance That all sounds great in theory, like my reef setup, but in practice it can go horribly wrong For example, if the reason resource availability is decreasing is due to a concerted DoS attack across multiple layers of the stack, adding more resources is unlikely to restore equilibrium You can add compute resources all day but it won t address the consumption of bandwidth or infrastructure resources caused by the attack Without context, the automated system simply does without thinking what it s been told to do And if those resources are in a cloud-based environment for which you are charged by the instance hour, you may increase costs dramatically without seeing any return on that investment Cloud-bursting can be a valuable tactical response to balancing the need for more capacity with costs, but if those resources are added without context then, like adding fresh-water to compensate for non-evaporative water loss to a salt-water system, you may be diluting the efficiency of the entire application delivery chain But if the automated system had visibility and context-awareness, if it was intelligent and could factor in all the variables network and compute it could react accordingly and perhaps take some other action that would address the real problem, like activating security-minded policies that throttle bandwidth based on usage patterns, or start blocking offending user sessions The what is less important than how, for our purposes, because it s really about having the context in the first place to enable the application of organizational-specific policies supporting operational goals Without context, without collaboration, automation is likely to result in blind decisions made without understanding the root cause and potentially causing more damage than good Context is critical to ensure that automation is supportive of not detrimental to- operational efficiency and goals --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles Document-iconCloud Chemistry 101 Document-iconThe Zero-Product Property of IT Document-iconThe Number of the Counting Shall be Three Rules of Thumb for Application Availability Document-iconOperational Risk Comprises More Than Just Security Document-iconAligning IT with the Business by Decreasing Efficiency Document-iconCloud Needs Context-Aware Provisioning Document-iconService Virtualization Helps Localize Impact of Elastic Scalability Document-iconWhat is a Strategic Point of Control Anyway Document-iconAre You Ready for the New Network Document-iconAll Infrastructure 20 Topics on DevCentral Document-iconI Find Your Lack of Win Disturbing Technorati Tags MacVittie,F5,cloud computing,virtualization,infrastructure 20,context-aware,dynamic infrastructure,automation,devops IMAGE http://www.secuobs.com/revue/news/304037.shtmlhttp://www.secuobs.com/revue/news/304037.shtml Secuobs.com : 2011-05-10 00:41:46 - Security - IMAGE Senator Jay Rockefeller D-WV has introduced a new Do Not Track bill to Congress that aims to hold companies accountable for collecting information on consumers after they've expressed a desire to opt out Called the Do-Not-Track Online Act of 2011 PDF , the bill would create a universal legal obligation for companies to honor users' opt-out requests on the Internet and mobile devices, and would give the Federal Trade Commission the power to take action against companies that don't comply Recent reports of privacy invasions have made it imperative that we do more to put consumers in the driver s seat when it comes to their personal information, Rockefeller said in a statement I believe consumers have a right to decide whether their information can be collected and used online This bill offers a simple, straightforward way for people to stop companies from tracking their movements online Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/303650.shtmlhttp://www.secuobs.com/revue/news/303650.shtml Secuobs.com : 2011-05-09 12:25:44 - Security - Though responsibility for taking precautions may be shared, the risk of an incident is always yours and yours alone, no matter who is driving the car Cloud and security still take top billing in many discussions today, perhaps because of the nebulous nature of the topic If we break down security concerns in a public cloud computing environment we can separate them into three distinct categories of risk the infrastructure, the application, and the management framework Regardless of the model IaaS, PaaS, SaaS these categories exist as discrete entities, the differences being only in what the customer has access to and ultimately over which they have control responsibility imageA Ponemon study recently reported on by InformationWeek Document-iconCloud Vendors Punt to Security Users shows a vastly different view of responsibility as it pertains to cloud computing and data security Whether it is shared, mostly on the provider or mostly on the customer is a matter of perspective apparently but is just as likely the result of failing to distinguish between categories of security concerns Regardless of the category, however, if we apply a couple of legal concepts used to determine fault in car accidents in many states, we may find some interesting comparisons and insights into just who is responsible and for what when it comes to security in a public cloud computing environment A MATTER of NEGLIGENCE Legalese is legalese, no matter the industry or vertical, and cloud computing is no exception As noted in the aforementioned InformationWeek article quote-badge When you read the licensing agreements for cloud providers, they don't need to do anything with security--they take 'best effort,' said Pironti John P Pironti, president of IP Architects Best effort means that should a case come to court, as long as they can show they're doing some effort, and not gross negligence, then they're covering themselves IMAGE In other words, providers are accepting that they have some level of responsibility in providing for security of their environments They cannot disregard the need nor their responsibility for security of their environments, and by law they cannot disregard such efforts below a reasonable standard of effort Reasonable being defined by what a reasonable person would consider the appropriate level of effort One would assume, then, that providers are, in fact, sharing the responsibility of securing their environments by exerting at least best effort A reasonable person would assume that best efforts would be comparable to those taken by any organization with a public-facing infrastructure, ie firewalls, DoS protection, notification systems and reasonable identity and access management policies Now if we treated cloud computing environments as we do cars, we might use a more granular definitions of negligence If we look at those definitions, it may be that we can find the lines of demarcation for security responsibilities in cloud computing environments quote-badge Contributory negligence is a system of fault in which the injured party can only obtain compensation for injuries and damages if he or she did not contribute to the accident in any way In comparative negligence, the injured party can recover damages even if she was partially at fault in causing the accident In a pure comparative system, the plaintiff s award is reduced by the amount of her fault in the accident Some states have what is called modified comparative fault This is where there is a cap on how much responsibility the injured party can have in the accident IMAGE -- Car Accident Fault and Getting What You re Owed In a nutshell, when it comes to car accidents fault is determined by the contribution to the accident which subsequently determines whether or not compensation is due If Alice did not fulfill her responsibility to stop at the stop sign but Bob also abdicated his responsibility to obey the speed limit and the two subsequently crash, one would likely assume both contributed to the incident although with varying degrees of negligence and therefore fault Similarly if Alice has fulfilled all her responsibilities and done no wrong, then if Bob barrels into her it is wholly his fault having failed his responsibilities The same concepts can certainly be applied to security and breaches, with the focus being on the contribution of each party provider and customer to the security incident Using such a model, we can determine responsibility based on the ability to contribute to a incident For example, a customer has no control over the network and management framework of an IaaS provider The customer has no authority to modify, change or configure network infrastructure to ensure an agreeable level of network-security suitable for public-facing applications Only the provider has the means by which such assurances can be made through policy enforcement and critical evaluation of traffic Alice cannot control Bob s speed, and therefore if it is Bob s speed that causes an accident, the fault logically falls on Bob s shoulders wholly If data security in a cloud computing environment is breached through the exploitation or manipulation of infrastructure and management components wholly under the control of the provider, then the fault for the breach falls solely on the shoulders of the provider If, however, a breach is enabled by poor coding practices or configuration of application infrastructure which is wholly under the control of the customer, then the customer bears the burden of fault and not the provider IT ALWAYS COMES BACK to CONTROL In almost all cases, a simple test of contributory negligence would allow providers and customers alike to not only determine the ability to contribute to a breach but subsequently who, therefore, bears the responsibility for security It is an unreasonable notion to claim that a customer who can neither change, modify nor otherwise impact the security of a network switch should be responsible for its security Conversely, it is wholly unreasonable to claim that a provider should bear the burden of responsibility for securing an application one which the provider had no input or control over whatsoever It is also unreasonable to think that providers, though afforded such a luxury by their licensing agreements, are not already aware of such divisions of responsibility and that they are not taking the appropriate best effort steps to meet that obligation The differences in the Ponemon study regarding responsibility for security can almost certainly be explained by applying the standards of contributory negligence Neither provider nor customer is attempting to abrogate responsibility, in fact all are clearly indicating varying levels of contribution to security responsibility, almost certainly in equal portions as would be assigned based on a contributory negligence model of fault for their specific cloud computing model Customers of IaaS, for example, would necessarily assign providers less responsibility than that of an SaaS provider with regard to security because providers are responsible for varying degrees of moving parts across the models In a SaaS environment the provider assumes much more responsibility for security because they have control over most of the environment In an IaaS environment, however, the situation is exactly reversed In terms of driving on the roads, it s the difference between getting on a bus SaaS and driving your own car IaaS The degree to which you are responsible for the security of the environment differs based on the model you choose to leverage on the control you have over the security precautions Ultimately, the data is yours it is your responsibility to see it secured and the risk of a breach is wholly yours If you choose to delegate implicitly or explicitly - portions of the security responsibility to an external party, like the driver of a car service, then you are accepting that the third party has taken acceptable reasonable precautions If the risk is that a provider s best effort is not reasonable in your opinion, as it relates to your data, then the choice is obvious you find a different provider The end result may be that only your own environment is safe enough for your applications and data, given the level of risk you are willing to bear --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles Document-icon Cloud Vendors Punt to Security Users Document-icon The Corollary to Hoff s Law Document-icon Operational Risk Comprises More Than Just Security Document-icon There Is No Such Thing as Cloud Security Document-icon Risk is not a Synonym for Lack of Security Document-icon Christofer Hoff Rational Survivability on Security Document-icon The Impact of Security on Infrastructure Integration Document-icon Authorization is the New Black for Infosec Document-icon Six Lines of Code Technorati Tags MacVittie,F5,security,cloud computing IMAGE http://www.secuobs.com/revue/news/303467.shtmlhttp://www.secuobs.com/revue/news/303467.shtml Secuobs.com : 2011-05-06 22:21:17 - Security - IMAGE Just two bulletins are being issued for Patch Tuesday this month, one each for Windows and Office, addressing one vulnerability in the operating system and two in the productivity suite The Windows bulletin has a critical security rating the Office bulletin has only an important rating Both patches solve remote code execution flaws in the affected software Many people will be able to get away without patching at all The Windows patch only applies to server operating systems, leaving Windows XP, Windows Vista, and Windows 7 untouched, and the Office patch doesn't apply to the latest Office 2010 and Office 2011 for Mac versions Systems which do need the bulletins may need rebooting Rating Impact Affected software 1 Critical Remote Code Execution Windows Server 2003 Server 2008 Server 2008 R2 2 Important Remote Code Execution PowerPoint 2002 Office XP PowerPoint 2003 PowerPoint 2007 Office 2004 for Mac Office 2008 for Mac Open XML File Format Converter for Mac Office Compatibility Pack The bulletins will be released on Tuesday at 10 00am PDT, and there will be the usual webcast the following day at 11 00am PDT to address customer questions Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/303178.shtmlhttp://www.secuobs.com/revue/news/303178.shtml Secuobs.com : 2011-05-05 04:21:53 - Security - Over the past few years, there have been various high-profile incidents and concerns with the Certificate Authority-based infrastructure that underpins https connections Various different efforts are underway to tackle the problem many are enumerated here http googleonlinesecurityblogspotcom 2011 04 improving-ssl-certificate-securityhtml And in terms of things baked directly into the browser, we have things like Firefox's Certificate Patrol add-on https addonsmozillaorg en-US firefox addon certificate-patrol My colleague Adam Langley summarized some features and directions we've been exploring in Chromium recently, it's a good read http wwwimperialvioletorg 2011 05 04 pinninghtml These features can also be controlled via the command-line, so to give a glimpse of the future, I present to you Twitter Like A Boss Run Chrome v12 dev channel or newer required with a command line like this google-chrome --user-data-dir tmp chrome_twitter --incognito --disable-plugins --proxy-server localhost 1 --proxy-bypass-list https twittercom,https twittercom,https twimgcom --hsts-hosts ' df0sSkr4gOg4VK8d NNTAWFtAN MjCgPCJ5ml ucdZE expiry 20000000000, include_subdomains true, mode strict , public_key_hashes sha1 TXoScD1SXPfhmRO8ACTPrkXD9Yk , tGm XsbBPK211uMWtg2k071vijQkuVLvd62QzfNFol8 expiry 20000000000, include_subdomains true, mode strict , public_key_hashes sha1 06curQTaPH4PGumbNSeL79da23s , wZU3atDOXaxKkaRgSdlWwB4UYjulRq46SGnIBij5I98 expiry 20000000000, include_subdomains true, mode strict , public_key_hashes sha1 O6hykhOmHJ5HQUREC0DTDeu6 mE ' --user-agent 'LIKE A BOSS' You'll need to edit a couple of things such as the command name and the temp directory if you're on Windows or Mac If you wish to connect securely to Twitter, well it pretty much does so like a boss It does the following things and defends against the following situations The --user-data-dir flag loads Twitter in a new profile so that you get a new Chrome instance and therefore new cookie jar Therefore, carelessly clicked links in your other browsing windows won't get you XSSed The --incognito flag applies the usual incognito changes notably, things like profile photos won't be cached to disk might be useful if you're an activist --disable-plugins is strictly unnecessary since Twitter generally isn't using plug-ins However, any secure command line should likely include that flag The --proxy-server localhost 1 is a good defensive catch-all which will stop any site traffic being sent by your browser unless it is whitelisted Specifically, a http bitly link to an XSS payload won't work on you You'll need to paste such links into an alternate browser which shouldn't be logged in to Twitter This will also stop non-pinned https requests going out which might otherwise compromise the integrity of the main page Mixed-content bugs, cookie forcing and failure to mark cookies Secure will also be mitigated --hsts-hosts is the magic It locks twittercom, apitwittercom and twimgcom such that SSL traffic from to Twitter will only be accepted if the leaf SSL certificate's public key is exactly what we expect It's called certificate pinning , and along with HSTS, it defends against any compromised root CA, Comodo-gate, Tunisia-like sslstrip attacks, and the evil country owns firewall CA situation --user-agent 'LIKE A BOSS' is strictly optional, depending on your mood The above command line isn't finished Although Twitter seems to run fine, there are under-the-hood failures to scribetwittercom and other places because I haven't added the correct certificate pin for that host The above will break if any of the leaf certificate public keys change this doesn't necessarily happen on expiry rollover but may otherwise happen for various reasons Hopefully this demo is compelling The plan is to push this technology more and more under the covers so that it happens for less technical users who have an empty command line http://www.secuobs.com/revue/news/302727.shtmlhttp://www.secuobs.com/revue/news/302727.shtml Secuobs.com : 2011-05-02 22:47:23 - Security - IMAGE Security firm Intego announced Monday that a fake antivirus program for Mac OS X has been discovered in the wild While the threat potential remains low, inexperienced users could be fooled into paying to remove fake viruses detected by the software, and in the process, could end up giving credit card information to scammers The fake antivirus software calls itself MAC Defender, perhaps the first hint that it should not be trusted Apple makes Macs, not MACs Those behind the malware used SEO poisoning to make links to the software show up at the top of search results in Google and other search engines Clicking the links that show up in search results brings up a fake Windows screen that tells the user a virus has been detected, another clue that something is fishy JavaScript code then automatically downloads a zipped installer for MAC Defender If the Open 'safe' files after downloading option is turned on in Safari, the installer will be unzipped and run Since the installer requires a user password, it won't install without user interaction However, inexperienced users may be fooled into thinking the software is legitimate Intego notes that the application is well designed and doesn't have misspellings or other errors common to such malware on Windows The software will periodically display Growl alerts that various fake malware has been detected, and also periodically opens porn websites in the default browser, perhaps leading a user to believe the detected malware threats are real Users are then directed to an insecure website to pay for a license and clean the malware infections However, the buying the license merely stops the fake alerts from popping up, but your money and credit card info is now in the hands of hackers While MAC Defender wouldn't likely fool an experienced user, Intego notes that its appearance in the wild is yet another opportunity to detail some useful security precautions Don't let your browser automatically open downloads If your browser asks if you want to run an installer even though you didn't try to download one, click cancel And never give your password to run installers you aren't 100 percent sure about Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/302105.shtmlhttp://www.secuobs.com/revue/news/302105.shtml Secuobs.com : 2011-04-28 03:39:26 - Security - IMAGE Turn any corner in the complex metropolis that is Internet policy and you'll hear about the cybersecurity crisis in two nanoseconds As a consequence, the public is treated to a regular diet of draconian fare coming from Sixty Minutes and Fresh Air about the growing cyberwar threat Former National Security Adviser Richard A Clarke suggests a thought exercise in his hit book Cyber War imagine you are the assistant to the president for Homeland Security The National Security Agency has just sent a critical alert to your BlackBerry Large scale movement of several different zero day malware programs moving on Internet in US, affecting critical infrastructure Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/301294.shtmlhttp://www.secuobs.com/revue/news/301294.shtml Secuobs.com : 2011-04-27 12:59:50 - Security - While everyone was focused on cloud, JSON has slowly but surely been taking over the application development world It looks like the debate between XML and JSON may be coming to a close with JSON poised to take the title of preferred format for web applications image image If you don t consider these statistics to be impressive, consider that ProgrammableWeb indicated that its own statistics on ProgrammableWeb show a significant increase in the number of JSON APIs over 2009 2010 During 2009 there were only 191 JSON APIs registered So far in 2010 August there are already 223 Today there are 1262 JSON APIs registered, which means a growth rate of 565pourcents in the past eight months, nearly catching up to XML which currently lists 2162 APIs At this rate, JSON will likely overtake XML as the preferred format by the end of 2011 This is significant to both infrastructure vendors and cloud computing providers alike, because it indicates a preference for a programmatic model that must be accounted for when developing services, particularly those in the PaaS Platform as a Service domain PaaS has yet to grab developers mindshare and it may be that support for JSON will be one of the ways in which that mindshare is attracted Consider the results of the State of Web Development 2010 survey from Web Directions in which developers were asked about their cloud computing usage only 22pourcents responded in the affirmative to utilizing cloud computing But of those 22pourcents that do leverage cloud computing, the providers they use are telling image PaaS represents a mere 735pourcents of developers use of cloud computing, with storage Amazon S3 and IaaS Infrastructure as a Service garnering 2689pourcents of responses Google App Engine is the dominant PaaS platform at the moment, most likely owing to the fact that it is primarily focused on JavaScript, UI, and other utility-style services as opposed to Azure s middle-ware and definitely more enterprise-class focused services SaaS, too, is failing to recognize the demand from developers and the growing ascendancy of JSON Consider this exchange on the Salesforcecom forums regarding JSON quote-badge Come on salesforce lets get this done We need to integrate, we need this JSON IMAGE If JSON continues its steady rise into ascendancy, PaaS and SaaS providers alike should be ready to support JSON-style integration as its growth pattern indicates it is not going away, but is instead picking up steam Providers able to support JSON for PaaS and SaaS will have a competitive advantage over those that do not, especially as they vie for the hearts and minds of developers which are, after all, their core constituency THE IMPACT What the steady rise of JSON should trigger for providers and vendors alike is a need to support JSON as the means by which services are integrated, invoked, and data exchanged Application delivery, service-providers and Infrastructure 20 focused solutions need to provide APIs that are JSON compatible and which are capable of handling the format to provide core infrastructure services such as firewalling and data scrubbing duties The increasing use of JSON-based APIs to integrate with external, third-party services continues to grow and the demand for enterprise-class service to support JSON as well will continue to rise There are drawbacks, and this steady movement toward JSON has in some cases a profound impact on the infrastructure and architectural choices made by IT organizations, especially in terms of providing for consistency of services across what is likely a very mixed-format environment Identity and access management and security services may not be prepared to handle JSON APIs nor provide the same services as it has for XML, which through long established usage and efforts comes with its own set of standards Including social networking streams in applications and web-sites is now as common as including images, but changes to APIs may make basic security chores difficult Consider that Twitter very quietly has moved to supporting JSON only for its Streaming API Organizations that were, as well they should, scrubbing such streams to prevent both embarrassing as well as malicious code from being integrated unknowingly into their sites, may have suddenly found that infrastructure providing such services no longer worked quote-badge API providers and developers are making their choice quite clear when it comes to choosing between XML and JSON A nearly unanimous choice seems to be JSON Several API providers, including Twitter, have either stopped supporting the XML format or are even introducing newer versions of their API with only JSON support In our ProgrammableWeb API directory, JSON seems to be the winner A couple of items are of interest this week in the XML versus JSON debate We had earlier reported that come early December, Twitter plans to stop support for XML in its Streaming API IMAGE --JSON Continues its Winning Streak Over XML, ProgrammableWeb Dec 2010 Similarly, caching and acceleration services may be confused by a change from XML to JSON from a format that was well-understood and for which solutions were enabled with parsing capabilities to one that is not IT S THE DATA, NOT the API The fight between JSON and XML is one we continue to see in a general sense See, it isn t necessarily the API that matters, in the end, but the data format the semantics used to exchange that data which matters XML is considered unstructured, though in practice it s far more structured than JSON in the sense that there are meta-data standards for XML that constrain security, identity, and even application formats JSON, however, although having been included natively in ECMA v5 JSON data interchange format gets ECMA standards blessing has very few standards aside from those imposed by frameworks and toolkits such as JQuery This will make it challenging for infrastructure vendors to support services targeting application data data scrubbing, web application firewall, IDS, IPS, caching, advanced routing to continue to effectively deliver such applications without recognizing JSON as an option The API has become little more than a set of URIs and nearly all infrastructure directly related to application delivery is more than capable of handling them It is the data, however, that presents a challenge and which makes the developers choice of formats so important in the big picture It isn t just the application and integration that is impacted, it s the entire infrastructure and architecture that must adapt to support the data format The World Doesn t Care About APIs but it does care about the data, about the model Right now, it appears that model is more than likely going to be presented in a JSON-encoded format --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-htmlJSON data interchange format gets ECMA standards blessing icon-htmlJSON Continues its Winning Streak Over XML icon-html JSON versus XML Your Choice Matters More Than You Think icon-html I am in your HTTP headers, attacking your application icon-html The Web 20 API From collaborating to compromised icon-html Would you risk 31,000 for milliseconds of application response time icon-html Stop brute force listing of HTTP OPTIONS with network-side scripting icon-html The New Distribution of The 3-Tiered Architecture Changes Everything icon-html Are You Scrubbing the Twitter Stream on Your Web Site Technorati Tags MacVittie,F5,JSON,XML,APIs,PaaS,IaaS,cloud computing,development,security,Web 20 IMAGE http://www.secuobs.com/revue/news/301086.shtmlhttp://www.secuobs.com/revue/news/301086.shtml Secuobs.com : 2011-04-27 03:10:48 - Security - IMAGE IMAGE The FBI s unprecedented effort to behead the Coreflood botnet comprised of millions of hacked Windows machines appears to be working, at least for now The bureau has tracked a dramatic decline in the number of pings from the botnet since the takedown operation began earlier this month, according to court documents filed by the Justice Department on Monday The number of pings from infected US systems plummeted from nearly 800,000 to less than 100,000 in about a week after authorities began sending out stop commands to those machines a drop of nearly 90 percent Pings from infected computers outside the US have also dropped about 75 percent, likely as a result of a parallel outreach effort to foreign ISPs Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/300969.shtmlhttp://www.secuobs.com/revue/news/300969.shtml Secuobs.com : 2011-04-25 23:40:35 - Security - IMAGE South Korea's Korea Communications Commission is now asking Apple questions about the location data being stored on iPhones and iPads and backed up to users' computers South Korea joins the governments of France, Germany, and Italy, which late last week notified Apple that they also had questions about location data collection These investigations follow stern letters from US Sentaor Al Franken D-MN and US Representative Ed Markey D-MA , both of whom asked Apple to answer why the data is retained on users' devices, how it is collected, and what Apple does to protect users' privacy Last week, a news firestorm started after the public revelation by researchers Alasdair Allan and Pete Warden that iPhones and iPads keep a log of location data based on cell tower and WiFi base station triangulation in a file called consolidateddb The news led many to believe that Apple was using or could use the information to track iPhone and iPad 3G users, and raised privacy concerns that the information could make it into the wrong hands Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/300695.shtmlhttp://www.secuobs.com/revue/news/300695.shtml Secuobs.com : 2011-04-25 18:43:12 - Security - IMAGE Will it take being accused of downloading child pornography to get people to lock down their WiFi networks once and for all Although that's not the only reason to keep your network secure, perhaps some users will be scared into doing so after reading a number of horror stories collected by the Associated Press over the weekend The underlying lesson keep your WiFi networks locked down, lest you find law enforcement kicking down your door in the middle of the night The three stories all fall along the same theme a Buffalo man, Sarasota man, and Syracuse man all found themselves being raided by the FBI or police after their wireless networks were allegedly used to download child pornography You're a creep just admit it, one FBI agent was quoted saying to the accused party In all three cases, the accused ended up getting off the hook after their files were examined and neighbors were found to be responsible for downloading child porn via unsecured WiFi networks Being accused of amassing the world's largest collection of child pornography is just one of the many downsides to leaving your network open, yet people including some self-identified geeks continue to do it But why As evidenced by reader e-mail over the last few years, some users claim they're providing a service to their neighbors by letting them use their WiFi every so often in turn, these users tend to also make use of open WiFi networks when they see them Others hope that leaving their WiFi networks open will help to exonerate them if they were to be accused of downloading copyrighted music or movies Big Content would never sue the wrong individual for copyright infringement, right The AP's cautionary tales come just months after wireless industry group Wi-Fi Alliance published a survey saying that 32 percent of Internet users have tried to connect to a WiFi network that wasn't theirs When managing their own networks though, 40 percent said that they would be more likely to trust someone with a key to their homes than the password to their WiFi access points Much like the seatbelts in your car, WiFi security won't protect you unless you use it, Wi-Fi Alliance marketing director Kelly Davis-Felner said at the time We have a guide to protecting yourself on public WiFi hotspots, but what about your own WiFi network The Wi-Fi Alliance recommends implementing WPA2 protections and strong passwords at least eight characters, no dictionary words, with a mixture of upper and lower case letters, numbers, and symbols You can also change your router's settings so that your SSID is no longer being broadcast to nearby devices, and if you want to be extra secure, you can require each device's MAC address to be approved before they can connect Doing so may lose you friend points during your annual Super Bowl party, but it will go a long way towards avoiding unwanted accusations of downloading child pornography Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/300625.shtmlhttp://www.secuobs.com/revue/news/300625.shtml Secuobs.com : 2011-04-22 12:58:25 - Security - Managing the other kind of performance in a data center requires the ability to analyze a whole lotta data Big operational data f5friday Big data right now is nearly as hyped as cloud computing The vast amounts of data collected that need to be shared, integrated, replicated, backed up, and managed is growing at a phenomenal rate But when folks talk about big data they re focused primarily on application data, on user-generated data, on business data They are not generally concerned with the other big data that threatens to overwhelm data center operations on a daily basis operational data Every day, in data centers across the world, gigabyte upon gigabyte of log data is generated Some of it is mundane bandwidth and throughput data Some of it is routine web application data, reporting on number of requests received in any given period of time Other data contains more gnarly information, such as who and what device was trying to inject malicious code into a web application It s all important data, and when you combine the gigabytes of log files from just about every device in the data center, well, that s BIG data Without the means to aggregate, search, and analyze all that data as a view of the data center as opposed to individual components , however, it s just bits and bytes and wasted disk Administrators and operators need a way to aggregate and correlate events across the entire data center so they can more easily find and understand any given event or problem that may be occurring as well as providing a holistic view of data center performance And by performance I mean not just how fast does my application go but how well is my web application firewall performing its responsibilities After all, one of the ways in which IT justifies the acquisition of solutions is by providing a Return On Investment ROI based on the solution performing its intended task MANAGING the OTHER KIND of PERFORMANCE Spelunking for Big Operational Data If you deploy F5 BIG-IP Access Policy Manager APM as an access management solution, you d like to know that it s actually doing just that and how well it s doing it Without that data it s hard to compute the ROI and provide the business with proof that its investments in data center solutions are paying back the organization as expected The problem is that while individual solutions may report on how well they are performing, they are unlikely to integrate and correlate data from other systems to provide a holistic view of the other kind of performance That s where those standards and management solutions come in handy Leveraging standards and integration methods to aggregate data from across data center components and even data centers including cloud computing providers , solutions exist that can provide the visibility into the other kind of performance of data center components necessary to understand not only how each component is performing but also see the big picture across the entire data center Now, the way in which you paint that big picture differs You can, of course, go spelunking through the data center yourself to find the data you need and manually aggregate it Such manual processes do not scale well, of course, and as data grows so does the time and effort required to perform such a task The big operational data in today s data centers makes that a Herculean task that, on reflection, you ll find is probably much better suited to an automated solution A good option is a solution like Splunk, which phonetically sounds a whole lot like spelunk and unsurprisingly that s not just coincidence What Splunk does is exactly what you may think it does it explores the entire data center, indexing and aggregating and correlating data from just about every kind of system, platform, and device Not only does it provide a single-point of entry into the big data of enterprise infrastructure, but it also allows analysis of that data from simple to complex queries, enabling operators and admins to fully explore the depths of big data in the enterprise from the comfort of their console Now available for free, as in gratis is Splunk for F5 Version 20 Not only does this version support APM, but also includes integrated data from F5 BIG-IP Application Security Manager ASM and FirePass as well For more details on this offering, please check out fellow blogger Pete Silva s latest post, Do You Splunk 20 Happy Spelunking --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html Splunk for F5 icon-html Do You Splunk 20 icon-html F5 Friday Protocols are from Venus Data is from Mars icon-html All F5 Friday Entries on DevCentral video_iconVideo Splunk for Use with F5 Networks Solutions pdf-icon Splunk Templates for BIG-IP Access Policy Manager pdf-icon Splunk for FirePass SSL VPN pdf-icon Splunk for Application Security Manager MembersIcon2ASM Splunk integration MembersIcon2F5 Security Community Group on DevCentral Technorati Tags MacVittie,Peter Silva,F5,F5 Friday,Splunk,big data,BIG-IP ASM,BIG-IP APM,FirePass,security,management,integration IMAGE http://www.secuobs.com/revue/news/300222.shtmlhttp://www.secuobs.com/revue/news/300222.shtml Secuobs.com : 2011-04-20 19:12:18 - Security - IMAGE Two security researchers have discovered that iPhones and 3G-equipped iPads regularly record and store location information to a hidden file that is backed up to iTunes and even transferred to new devices While the information isn't necessarily accessible to remote hackers, the researchers noted that it does raise some important concerns about privacy Researchers Alasdair Allan and Pete Warden announced this morning that they are presenting their findings at the Where 20 conference on Wednesday Ever since iOS 4 arrived, your device has been storing a long list of locations and time stamps, the pair noted in a post to O'Reilly Radar We're not sure why Apple is gathering this data, but it's clearly intentional, as the database is being restored across backups, and even device migrations Warden developed software to view and analyze the database of locations stored by your iOS device, a copy of which is likely sitting unencrypted on the computer with which you sync your iPhone or iPad The pair advised that turning on backup encryption in iTunes is an easy way to protect the information from leaking, though anyone with physical access to your iDevice could potentially access and analyze the database We have contacted Apple and several security experts to get a better understanding of the privacy and security implications of Allan and Warden's findings Keep an eye out for our in-depth analysis on the issue later today Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/299735.shtmlhttp://www.secuobs.com/revue/news/299735.shtml Secuobs.com : 2011-04-20 03:31:34 - Security - IMAGE HBGary, the security firm that saw its servers hacked and its e-mails released after its HBGary Federal offshoot angered the Anonymous hive, published a rather peculiar open letter this past Friday in an effort to address the large amount of misinformation reported in the press But the letter makes some questionable claims of its own The unsigned letter outlines the basics of the attack and asserts that HBGary's internal systems remained safe and uncompromised To ward off future attacks, the letter also claimed that HBGary's website, which was hacked using a basic security flaw, and its e-mail system, which fell victim to weak, re-used passwords, were now back in operation with even stronger cyber defense mechanisms Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/299557.shtmlhttp://www.secuobs.com/revue/news/299557.shtml Secuobs.com : 2011-04-16 17:42:57 - Security - IMAGE Meet the senator blocking Big Content's Web censorship plan Senator Ron Wyden is on the warpath against Web censorship The content industry is trying to use government as a club to beat up on one of the most promising parts but the economy of the future the Internet, he tells me And he vows to stop them Judge to copyright troll your business model isn't my problem A federal judge blasted copyright litigation firm Righthaven for using lawsuits to squeeze settlements from Defendants cowed by the potential costs of litigation and liability The company immediately ditched that case, but the same judge is overseeing 50 more Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/298910.shtmlhttp://www.secuobs.com/revue/news/298910.shtml Secuobs.com : 2011-04-14 16:16:46 - Security - IMAGE Past efforts at killing botnets the large networks of computers running malicious software to send spam, flood Web sites with traffic, and steal personal data have managed to disable the networks by taking down important servers, they've always stopped short of actually killing the botnet software itself That's because the companies behind these efforts have no more legal authority to run unauthorized software on users' machines than the botnet owners do to remove the botnet software would make them just as guilty of hacking as the bad guys are The result is that while efforts such as Microsoft's disruption of the Waledac and Rustock botnets were successful, they were far from perfect These efforts left the malicious software running on the infected PCs they just removed the command and control servers, the centralized machines that tell the botnet what to do Should the bot herders regain control of the domain names or IP addresses used by the command and control servers, the infected machines will be able to successfully connect to them, and the networks will once again spring into life Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/298463.shtmlhttp://www.secuobs.com/revue/news/298463.shtml Secuobs.com : 2011-04-12 18:45:39 - Security - IMAGE Think that anonymizing BitTorrent tracker connections through Tor makes you harder to track Think again A vulnerability was used to identify over 10,000 users' IP addresses via their BitTorrent tracker connections But it's not just your BitTorrent downloads that are at risk an attacker can use your BitTorrent connections to de-anonymize other, more secure applications run over Tor In a paper released a few weeks ago at the USENIX conference's workshop on Large-scale Exploits and Emergent Threats LEET , researchers from INRIA France revealed a class of vulnerabilities in the Tor system which threatens the anonymity of many BitTorrent users The research team, led by Stevens Le Blond, explained an attack methodology which it developed and deployed The attack exploits a feature of Tor originally introduced to improve anonymity and efficiency, but it also relies on certain aspects of the BitTorrent protocol Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/297874.shtmlhttp://www.secuobs.com/revue/news/297874.shtml Secuobs.com : 2011-04-12 01:34:56 - Security - Adobe has confirmed the existence of a 0-day vulnerability that affects the latest versions of Flash, Reader, and Acrobat Targeted attacks using Flash files embedded into Word documents are being seen Read More Adobe advisory Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/297687.shtmlhttp://www.secuobs.com/revue/news/297687.shtml Secuobs.com : 2011-04-11 23:56:22 - Security - IMAGE Following last week's massive Epsilon e-mail breach, it feels as if all of us suddenly have a little too much personal information floating around online And now, a large group of Texans are about to have it a lot worse the state revealed Monday that personal information for 35 million citizens has been exposed to the public, including names, addresses, Social Security numbers, and more According to Texas State Comptroller Susan Combs, the data wasn't exposed by a hacker or a group of vigilante scriptkiddies it ended up on a state-controlled public server after having been passed around between various state agencies The data came from the Teacher Retirement System of Texas, the Texas Workforce Commission, and the Employees Retirement System of Texas, all of whom transferred the unencrypted data against state policy between January and May of 2010 The information was only discovered on the public server on March 31, 2011, meaning it has been available for almost a year Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/297669.shtmlhttp://www.secuobs.com/revue/news/297669.shtml Secuobs.com : 2011-04-08 04:04:59 - Security - IMAGE Microsoft's patching is going from one extreme to the other While March had just three bulletins fixing four vulnerabilities, next week 17 bulletins are being issued, fixing 64 different vulnerabilties This ties with December 2010 as the most bulletins, and takes the clear lead for number of flaws fixed Nine bulletins are critical, with all carrying the risk of remote code execution The remaining eight are ranked important six of these enable remote code execution, one allows privilege escalation, and the last can lead to information disclosure Seven of the bulletins have mandatory restarts the remainder may do so Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/297014.shtmlhttp://www.secuobs.com/revue/news/297014.shtml Secuobs.com : 2011-04-07 19:03:03 - Security - IMAGE Pandora's Android app transmits a plethora of personal information to third parties after all, at least according to an analysis done by security firm Veracode The company decided to do a follow-up on the news that Pandora among other mobile app makers was being investigated by a federal grand jury, and found that data about the user's birth date, gender, Android ID, and GPS information were all being sent to various advertising companies Earlier this week, Pandora revealed that it had been subpoenaed by a federal grand jury to produce documents about its user data collection practices on Android and iOS devices The company said that it believes the subpoena is part of an industry-wide investigation into popular applications on both platforms The Wall Street Journal quickly followed up on the news by reporting that the purpose of the investigation is to find out whether app makers fully describe to users the kinds of information they obtain and why they need it One other iOS developer, Anthony Campiti, said that he also got a subpoena over his app, Pumpkin Maker Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/296915.shtmlhttp://www.secuobs.com/revue/news/296915.shtml Secuobs.com : 2011-04-06 22:52:36 - Security - Our book, Unmasked, is now available on Apple's iBook store and Barnes Noble's NOOKstore Read More Our announcement, Screenshot of iBooks Page, NOOKstore, Smashwords, Kindle Store, Sony Reader Store Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/296709.shtmlhttp://www.secuobs.com/revue/news/296709.shtml Secuobs.com : 2011-04-06 12:52:59 - Security - It s called a feedback loop, not a feedback black hole One of the key components of a successful architecture designed to mitigate operational risk is the ability to measure, monitor and make decisions based on collected management data Whether it s simple load balancing decisions based on availability of an application or more complex global application delivery traffic steering that factors in location, performance, availability and business requirements, neither can be successful unless the components making decisions have the right information upon which to take action Monitoring and management is likely one of the least sought after tasks in the data center It s not all that exciting and it often involves please don t be frightened by this integration Agent-based, agentless, standards-based Monitoring of the health and performance of resources is critical to understanding how well an application is performing on a daily basis It s the foundational data used for capacity planning, to determine whether an application is under attack and to enable the dynamism required of a dynamic, intelligent infrastructure supportive of today s operational goals YOU CAN T REACT to WHAT you CAN T SEE We talk a lot about standards and commoditization and how both can enable utility-style computing as well as the integration necessary at the infrastructure layers to improve the overall responsiveness of IT But we imagedon t talk a lot about what that means in terms of monitoring and management of resource health performance, capacity and availability The ability of any load-balancing service depends upon the ability to determine the status of an application In an operationally mature architecture that includes the status of all components related to the delivery of that application, including other application services such as middle-ware and databases and external application services When IT has control over all components, then traditional agent-based approaches work well to provide that information When IT does not have control over all components, as is increasingly the case, then it cannot collect that data nor access it in real-time If the infrastructure components upon which successful application delivery relies cannot see how any given resource is performing let alone whether it s available or not, there is a failure to communicate that ultimately leads to poor decision making on the part of the infrastructure We know that in a highly virtualized or cloud-computing model of application deployment that it s important to monitor the health of the resource, not the server , because the server has become little more than a container, a platform upon which a resource is deployed and made available With the possibility of a resource moving it is even more imperative that operations monitor resources Consider how IT organizations that may desire to leverage more PaaS Platform as a Service to drive application development efforts forward faster Monitoring and management of those resources must occur at the resource layer IT has no control or visibility into the underlying platforms which is kind of the point in the first place YOU CAN T MAKE DECISIONS without FEEDBACK image The feedback from the resource must come from somewhere Whether that s an agent doesn t play well with a PaaS model or some other mechanism which is where we re headed in this discussion is not as important as getting there in the first place If we re going to architect highly responsive and dynamic data centers, we must share all the relevant information in a way that enables decision-making components strategic points of control to make the right decisions To do that resources, specifically applications and application-related resources, must provide feedback This is a job for devops if ever there was one Not the ops who apply development principles like Agile to their operational tasks, but developers who integrate operational requirements and needs into the resources they design, develop and ultimately deploy We already see efforts to standardize APIs imagedesigned to promote security awareness and information through efforts like CloudAudit We see efforts to standardize and commoditize APIs that drive operational concerns like provisioning with OpenStack But what we don t see is an effort to standardize and commoditize even the simplest of health monitoring methods No simple API, no suggestion of what data might be common across all layers of the application architecture that could provide the basic information necessary for infrastructure services to take actions appropriately The feedback regarding the operational status of an application resource is critical in ensuring that infrastructure is able to make the right decisions at the right time regarding each and every request It s about promoting dynamic equilibrium in the architecture an equilibrium that leads to efficient resource utilization across the data center while simultaneously providing for the best possible performance and availability of services MORE OPS in the DEV It is critical that developers not only understand but take action regarding the operational needs of the service delivery chain It is critical because in many situations the developer will be the only ones with the means to enable the collection of the very data upon which the successful delivery of services relies While infrastructure and specifically application delivery services are capable of collaborating with applications to retrieve health-related data and subsequently parse the information into actionable data, the key is that the data be available in the first place That means querying the application service whether application or middle-ware and beyond directly for the data needed to make the right decisions This type of data is not standard, it s not out of the box, and it s not built into the platforms upon which developers build and deploy applications It must be enabled, and that means code That means developers must provide the implementation of the means by which the data is collected ultimately one hopes this results in a standardized health-monitoring collection API jointly specified by ops and dev Together --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html Cloud Control Does Not Always Mean Do it yourself icon-html Operational Risk Comprises More Than Just Security icon-html On Cloud, Integration and Performance icon-html How to Build a Silo Faster Not Enough Ops in your Devops icon-html Infrastructure 20 Cloud IT as a Service An Architectural Parfait icon-html Cloud Chemistry 101 icon-html Infrastructure 20 Isn t Just For Cloud Computing icon-html Infrastructure 20 Is the Beginning of the Story, Not the End icon-html Will DevOps Fork icon-html The Zero-Product Property of IT slideshare The New Network Technorati Tags MacVittie,F5,devops,monitoring,management,application delivery,infrastructure 20,integration,standards,development,performance,availability IMAGE http://www.secuobs.com/revue/news/296576.shtmlhttp://www.secuobs.com/revue/news/296576.shtml Secuobs.com : 2011-04-06 06:58:38 - Security - IMAGE Google already warns users of its search engine if the page they're about to click on is likely to be malware The company also has an API, the Safe Browsing API, to allow Web browsers to check if a URL is bad or not This API is already used by Chrome, Firefox, and Safari Google has just announced that it's going to take this protection even further in its Chrome browser and apply it to executable downloads Click a link that downloads a program Google's Safe Browsing API regards as hostile and you'll see a warning, along with an option to cancel the download Initially, malicious Windows programs will be the target Such programs are unfortunately commonplace and generally depend on social engineering tricks rather than outright security flaws to lure users into installing them, with fake video codecs and bogus anti-virus software both being popular approaches A similar security system, designed for a similar purpose, was included in Internet Explorer 9 In that system, each download has a reputation attached to it, which is determined by the number of other people downloading a particular file Try to download a file with a bad reputation and the browser will warn you that there's a chance it's malicious This builds on top of the SmartScreen URL verification found in Internet Explorer 8 that offers equivalent functionality to the Safe Browsing API though Microsoft claims that SmartScreen is far more effective The new Chrome feature will initially be available in the development version of the browser, and the company hopes to have it ready in time for the next stable release Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/296539.shtmlhttp://www.secuobs.com/revue/news/296539.shtml Secuobs.com : 2011-04-06 04:39:45 - Security - IMAGE Symantec detected more than three billion malware attacks from 286 million malware variants last year, according to the 2010 edition of its annual Internet Security Threat Report, published today Web-based attacks were up 93 percent on 2009, and you were most likely to come across a malicious Web site if you were on the hunt for pornography 49 percent of malicious sites found through Web searches were pornographic Overall, the report paints a grim picture of the Internet threat landscape Software flaws are abundant In 2010, 6,253 software vulnerabilities were reported, higher than in any previous edition of the report 14 vulnerabilities were used in zero-day attacks, including four different Windows zero-days used in the Stuxnet attack Though data breaches are still relatively rare 457 in 2010 according to aggregator DataLossDB they still put many at risk About 61,000 identities were compromised on average, with breaches in the finance sector particularly big, at an average of over 235,000 identities per breach Breaches as a result of hacks rather than insiders, or theft or loss of hardware and media tended to be substantial, averaging more than 262,000 identities per hack The bad guys also demonstrated a firm grasp of new technology Social networking sites are a huge target, both due to their wide use and their enormous susceptibility to social engineering In mass, untargeted attacks, the social networking sites give malicious links a veneer of integrity if a friend of yours posts a link it's surely going to be safe, right For spear-phishing and other targeted attacks, the social networks give valuable insight into individual habits and interests, not to mention the ability for hackers to strike up friendships with their would-be victims and to gain their trust that way Hand in hand with social networking sites like Twitter, we've also seen a boom in URL shortening services such as bitly Hackers have been quick to exploit the way these mask the destination URL, making it much harder to know if a link is malicious until you actually click on it Two-thirds of attacks used on social networking sites used such masked, shortened URLs Smartphones are also beginning to attract malware 2010 saw the discovery of the first Android trojan, and it looks like hackers regard Android as a ripe platform for attacks last month more than 50 malicious programs were yanked from Android Market More vulnerabilities are being found on mobile platforms, with 163 found last year, an increase of 41 percent While still small-scale attacks compared to their PC-based counterparts, this is set to be a growth market Smartphones are chock full of personal information and thanks to premium rate phone and text numbers, have an unparalleled ability to monetize malware Patching won't save you 2010 was also a big year for targeted attacks Google came out as a victim of the Aurora attacks, and, of course, Stuxnet struck Iran The targeted attacks were notable for their use of zero-day vulnerabilities three different Internet Explorer zero-days were used in three separate targeted attacks, and Stuxnet used four Windows zero-days Social engineering was also instrumental in these attacks The use of zero-days is significant because it means that even an organization with good practices patching machines on a timely basis, using anti-malware software is at risk these old mechanisms do little to guard against this style of attack Heuristic analysis and sandboxing techniques both have a role to play in detecting these problems but work still needs to be done to make these easy to use, robust, and effective More than anything else, the report shows that the security situation really isn't improving it's getting quite a bit worse Social networking-based social engineering and zero-day targeted attacks put even conscientious, well-educated users at risk Software vulnerabilities are abundant, and malware is rampant That's good news for companies like Symantec it ensures that they'll continue to see a large market for their security products But it's bad news for everyone else Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/296527.shtmlhttp://www.secuobs.com/revue/news/296527.shtml Secuobs.com : 2011-04-05 16:55:12 - Security - ThreatPost has a list of companies affected by the Epsilon e-mail breach so far Read More ThreatPost, Ars coverage Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/296343.shtmlhttp://www.secuobs.com/revue/news/296343.shtml Secuobs.com : 2011-04-05 04:11:14 - Security - IMAGE Security firm RSA announced in March that it had been the victim of a hack that it described as extremely sophisticated The company has now shared some details of the attack Extremely sophisticated More like run-of-the-mill A spear-phishing e-mail was sent to two small groups within the company Though the e-mail was automatically marked as Junk, the subject of the message 2011 Recruitment Plan tricked one employee into opening it anyway Attached to the mail was an Excel spreadsheet, 2011 Recruitment planxls Embedded within the spreadsheet was a Flash movie that exploited a Flash vulnerability Adobe has since released an emergency patch for the flaw Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/296238.shtmlhttp://www.secuobs.com/revue/news/296238.shtml Secuobs.com : 2011-04-04 19:29:30 - Security - IMAGE Those of you who carefully craft a new e-mail alias for every e-commerce site you use will likely have to start all over again thanks to a new data breach E-mail marketing vendor Epsilon used by numerous banks, retailers, and other online services reported Friday that an unauthorized party had accessed its system on March 30 The breach exposed customer names and e-mail addresses from a subset of Epsilon clients' customer data, exposing those users to increased spam and phishing attacks According to a very brief statement issued by Epsilon, no other customer data was exposed besides names and e-mail addresses A rigorous assessment determined that no other personal identifiable information associated with those names was at risk A full investigation is currently underway, the company wrote Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/296114.shtmlhttp://www.secuobs.com/revue/news/296114.shtml Secuobs.com : 2011-04-01 12:51:09 - Security - It s not enough to have a strategic point of control you ve got to use it, too f5friday One of the primary threats to the positive operational posture of an organization is that of extremely heavy load Whether it s from a concerted effort to take down the site DDoS or simply an unanticipated flood of legitimate users is really not as important to today s discussion as understanding the impact both can have not just on your applications, but on their supporting infrastructure You know, the network stuff that sits between the client and your applications, defending against all manner of vile miscreant-created traffic Most often these network devices comprise components like IDS and IPS components that traditionally are configured in a transparent topology requiring the use of mirroring at the network layer This is most often accomplished by mirror span port configurations on the physical device In the face of overwhelming traffic, these components can become, well, overwhelmed Like firewalls, they can become a bottleneck Unlike firewalls which can induce performance degradations in the face of high traffic volumes - the bottleneck for these transparent security devices becomes a slowdown in operational processes and degradation in reaction times to the discovery of malicious content The typical reaction to such a potential problem is simple acquire more resources and or hardware to beef up capacity But that s not always the most efficient means of addressing the problem and in fact a more efficient solution would be to apply an architectural strategy that maintains an agile operational posture capable of reacting quickly to the presence of malicious content CONTEXTUAL TRAFFIC MIRRORING image Consider that in a traditional architecture comprising security devices such as IPS and IDS, all application traffic is mirrored to the device All traffic, whether it needs to be inspected or not Now that may at first sound like a silly statement Of course all traffic needs to be inspected But does it Does a request for an image need to go through an IPS or IDS Stenography has come a long way, sure, but the technique is generally used to hide data for human consumption it rarely if ever contains malicious code because there s not a commoditized means by which such data can be exploited to gain access to internal systems or carry out an attack against a data source But in a traditional architecture, requests for images are going through the security infrastructure no matter what You ve got no control over that Except you do, if you ve got the right tools in your strategic arsenal A tool like a network-side scripting that can leverage the innate capabilities of a full-proxy based application delivery controller Yeah, I m talking about iRules on an F5 BIG-IP LTM Local Traffic Manager Using the ability of BIG-IP LTM to intercept requests, inspect them, and then enforce routing, security and other application-centric policies upon those requests you can architect a solution that is makes more efficient use of the resources you have even in the face of higher traffic volumes It s a force-multiplier, making your limited security infrastructure resources more powerful by focusing them in on the attempts to outflank your information security strategy Using the iRules clone command, you can instruct BIG-IP to mirror traffic to a designated pool collection of resources, most often servers or pool member a single resource, such as an application instance virtual or physical By taking advantage of iRules ability to inspect incoming requests, you can then leverage this cloning capability to only mirror specified traffic to a pool of security infrastructure components, such as a group of IDS The decision regarding which requests are mirrored can be based on just about any variable you can think of URI, host name, client agent data, request type, HTTP headers, cookies, etc Such decisions could also be used conditionally that is, if traffic volume suddenly increases a sampling of traffic could be mirrored off instead of all traffic as a means to avoid overwhelming the infrastructure, or perhaps such a policy could be enforced only when it becomes clear that the security infrastructure is about to be overwhelmed It s about context and the ability to leverage that context to make decisions that are smart, efficient, and consistent with business goals and requirements For those of you who d like to try it out yourself, here s a sample from our Solution Architects collection of Top 50 iRules This sample uses the URI as the means of determining whether to clone the request to a pool of IDS but you can use just about any information in the network stack whatever makes sense to enforce the topological control over the flow of traffic you need to meet business and operational goals Clone Pool Based on URI CPU impact Minimal Requirement HTTP profile A clone pool is a pool of transparent devices such as Intrusion Detection Systems Instead of cloning copy or mirroring all traffic to the IDS pool, this iRule more granularly clones only traffic destined for sensitive areas of a web site when HTTP_REQUEST if HTTP uri starts_with secure clone pool clone_pool pool real_pool CONTROL and FLEXIBILITY The advantage of using a strategic point of control like BIG-IP is its visibility and management of an application as a holistic unit Because it is the primary interface for clients when interacting with a web application, BIG-IP sees the total load on an application and its supporting infrastructure That allows operations to codify policies that dynamically adjust the flow of traffic based on current capacity against current request load It can collaborate with provisioning and management systems to further initiate provisioning of additional security resources if they re virtualized, providing the means by which an application can be truly scaled to meet demands Too often application scalability focuses solely on the application and its servers instances, but operations does so at its own peril, as failing to properly also scale up supporting infrastructure such as IDS or IPS can cause failures if not of the application then of the security or other supporting infrastructure systems Consider a failure of the identity and access management supporting web applications, for example Such a failure ultimately means a failure of the application, even though operationally there may be more than enough web resource capacity to fulfill all incoming requests It is paramount to a successful scaling strategy to ensure that all components directly or indirectly impacted by increases in traffic volume are either able to scale along with the application or there are policies in place to effectively manage the incoming requests such that no topological segment of the architecture is overwhelmed There s no single best way to architect such a solution because it s highly dependent on an organization s operational goals and policies and the business tolerance for risk The flexibility of iRules and ability to strategically apply policies governing resource utilization affords organizations the means to architect a solution that meets or exceeds operational goals using the resources at hand It is in part this agility that makes BIG-IP a strategic point of control enabling organizations to apply and enforce a broad range of operational policies in a way that makes the most of limited resources --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html What CIOs Can Learn from the Spartans icon-html F5 Friday Hyperlocalize Applications for Everyone icon-html F5 Friday You ll Catch More Bees with Honey pots icon-html All F5 Friday Entries on DevCentral icon-html iRules Wiki on DevCentral User-Group-icon iRules Discussion Group on DevCentral icon-html What is a Strategic Point of Control Anyway icon-html The Strategy Not Taken Broken Doesn t Mean What You Think It Means icon-html Some Services are More Equal than Others icon-html The Battle of Economy of Scale versus Control and Flexibility Technorati Tags MacVittie,F5,F5 Friday,BIG-IP,LTM,iRules,network-side scripting,architecture,strategic point of control,security IMAGE http://www.secuobs.com/revue/news/295641.shtmlhttp://www.secuobs.com/revue/news/295641.shtml Secuobs.com : 2011-04-01 02:16:30 - Security - IMAGE Hundreds of thousands of URLs have been compromised at the time of writing, 694,000 in an enormous and indiscriminate SQL injection attack The attack has modified text stored in databases, with the result that pages served up by the attacked systems include within each page one or more references to a particular JavaScript file The attack appears to be indiscriminate in its targets, with compromised machines running ASP, ASPNET, ColdFusion, JSP, and PHP, and no doubt others SQL injection attacks, which exploit badly-written Web applications to directly perform actions against databases, are largely independent of the technology used to develop the applications themselves the programming errors that allow SQL injection can be made in virtually any language The underlying cause is a programmer trusting input that comes from a Web page either a value from a form, or a parameter in a URL and passing this input directly into the database If the input is malformed in a particular way, the result is that the database will run code of the attacker's choosing In this case, the injected SQL is simply updating text fields within the database, to make them include an extra fragment of HTML This HTML in turn loads a JavaScript from a remote server, typically http lizamooncom urphp or more recently, http alisa-cartercom urphp Both domain names resolve to the same IP address, and presently that server is not functional, leaving browsers unable to load the malicious script when they visit infected pages Previously, it contained a simple script to redirect users to a fake anti-virus site The massive scale of these attacks and the rapidly growing number of affected URLs was first noticed by Websense Security Labs On Tuesday, around 28,000 URLs were compromised now more than 20 times more URLs are infected, and the numbers are still growing The injected code is also found on a number of product pages on Apple's iTunes Store Apple fetches RSS feeds from podcasters that broadcast using iTunes, and in a number of cases these broadcasters have been compromised by the SQL injection attack As a result, the malicious code has made its way into Apple's system However, due to the way Apple processes the RSS feeds, there appears to be no exploitation vector the injected HTML is safely nullified SQL injections following this pattern appear to have been happening off and on for six or more months now The domain name hosting the JavaScript changes each time, but the file name urphp and the style of injection remain consistent The actions of the scripts have been similar too pop-up windows and malware downloads Previous efforts were on a much smaller scale, however hundreds of compromised URLs instead of hundreds of thousands In these earlier cases, the attacks originated from IP addresses in eastern Europe and Russia It's been a busy week for SQL injection at the weekend, MySQLcom, the website of Oracle-owned open source database MySQL, was hacked, again using SQL injection A little embarrassing for a database vendor to be unable to use its own database securely Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/295530.shtmlhttp://www.secuobs.com/revue/news/295530.shtml Secuobs.com : 2011-03-31 16:33:52 - Security - IMAGE Mohamed Hassan had just installed anti-malware software on his new Samsung laptop when, much to his surprise, the software alerted him to the presence of a keystroke logger A brand-new machine, and it was apparently already recording every password and username he typed He returned the computer for an unrelated reason, and bought a second Samsung laptop to replace it Lo and behold, the same keylogger was apparently found on this new machine Naturally, he asked Samsung about this, only to receive a range of confused answers Initially the support person he talked to denied any Samsung involvement, claiming all Samsung did was to manufacture the hardware On escalating the issue, supervisor claimed to have no idea how the software might have got onto his PC Hassan was then told that Samsung installed the software so that it could monitor the performance of the machine and to find out how it is being used Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/295396.shtmlhttp://www.secuobs.com/revue/news/295396.shtml Secuobs.com : 2011-03-30 22:58:02 - Security - Samsung is reported to have installed keyboard loggers on new systems, apparently to monitor performance and learn how systems are being used Read More Discovery of the key logger, Samsung's astonishing response Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/295221.shtmlhttp://www.secuobs.com/revue/news/295221.shtml Secuobs.com : 2011-03-30 02:17:29 - Security - IMAGE It's sure to be temporary, but we should enjoy it while we can Microsoft's action to behead the Rustock botnet has seen global spam levels drop by about a third, according to Symantec-owned messaging and security provider MessageLabs The full report shows that there's still a lot of work to be done In 2010, 88 percent of all spam emails were sent by botnets, and of that botnet-originated spam, Rustock was responsible for an average of 28 percent Taking out Rustock has unsurprisingly had a substantial impact on spam levels However, MessageLabs reports that other botnets have increased spam production over the same period, making it likely that previous spam volumes will be resumed soon enough It's a one-time drop, but it's a big one The data does give some reason for optimism, however Just ten botnets including Rustock are responsible for about 74 percent of all spam Taking out these botnets would not be a minor undertaking, but it's still a manageable scale the botnet market is relatively consolidated While eradicating the botnets certainly won't eradicate spam, it may well reduce it to tolerable levels Gradual improvements in system security not least the slow abandonment of Windows XP and replacement of infected systems should make it harder to recruit large-scale botnets in the future, amplifying the effect of each botnet takedown That future is, alas, still some way off in the meantime, aggressive spam filtering at the server and client level is the only viable recourse A case might also be made for better legislation one of the more surprising aspects of Microsoft's Rustock lawsuit was the circuitous route by which the company had the server hardware used by the botnet seized The company had to use trademark law claiming that Rustock's spam infringed on both its own and Pfizer's trademarks in order to have the server hardware seized Existing anti-spam legislation only allows domain names to be taken an insufficient tool for taking down Rustock Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/294985.shtmlhttp://www.secuobs.com/revue/news/294985.shtml Secuobs.com : 2011-03-29 03:30:49 - Security - The Iranian Comodo hacker has now posted incontrovertible evidence that he was behind the attacks he has published the private key to one of the certificates he generated Read More Private key, Walkthrough demonstrating legitimacy of the private key, Past coverage, Past coverage Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/294702.shtmlhttp://www.secuobs.com/revue/news/294702.shtml Secuobs.com : 2011-03-29 00:18:33 - Security - Chris Palmer, the technology director of the EFF, has produced an interesting presentation entitled It's Time to Fix HTTPS Read More The presentation on Google Docs Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/294677.shtmlhttp://www.secuobs.com/revue/news/294677.shtml Secuobs.com : 2011-03-28 12:46:38 - Security - When your data center is constantly under pressure to address operational risks, try leveraging some ancient wisdom from King Leonidas and William Wallace spartanThe Battle of Thermopylae is most often remembered for the valiant stand of the 300 In case you aren't familiar, three hundred Spartans and a supporting cast of city-state nations held off the much more impressively numbered armies of Prince Xerces for a total of seven days before being annihilated quote-badge A Greek force of approximately 7,000 men marched north to block the pass in the summer of 480 BC The Persian army, alleged by the ancient sources to have numbered in the millions but today considered to have been much smaller various figures are given by scholars ranging between about 100,000 and 300,000 , arrived at the pass in late August or early September Vastly outnumbered, the Greeks held off the Persians for seven days in total including three of battle , before the rear-guard was annihilated in one of history's most famous last stands During two full days of battle, the small force led by King Leonidas I of Sparta blocked the only road by which the massive Persian army could pass After the second day of battle, a local resident named Ephialtes betrayed the Greeks by revealing a small path that led behind the Greek lines Aware that his force was being outflanked, Leonidas dismissed the bulk of the Greek army, and remained to guard the rear with 300 Spartans, 700 Thespians, 400 Thebans and perhaps a few hundred others, the vast majority of whom were killed -- Wikipedia, The Battle of Thermopylae emphasis added Compare that to the Battle of Stirling Bridge, where William Wallace and his much smaller force of Scots prepared to make a stand against Edward I and his English forces He chose a battleground that afforded him a view of the surrounding area for twenty miles, enabling him to not only see exactly what challenges he faced, but to make his plans accordingly Leveraging the very narrow bridge at Stirling and some somewhat unconventional tactics at the time, he managed to direct his resources in a way that allowed him to not only control the flow of opponents but ensure victory for the Scottish forces What CIOs should take away from even a cursory study of these battles is this strategic control can enable you to meet your goals with far fewer resources than expected The choice of terrain and tools is commonly accepted as a force multiplier in military tactics The difference between the two was in visibility ultimately it was a lack of visibility that caused Leonidas' strategy to fail where Wallace was successful Leonidas, unable to see sooner that he was being outflanked, could not provision resources or apply tactics in a way that enabled him to defeat the Persians Wallace, on the other hand, had both visibility and control and ultimately succeeded What's needed in the data center is similar finding strategic points of control and leverage them to achieve a positive operational posture that not only addresses implementation and architectural requirements but business requirements as well IT has to align itself as a means to align with the business THE STRATEGIC TRIFECTA There inherently exist in the data center strategic points of control that is, locations at which it's most beneficial to apply and enforce a broad variety of policies to achieve operational and business goals Like terrain, these points of control can be force multipliers improving the efficiency and effectiveness of fewer resources Like high ground, it affords IT the visibility necessary to redeploy resources dynamically strategic trifecta This strategic trifecta comprises business value, architecture and implementation and when identified, these strategic locations can be a powerful tool in realizing IT operational and business goals Strategic points of control are almost always naturally aggregation points within an architecture physical and topological locations at which traffic is forced for one reason or another to flow The locations are ones within the data center in which all three strategic advantages can be achieved simultaneously Applications and data cannot be controlled nor policies enforced upon them to align with business goals on a per-instance basis Applications and storage resources today are constructs, comprising multiple infrastructure and application services that cannot be managed effectively to meet business goals individuallyStrategic points of control within the data center afford a unique opportunity to view, manage and enforce policies upon application and storage services as a holistic unit You'll note the similarity here with the battlegrounds chosen by Leonidas and Wallace Thermopylae and Stirling Thermopylae was a naturally occurring location that narrowed the path through which the invading army had to travel Mountains on one side, cliffs on the other, Xerces had no choice but to send his army straight into the eager arms of the Spartans Stirling is located within the folds of a river with a single, narrow bridge Edward I had no choice but to send his men two by two across that bridge to form up on the chosen battleground, allowing Wallace and the Scots to control the flow and ultimately decide the moment of attack when it was most likely that the Scots could prevail As a data center technique, the strategy remains much the same apply policies regarding security, performance, and reliability in those places where traffic and resources naturally converges Use the right equipment in the right locations and the investment can multiply the efficiency of the entire data center just as both become force multipliers on the battlefield The policies implemented at each strategic point of control enable better management of resources, better direction of traffic, and improved control over access those resources Each point essentially virtualizes resources, and policies that govern how those resources are access, distributed and consumed can be enforced They optimize the end-to-end delivery of resources across vastly disparate conditions and environments Such points of control, especially when collaborative in nature, provide a holistic view of and control over top-level business concerns reliability, availability and performance Leveraging strategic points of control also affords creates a more agile operational posture in which policies can be adjusted dynamically and rapidly to address a wide variety of data center concerns All three foci are required a lack of visibility by concentrating on individual performance, availability and capacity operational risks does not afford the opportunity to meet business goals It is the performance of the application as a whole, not its individual components, that is of import to the business It is the cost to deliver and secure the application as a whole that determines efficiency, not that of individual components strategic point of control - definitionThese strategic points of control also offer the advantage of being contextually aware, which enables policies to be applied based on the resources, the network or the clients Policies might be applied to all tablets or all applications of a specific type or they might be dynamic based on current operational or business parameters Strategic points of control enable resources to be more effectively and efficiently managed by policies instead of people This has the effect of tipping the imbalance of burden that currently lies primarily on the shoulders of people toward technology The goal of IT as a Service and a more dynamic data center is wholly supported by such a strategic trifecta, as it provides the means by which resources can be managed, provisioned, and secured without disruption The virtualization of resources and their associated policies enables a more responsive IT organization by making it possible to manage resources in a very service-oriented fashion, applying and enforcing policies on an application rather than on individual servers, instances, or virtual images A strategic point of control in the data center is the equivalent of a modern Thermopylae Like ancient but successful battles whose tactics and strategy have become standard templates for efficiently using resources by leveraging location and visibility, their modern equivalents in the data center can enable a CIO to align IT not only with the business, but its own operational and architectural goals as well --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html What is a Strategic Point of Control Anyway icon-html Cloud is the How not the What icon-html Cloud Control Does Not Always Mean Do it yourself icon-html The Strategy Not Taken Broken Doesn t Mean What You Think It Means icon-html Data Center Feng Shui Process Equally Important as Preparation icon-html Some Services are More Equal than Others icon-html The Battle of Economy of Scale versus Control and Flexibility Technorati Tags MacVittie,F5,strategic points of control,strategy,cloud computing,virtualization,unified application delivery and data services,services,acceleration,optimization,security,performance,availability IMAGE http://www.secuobs.com/revue/news/294511.shtmlhttp://www.secuobs.com/revue/news/294511.shtml Secuobs.com : 2011-03-25 16:57:26 - Security - What s worse than the big bad SSL wolf Bad certificates certifying badder content big bad wolf --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles s 1024 words 1 picture g IT Security Flowchart This post intentionally left blank All 1024 Words on DevCentral 1024 Words Inception Cloud Technorati Tags MacVittie,F5,security,SSL,1024 Words IMAGE http://www.secuobs.com/revue/news/294202.shtmlhttp://www.secuobs.com/revue/news/294202.shtml Secuobs.com : 2011-03-25 01:04:30 - Security - IMAGE Recently at Ars we've had a couple of discussions about the use of HTTPS that is, HTTP secured using SSL or TLS for every website, as a way of keeping sensitive information out of reach of eavesdroppers and ensuring privacy That's definitely a good thing, but it has a flaw it requires HTTPS to actually be effective at protecting privacy Recent goings on at Certificate Authority CA Comodo provide compelling evidence that such trust is misplaced There are two interrelated aspects to SSL The first is encryption ensuring that nobody can understand the communication between a client and a server and the second is authentication proving to the client that it is actually communicating with the server it thinks it's communicating with When a client first connects to an HTTPS server, both parties have a bit of a problem They would like to encrypt the information they send each other, but to do this, they both need to be using the same encryption key Obviously, they cannot just send the key to each other, because anyone listening in on the connection will be able to watch them do so, and use the key to decrypt the communication themselves Fortunately, clever mathematics allows both parties to share an encryption key without it being disclosed to any eavesdroppers Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/294057.shtmlhttp://www.secuobs.com/revue/news/294057.shtml Secuobs.com : 2011-03-22 14:42:02 - Security - IMAGE The Rustock botnet, responsible at its height for sending 30 billion spam e-mails a day, went silent last Wednesday Its command and control servers, responsible for telling the millions of machines recruited into the network which spams to send, were taken offline With the botnet now headless, the deluge of spam was halted Security researchers tracking spam production immediately noticed the drop in spam volume But what they didn't know was why the botnet went silent Rustock's spam output had declined before, only to bounce back Was this latest drop a temporary hiatus as the botnet's operators prepared to unleash a new torrent of spam, or was it something more Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/293291.shtmlhttp://www.secuobs.com/revue/news/293291.shtml Secuobs.com : 2011-03-18 22:31:22 - Security - IMAGE Security firm RSA has been the victim of an extremely sophisticated attack that has resulted in exfiltration of certain private information, announced Executive Chairman Art Coviello in an open letter published yesterday The company also filed a note with the SEC, warning of possible risks due to the attack Since 2006, RSA has been part of EMC Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/292709.shtmlhttp://www.secuobs.com/revue/news/292709.shtml Secuobs.com : 2011-03-16 19:19:04 - Security - IMAGE In 1998, Ask Ars was an early feature of the newly-launched Ars Technica Now, as then, it's all about your questions and our community's answers Each week, we'll dig into our question bag, provide our own take, then tap the wisdom of our readers To submit your own question, see our helpful tips page Question What's the most secure way to transport 100GB of data via Sneakernet Sharing small files across the Internet with a good amount of security keeps getting easier, but large datasets can still create long, painful upload times In this video edition of Ask Ars, we cover the most secure ways to transport large datasets by trekking the dusty trail, otherwise known as Sneakernet, even with predators in hot pursuit Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/292081.shtmlhttp://www.secuobs.com/revue/news/292081.shtml Secuobs.com : 2011-03-14 11:24:15 - Security - Internal processes may be the best answer to mitigating risks associated with third-party virtual appliances Quarantine-Area-Caution-SignThe enterprise data center is, in most cases, what aquarists would call a closed system This is to say that from a systems and application perspective, the enterprise has control over what goes in The problem is, of course, those pesky parasites viruses, trojans, worms that find their way in This is the result of allowing external data or systems to enter the data center without proper security measures For web applications we talk about things like data scrubbing and web application firewalls, about proper input validation codified by developers, and even anti-virus scans of incoming e-mail But when we start looking at virtual appliances, at virtual machines, being hosted in vm stores much in the same manner as mobile applications are hosted in app stores today, the process becomes a little more complicated Consider Stuxnet as a good example of the difficulty in completely removing some of these nasty contagions Now imagine public AMIs or other virtual appliances downloaded from a virtual appliance store Hoff first raised this as a potential threat vector a while back, and reintroduced it when it was tangentially raised by Google s announcement it had pulled 21 popular free apps from the Android Market because the apps are malware aimed at getting root access to the user s device Hoff continues to say quote-badge This is going to be a big problem in the mobile space and potentially just as impacting in cloud virtual datacenters as people routinely download and put into production virtual machines virtual appliances, the provenance and integrity of which are questionable Who s going to police these stores -- Christofer Hoff, App Stores From Mobile Platforms To VMs Ripe For Abuse Even if someone polices these stores, are you going to run the risk, ever so slight as it may be, that a dangerous pathogen may be lurking in that appliance We had some similar scares back in the early days of open source, when a miscreant introduced a trojan into a popular open source daemon that was subsequently downloaded, compiled, and installed by a lot of people It s not a concept with which the enterprise is unfamiliar THE DATA CENTER QUARANTINE TANK I cannot count the number of desperate pleas for professional advice and help with regards to sick fish that start with I did not use a quarantine tank A quarantine tank QT in the fish keeping hobby is a completely separate isolated tank maintained with the same water parameters as the display tank DT closed-loop The QT provides a transitory stop for fish destined for the display tank that offers a chance for the fish to become acclimated to the water and light parameters of the system while simultaneously allowing the hobbyist to observe the fish for possible signs of infection Interestingly, the QT is used before an infection is discovered, not just afterwards as is the case with people infected with highly contagious diseases The reason fish are placed into quarantine even though they may be free of disease or parasites is because they will ultimately be placed into a closed system and it is nearly impossible to eradicate disease and parasites in a closed system without shutting it all down first To avoid that catastrophic event, fish go into QT first and then, when it s clear they are healthy, they can join their new friends in the display tank Now, the data center is very similar to a closed system Once a contagion gets into its systems, it can be very difficult to eradicate it While there are many solutions to preventing contagion, one of the best solutions is to use a quarantine tank to ensure health of any virtual appliance prior to deployment Virtualization affords organizations the ability to create a walled-garden, an isolated network environment, that is suitable for a variety of uses Replicating production environments for testing and validation of topology and architecture is often proposed as the driver for such environments, but use as a quarantine facility is also an option Quarantine is vital to evaluating the health of any virtual network appliance because you aren t looking just for the obvious worms and trojans that are detectable using vulnerability scans but you re looking for the stealth infection The one that only shows itself at certain times of the day or week and which isn t necessarily as interested in propagating itself throughout your network but is instead focused on phoning home for purposes of preparing for a future attack It s necessary to fire up that appliance in a constrained environment and then watch it Monitor its network and application activity over time to determine whether or not it s been infected with some piece of malware that only rears its ugly head when it thinks you aren t looking Within the confines of a quarantined environment, within the turn it off and start it over clean architecture comprised of virtual machines, you have the luxury of being able to better evaluate the health of any third-party virtual machine or application for that matter before turning it loose in your data center QUARANTINE in the DATA CENTER is not NEW The idea of quarantine in the data center is not new We ve used it for some time as an assist in dealing with similar situations particularly end-users infected with some malware detectable by end-user inspection solutions Generally we ve used that information to quarantine the end-user on a specific network with limited access to data center resources usually just enough to clean their environment or install the proper software necessary to protect them We ve used a style of quarantine to aid in the application lifecycle progression from development to deployment in production in the QA or test phase wherein applications are deployed into an environment closely resembling the production environment as a means to ensure that configurations, dependencies and integrations are properly implemented and the application works as expected So the concept is not new, it s more the need to recognize the benefits of a quarantine first policy and subsequently implementing such a process in the data center to support the use of third-party virtual network appliances As with many cloud and virtualization-related challenges, part of the solution almost always involves process It is in recognizing the challenges and applying the right mix of process, product and people to mitigate operational risks associated with the deployment of new technology and architectures --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html Cloud Control Does Not Always Mean Do it yourself icon-html App Stores From Mobile Platforms To VMs Ripe For Abuse icon-html Operational Risk Comprises More Than Just Security icon-html The Strategy Not Taken Broken Doesn t Mean What You Think It Means icon-html Cloud Chemistry 101 icon-html More Users, More Access, More Clients, Less Control icon-html Get Your Money for Nothing and Your Bots for Free icon-html Control, choice, and cost The Conflict in the Cloud icon-html The Corollary to Hoff s Law Technorati Tags MacVittie,F5,virtualization,quarantine,data center,security,risk,cloud computing,virtual network appliance IMAGE http://www.secuobs.com/revue/news/291401.shtmlhttp://www.secuobs.com/revue/news/291401.shtml Secuobs.com : 2011-03-11 23:31:16 - Security - IMAGE The Federal Trade Commission FTC has accepted the proposed settlement with Twitter over its 2009 security breaches The settlement was first proposed in mid-2010 when the FTC said that Twitter had serious lapses in the company s data security, and as a result, Twitter must implement and maintain a comprehensive information security program that will be independently evaluated every other year for 10 years The social media service had come under fire for making private tweets and the login credentials of users easily available to hackers between January and May of 2009 During that time, someone was able to gain administrative access to Twitter's system and therefore access to thousands of user accounts, passwords, direct messages, and more simply by using password-guessing software That user reset numerous user passwords, allowing others to access those accounts There was also a separate incident in which another user was able to get into a Twitter employee's Gmail account and steal more passwords that were stored in plaintext, which were then used to guess that employee's admin password to the Twitter system The FTC issued a warning to Twitter a year later, and the finalized settlement was unanimously approved on Friday There aren't many changes to the settlement between last year and now, except that Twitter's new security program will get evaluated every other year instead of every three years Additionally, Twitter is barred from misleading consumers about its security practices for 20 years Hopefully the company doesn't plan to mislead anyone at the 21-year mark Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/291127.shtmlhttp://www.secuobs.com/revue/news/291127.shtml Secuobs.com : 2011-03-11 16:11:07 - Security - IMAGE After successful attacks on Safari and Internet Explorer 8 on Wednesday, the second day of Pwn2Own saw the iPhone 4 and then the BlackBerry Torch 9800 successfully exploited The annual security competition allows researchers to win any systems that they successfully compromise, and also awards them cash rewards if those security flaws are still present at in the latest version of the software The iPhone was hacked by Pwn2Own veteran Charlie Miller working with Dion Blazakis In the last three years, Miller has successfully pwned both Apple's phones and laptops at the competition, and he kept his winning streak going this year with a successful attack on the iPhone 4 The flaw used to pwn the iPhone was in its Mobile Safari Web browser the phone was compromised simply by visiting a specially-crafted Web page, which allowed Miller to run exploit code that allowed him to access the phone's address book Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/291031.shtmlhttp://www.secuobs.com/revue/news/291031.shtml Secuobs.com : 2011-03-11 12:07:59 - Security - Sometimes vulnerabilities are simply the result of a protocol design decision, but that doesn t make it any less a vulnerability f5friday An article discussing a new attack on social networking applications that effectively provides an opening through which personal data can be leaked was passed around the Internets recently If you haven t read Abusing HTTP Status Codes to Expose Private Information yet please do, it s a good read and exposes, if you ll pardon the pun, yet another vulnerability by design flaw that exists in many of the protocols that make the web go today We, as an industry, spend a lot of time picking on developers for not writing secure code, for introducing vulnerabilities and subsequently ignoring them, and for basically making the web a very scary place We rarely, however, talk about the insecurities and flaws inherent in core protocols, however, that contribute to the overall scariness of the Internets Consider, for example, the misuse and abuse of HTTP as a means to carry out a DDoS attack Such attacks are not viable due to some developer with a lax attitude toward security, it s simply the result of the way in which the protocol works Someone discovered a way to put it to work to carry out their evil plans The same can be said of the aforementioned vulnerability This isn t the result of developers not caring about security, it s merely a side-effect of the way in which HTTP is supposed to work Site and application developers use HTTP status codes and the like to respond to requests in addition to the content returned Some of those HTTP status codes aren t even under the control of the site or application developer 5xx errors are returned by the web or application server software automatically based on internal conditions That someone has found a way to leverage these basic behaviors in a way that might allow personal information to be exposed should be no surprise The more complex web applications and the interactions that make the web an actual web of interconnected sites and data stores become, the more innovative use of admittedly very basic application protocols must be made That innovation can almost always be turned around and used for more malevolent purposes What was, troubling, however, was Google s response to this vulnerability in Gmail as described by the author The author states he reported it to Google and they described it as expected behaviour and ignored it Now Google is right it is expected behavior but that doesn t necessarily mean it s acceptable behavior PROTECTING YOURSELF from BAD EXPECTED BEHAVIOR Enabling protection against this potential exposure of personal information depends on whether you are a user or someone charged with protecting user s information If you didn t read through all the comments on the article then you missed a great suggestion for users interested in protecting themselves against what is similar to a cross-site request forgery XSRF attack I ll reproduce it here, in total, to make sure nothing is lost quote-badge Justin Samuel I'm the RequestPolicy developer Thanks for the mention I should point out that if you're using NoScript then you're already safe as long as you haven't allowed JavaScript on this or the other sites Of course, people do allow JavaScript in some cases but still want control over cross-site requests In those cases, NoScript RequestPolicy is a great combo it's what I use if the usability impact of having two website-breaking, whitelist-based extensions installed is worth the security and privacy gains RequestPolicy does have some good usability improvements planned, but if you can only stand to have one of these extensions installed, then I recommend NoScript over RequestPolicy in most situations Written, Tuesday January the 25th, 2011 So as a user, NoScript or NoScript and RequestPolicy will help keep you safe from the potential misuse of this expected behavior by giving you the means by which you can control cross-site requests As someone responsible for protecting your user customer partner employee information, however, you can t necessarily force the use of NoScript or RequestPolicy or any other client-side solution First, it doesn t protect the data from leaving the building in the first place and second, even if it did and you could force the installation deployment of such solutions you can t necessarily control user behavior that may lead to turning it off or otherwise manipulating the environment The reality is that for organizations trying to protect both themselves and their customers, they have only one thing they can control their own environment That means the data center PROTECTING YOUR CLIENTS FROM BAD EXPECTED BEHAVIOR To prevent data leakage of any kind whether through behavioral or vulnerability exploitation you need a holistic security strategy in place The funny thing about protocol behavior exploitation, however, is that application protocol behavior is governed by the stack and the platform, not necessarily the application itself Now in this case it s true that the behavior is eerily similar to a cross-site request forgery XSRF attack Which means developers could and probably should be able to address by enforcing policies that restrict access to specific requests based on referrer or other identifying contextual information The problem is that this means modifying applications for a potential vulnerability that may or may not be exploited It s unlikely to have the priority necessary to garner time and effort on the application development team s already lengthy to-do list Which is where a web application firewall WAF like BIG-IP ASM Application Security Manager comes into play BIG-IP ASM can protect applications and sensitive data from attacks like XSRF right now It doesn t take nearly the cycles to implement an XSRF or other web application layer security policy using ASM as it will to address in the application itself if that s even possible sometimes it s not Whether ASM or any WAF ends up permanently protecting data against exploitation or not is entirely up to the organization In some cases it may be the most financially and architecturally efficient solution In other cases it may not In the former, hey great In the latter, hey great you ve got a stop gap measure to protect data and customers and the organization until such time as a solution can be implemented, tested, and ultimately deployed Either way, BIG-IP ASM enables organizations to quickly address expected but still unacceptable behavior That means risk is nearly immediately mitigated whether or not the long term solution remains the WAF or falls to developers Customers don t care about the political battles or religious wars that occur regarding the role of web application firewalls in the larger data center security strategy and they really don t want to hear about expected behavior as the cause of a data leak They care that they are protected when using applications against inadvertent theft of their private, personal data It s the job of IT to do just that, one way or another --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html Facebook app pages serve up Javascript and Acai Berry spam icon-html The True Security Company Red Herring icon-html F5 Friday Two Heads are Better Than One icon-html Challenging the Firewall Data Center Dogma icon-html F5 Friday Multi-Layer Security for Multi-Layer Attacks icon-html F5 Friday You ll Catch More Bees with Honey pots icon-html Defeating Attacks Easier Than Detecting Them pdf-icon 2011 Hactivism Report viddler Security is Our Job slideshare F5 Networks Hacktivism Focus Group Technorati Tags MacVittie,F5,F5 Friday,application security,HTTP,vulnerability,CSRF,XSS,web application firewall,security IMAGE http://www.secuobs.com/revue/news/290979.shtmlhttp://www.secuobs.com/revue/news/290979.shtml Secuobs.com : 2011-03-10 04:33:57 - Security - IMAGE Fully patched versions of Safari and Internet Explorer 8 were both successfully hacked today at pwn2own, the annual hacking competition held as part of the CanSecWest security conference If a researcher can pwn the browser that is, make it run arbitrary code then they get to own the hardware the browser runs on This year, not only did they have to run arbitrary code, they also had to escape any sandboxes restricted environments with reduced access to data and the operating system that are imposed First up, and first to fall, was fully-patched Safari on fully-patched Mac OS X 1066 French security firm VUPEN was first to attack the browser, and five seconds after the browser visited its specially-crafted malicious web page, it had both launched the platform calculator application a standard harmless payload to demonstrate that arbitrary code has been executed and wrote a file to the hard disk to demonstrate that the sandbox had been bypassed Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/290616.shtmlhttp://www.secuobs.com/revue/news/290616.shtml Secuobs.com : 2011-03-09 22:56:27 - Security - It's not often that I find a bug that affects multiple different codebases in the same way, but here is an interesting info-leak bug that is currently unpatched in Firefox, Internet Explorer and Safari I'm releasing it now for a few reasons 1 The bug was already publicly noted here 2 This bug cannot damage anyone in and of itself it's a low severity info-leak that does not corrupt anything It needs to be paired with other bugs, perhaps as an exploit aid against ASLR 3 This is a rare and unique opportunity to directly compare vendor responses and response times for a near-identical bug It's nice that this is a lower-severity issue as all vendors tend to treat critical issues with at least some urgency lower severity issues serve as a better differentiator The bug The bug is in the generate-id XPath function, and is sometimes used in XSL transforms Here's an web page that simply calls generate-id and renders the result as a web page https cevans-appappspotcom static genidxml Let's see how this renders in different browsers Firefox 64-bit Linux id0x00007fbac51c1000 There is no obfuscation that this is a raw heap address Since Firefox is open source, we can go and look at the source code to find that indeed, the string is generated from a pointer txXPathNodeUtils getXSLTId const char gPrintfFmt id0xpourcents016p Internet Explorer 8 Windows 7 IDAW0MLB Doesn't look like a heap address, does it If, however, you strip off the ID prefix and treat the string as a A-Z0-5 base32 encoded little endian string, you resolve to a nice heap address At that address is a pointer in msxmldll, possibly the address of a vtable for some internal xml node class Safari 5 Mac OS X id35865226 Also does not immediately look like a heap address, but libxslt is doing a simple transform on a heap address val unsigned long char cur - char 0 val sizeof xmlNode sprintf char str, idpourcentsld , val Opera o14022440 o2148150600 These object ids bounce around all over the place I don't know what is going on so I'm not making the claim that Opera is affected Chrome Latest stable Chrome Chrome 10 is not affected It has been removed from the time to fix competition in order to keep things fair It's on Who will fix it first and who will be the security laggard Updates to be provided via Twitter scarybeasts http://www.secuobs.com/revue/news/290559.shtmlhttp://www.secuobs.com/revue/news/290559.shtml Secuobs.com : 2011-03-09 16:09:55 - Security - IMAGE Google has issued a new stable release of the Chrome Web browser and is rolling it out to users The new version introduces some noteworthy JavaScript performance enhancements, new plug-in security features, improved support for synchronization, and a new user interface for managing the browser's settings Plug-ins have historically been a major attack vector for Internet malware particularly Adobe's Flash and Acrobat plug-ins, which are notoriously insecure Rather than seriously addressing the issue, Adobe has capitalized on the poor security of its own software by bundling unwanted McAfee crapware in Flash and Acrobat updates Chrome 10 introduces support for Flash sandboxing, which is now enabled by default on Windows Vista and Windows 7 The feature, which attempts to limit Flash's access to sensitive system functionality, is one of several key plug-in security features that Google has delivered since it started collaborating with Adobe almost a year ago Chrome 10 has also gained support for selective plug-in blocking and automatically blocking out-of-date plug-ins A new settings panel introduced in Chrome 10 offers a big usability boost Instead of displaying its settings in a native-looking dialog window, the browser now shows its settings in a regular tab with a more web-like presentation It's a cleaner and more intuitive layout that is also consistent across operating systems Google has continued to advance Chrome's sophisticated JavaScript engine The latest optimizations in Chrome 10 which incorporate Google's crankshaft technology reportedly produce a 66 percent improvement in the browser's score on Google's own benchmark This performance increase is largely confined to complex JavaScript use cases where there is a lot of repetitious activity under the hood Users can download Chrome 10 directly from Google's website The new version is already being rolled out to existing users through Chrome's update system Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/290450.shtmlhttp://www.secuobs.com/revue/news/290450.shtml Secuobs.com : 2011-03-09 06:07:38 - Security - I did a bunch of fairly interesting things with my corporate hat on today not to be confused with any of my personal research - Firstly, Chrome 10 went out with a record 16k series of rewards It's continually humbling to see such a wide range of researchers and a wide range of bug categories http googlechromereleasesblogspotcom 2011 03 chrome-stable-releasehtml Also, there are some nice new security pieces in Chrome 10 I blogged about some of these http blogchromiumorg 2011 03 mini-newsletter-from-your-google-chromehtml My personal favourite is plug-in blocking enhancements , probably because I implemented it and am therefore biased - In reality, the change that's going to really help end user security is out-of-date plug-in warnings Users are encouraged to update to the latest security patches for their plug-ins I personally believe this will be particularly helpful for Java, which is widely installed but users are not always the most uptodate And then I spoke at SANS AppSec with Adam Mein about Google's two vulnerability reward programs Chromium and Web This seemed to be very well received, as evidenced by the stack of insightful questions We released a few new stats and charts, so it's probably worth me linking to the slides https docsgooglecom present edit id 0Ae_usSLlqH60ZGZnYjI0NTVfMjBobngybWRoaA hl en All in all a fun day http://www.secuobs.com/revue/news/290358.shtmlhttp://www.secuobs.com/revue/news/290358.shtml Secuobs.com : 2011-03-08 03:05:06 - Security - IMAGE Hackers using spear-phishing techniques broke into the French Ministry of Economics, Finances, and Industry last year, compromising at least 150 machines and exfiltrating documents related to the G-20 organization, in an attack described as determined and organized The perpetrators of the attack are unknown, but investigators have discovered that information was sent to servers located in China The break-in was reported in Paris Match, and has since been confirmed by Minster of Budget François Baroin He also clarified that personal tax records were not accessed by the hack Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/290029.shtmlhttp://www.secuobs.com/revue/news/290029.shtml Secuobs.com : 2011-03-08 01:27:18 - Security - IMAGE Ask Ars was one of the first features of the newly born Ars Technica back in 1998 And now, as then, it's all about your questions and our community's answers Each week, we'll dig into our bag of questions, answer a few based on our own know-how, and then we'll turn to the community for your take To submit your own question, see our helpful tips page Question What are the best practices when using a password-keeping service, and what are the merits and disadvantages of local vs cloud-based password storage With every website requiring users to register a password-protected account to see its content, password management systems have become very popular We probably don't need to tell you that one of the most popular strategies for managing passwords using the same password for every account is a terrible thing to do Because of this, password-keeping programs have been making gains, but using one can be dangerous to your privacy if done incorrectly There are certain features and practices that will keep your logins more secure, so we'll go through a few different services and things you can do to crank up the security Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/290014.shtmlhttp://www.secuobs.com/revue/news/290014.shtml Secuobs.com : 2011-03-07 12:18:49 - Security - You re still asking the wrong questions about cloud computing Tweet cloud-connect The city of Santa Clara is covered by a cloud this week, but not the kind of clouds most folks associate with California CloudConnect 2011 is gearing up for a week of sessions and workshops, thought-provoking panels and general conversation on a topic that continues to be top of mind for everyone from press to analysts to IT professionals Everyone is going to be there Well, everyone but me Now you might think that s odd, that a co-chair of a track at a conference wouldn t attend the show My cohort in cloud crime, Randy Bias twitterbird , will be moderating many of the Private Cloud track panels and generally making sure that the track is as exciting, informative and educational as we hope it will be But I ll be in my home office, watching the chatter and sound-bites intently from the sidelines via Twitter and blogs I rarely wax too personal or complain because, well, I m from the mid-west We re stoics and pragmatists and it is what it is is not an uncommon mantra for us But it s pertinent in this case as it s ultimately the cause of my absence from the show and provides some insight into cloud computing and organizational approaches to leveraging the right cloud for the application WHAT CELIACS can TEACH US about CONTROL Nearly two years I ago I was diagnosed with Celiac s Disease There s a lot of misinformation and misunderstanding about Celiac s out there and even folks who have family members diagnosed often don t get the impact on your daily life, to say nothing about traveling and professional life Add in a healthy dose of the popularizing of a gluten-free diet as the new black of dietary health for very visible celebrities like Oprah and you have yourself a perfect storm of misconception regarding a disease that s most often described by experts as debilitating That s probably because most Celiac s are very thin, so it must be what they eat, right Unfortunately for everyone, it isn t the diet, that s malabsorption and malnutrition neither of which are really good things in the long run Talk to folks who frequent support forums for sufferers of Celiac s and you ll generally find a common theme regarding travel they ve given up We don t eat out at restaurants and we don t travel far from the safety net of our own homes That s because at home we have control not just over what we eat but our environment We have control over the process by which the food we eat is prepared and served and ultimately that s as important if not more so than what that food contains Every Celiac reacts differently to ingesting gluten Some experience no side-effects at all asymptomatic and others are wracked with so much pain and illness they end up in the hospital If you think about having a stomach flu for 2-3 weeks you wouldn t be far from how many Celiac s react to ingesting even microscopic amounts of gluten Yes, microscopic amounts Trust me, our Toddler is the cleanest three-year old in existence the dust from Captain Crunch Berries is full of gluten, after all, and three-year olds are not known for their proficiency with utensils or their proclivity to use them If you think about how that translates to eating out or on the run at a conference, you ll probably see that practice is a whole lot more difficult than the theory It s all about process in my house these days about following certain procedures to ensure that even minute traces of gluten do not come in contact with me, my food, or anything I might touch If you can imagine trying to enforce such processes and policies while traveling you ll probably see why so many Celiacs give up and cut travel from their lives So after more than a year of traveling to conferences and events and ending up sick I took a step back to try to figure out how I could manage the processes and procedures I need to enforce to stay healthy while traveling What I ve discovered is that as with cloud computing, control is not a synonym for do it yourself , it s about asking the right questions before you do anything else DO not CONFUSE CONTROL with DIY Like Celiac s, cloud computing is not just about the ingredients, it s about how they are put together the process and preparation Ultimately ensuring that a cloud computing initiative achieves the goals it was intended to for the organization require control That control is over the implementation and ultimately control over the deployment to ensure ongoing compliance with operational and organizational policies intended to ensure the efficiency, security and speedy delivery of applications critical to the business Which makes the standard question Which applications are right for the cloud the wrong question in the first place It s not just the applications you have to match to any given cloud implementation, it s the application ecosystem Dependencies on application and network infrastructure providing for the security, optimization or availability of the application must be considered when determining where to deploy an application internal, external, cloud, or traditional As part of the vendor machine I of course hope you want to replicate your infrastructure in the cloud, but in many cases today this is simply not realistic Either topological constraints or infrastructure integration issues will prevent such a deployment from happening What s important, overall, is to match the application s operational dependencies to services available in a cloud environment If that s by deploying virtual network appliances, great If it s leveraging services in the cloud, that s great too The point is that you can t simply look at the application, you have to examine its dependencies in the storage and application delivery network and replicate them, through service or solution, in the cloud environment or architecturally, but that s another discussion The question you should be asking about cloud are the same kinds of questions I have to ask a restaurant how are meals prepared and handled in the kitchen How are applications isolated to prevent collateral damage What optimization services are available Are WAN optimization services an option How does the cloud provider combat jitter How do you replicate application access control processes in the cloud environment What infrastructure services can I provision if not replicate in the cloud environment I ve recently eaten at a number of restaurants successfully ie without ending up sick for weeks The key was always asking the right questions asking about isolation techniques and shared services asking about the tools used and the processes in handling the food from preparation to delivery The key to successfully deploying an application in an external public cloud computing environment is no different The control you exercise is also in the decision making process in asking the right questions in the first place not necessarily commandeering the kitchen Don t think that sticking to private cloud computing alleviates the need to ask and answer those questions The control you exercise in your private cloud implementation is as vital to your long-term success as that of the control exercised over public cloud computing Just as I examine the ingredient list on every product I might eat even if it s labeled gluten-free so must you examine the infrastructure ingredients necessary for each application you want to deploy in a cloud environment The questions still need to be asked, because it isn t just a matter of virtualizing an application and sticking a self-service layer over it There are myriad network and application network components that make up an application and it those services that must also considered when posing the question Is this application right for the cloud whether private or public So like a Celiac, the health security, performance and availability of the applications you manage to support the business is ultimately up to you and you alone You need to take control of the processes and ensure that you re asking the right questions before deploying an application in any environment See, control isn t necessarily the same thing as do it yourself Public cloud computing can be the right answer but only if you ve asked the right questions in the first place celiacsprue --------------------------------------------------------------------- You can learn more about Celiac s Disease also commonly called Celiac Sprue by visiting the Celiac Sprue Association --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html Hybrid Cloud Fact, Fiction or Future icon-html Data Center Feng Shui Process Equally Important as Preparation icon-html The Gluten-free Application Network icon-html Knowing is Half the Battle icon-html Putting the Cloud Before the Horse icon-html If You Focus on Products You ll Miss the Cloud icon-html The Zero-Product Property of IT icon-html What is a Strategic Point of Control Anyway pdf-icon Why You Need a Cloud to Call your Own F5 White Paper slideshare The New Network Technorati Tags MacVittie,cloud computing,cloud connect,control,strategy,infrastructure as a service,application delivery,security,performance,availability,architecture IMAGE http://www.secuobs.com/revue/news/289821.shtmlhttp://www.secuobs.com/revue/news/289821.shtml Secuobs.com : 2011-03-06 09:40:17 - Security - This is fixed in the recently released Foxit PDF Reader v4310218 That release is marked as an important security update, although this file bug is not mentioned Recently, I've been playing around with the various JavaScript APIs available in various different PDF readers In case you wanted to do the same, I made some little tools, including a simple one to execute PDF-based JS via an URL https cevans-appappspotcom static pdfjshtml js appalert 'hi' The serious bug I found in Foxit PDF Reader permits arbitrary files to be written with arbitrary content, like this https cevans-appappspotcom static pdfjshtml js createDataObject 'c autoexecbat','echo hi mom' Files can be overwritten as well as created I did some hackery on the generated PDF and managed to squeeze a full valid PDF, including simple JS payload, into 136 characters This means I can tweet the full PoC PDF, which I will do shortly Here it is for completeness pourcentsPDF 1 0 obj 2 0 obj trailer http://www.secuobs.com/revue/news/289697.shtmlhttp://www.secuobs.com/revue/news/289697.shtml Secuobs.com : 2011-03-05 00:17:51 - Security - IMAGE As part of the iTunes 102 update released on Wednesday, Apple patched an unprecedented number of vulnerabilities in WebKit, the Web-rendering engine that powers Safari and the iTunes Store According to French security firm Vupen, Apple plans to add those patches to Safari 5 in an update set to be released before the Pwn2Own hacking competition at CanSecWest 2011 Still, security researcher Charlie Miller, known for pwning Safari for the last three years running, doesn't think a potential patch will present much of a challenge in his fourth attempt to crack Apple's browser In the security bulletin for iTunes 102, Apple made note of 50 separate vulnerabilities related to memory corruption issues Those issues could enable a man-in-the-middle attack while browsing the iTunes Store, which Apple noted could lead to unexpected application termination or arbitrary code execution Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/289556.shtmlhttp://www.secuobs.com/revue/news/289556.shtml Secuobs.com : 2011-03-04 19:20:08 - Security - IMAGE After a busy February, March is a fairly quiet month for Patch Tuesday patches Just three bulletins going out, two for Windows and one for Groove 2007 users Together, the bulletins close a total of four vulnerabilities One Windows bulletin is rated critical the Groove bulletin and the other Windows bulletin are ranked important Microsoft says that all three bulletins may require a restart Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/289509.shtmlhttp://www.secuobs.com/revue/news/289509.shtml Secuobs.com : 2011-03-03 21:36:38 - Security - IMAGE Ask Ars was one of the first features of the newly born Ars Technica back in 1998 And now, as then, it's all about your questions and our community's answers Each week, we'll dig into our bag of questions, answer a few based on our own know-how, and then we'll turn to the community for your take To submit your own question, see our helpful tips page How can I safely erase the data from my SSD drive I've seen a few pieces in recent days about how traditional secure delete programs fail to work properly on SSD drives, so what tools are available and useful As pointed out in a recent research article, there isn't a standard method for securely deleting data from a solid state drive Hard disk drives have had this problem solved for ages, and can execute a secure delete by filling the space occupied by an incriminating file with zeroes or multiple writes of different characters We'll go into why this approach and some other secure erase methods don't really work on an SSD, especially not for individual files, and then describe some approaches you might take to make sure all your old data is gone for good We did an Ask Ars not long ago concerning the way that SSDs handle deletion and cleanup of old files, and we'll assume you've read it or have equivalent knowledge Basically, the issue with SSDs is this let's say your SSD is a pirate, and your data is buried treasure If you tell an SSD pirate to make his buried treasure disappear, all he really does is burn the treasure map The buried treasure is still out there for someone to find if they know where to look This isn't the case for all SSDs in the long term, but it is the case for all of them in the short term Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/289224.shtmlhttp://www.secuobs.com/revue/news/289224.shtml Secuobs.com : 2011-03-03 02:08:50 - Security - IMAGE Google has removed 21 applications from the Android Market after it was discovered that the apps secretly installed malware The applications themselves included pirated and renamed versions of legitimate Android software that had been modified to include the malware and then offered for free on the Market Together, the 21 programs received more than 50,000 downloads over the course of about four days The malicious applications sent personal details, including the phone's unique IMEI number, to a US-based server Worse, it exploited security flaws to root the phone, and installed a backdoor application that allows further software to be installed to the handsets Though Google has now purged the applications from the Market, the rooting and backdoor mean that the anyone who has run one of the malicious programs should reset their phone to stock conditions to clean it up The flaw used to root the operating system was fixed in Android 222 and 23, so users of those versions should be able to get away with simply removing the applications The programs were all re published by an entity named Myournet it too has now been removed from the Market Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/289016.shtmlhttp://www.secuobs.com/revue/news/289016.shtml Secuobs.com : 2011-03-02 11:58:56 - Security - We need to remember that operations isn t just about deploying applications, it s about deploying applications within a much larger, interdependent ecosystem One of the key focuses of devops that hardy movement that seeks to bridge the gap between development and operations is on deployment Repeatable deployment of applications, in particular, as a means to reduce the time and effort that goes into the deployment of applications into a production environment But the focus is primarily on the automation of application deployment on repeatable configuration of application infrastructure such that it reduces time, effort, and human error Consider a recent edition of The Crossroads, in which CM Crossroads Editor-in-Chief Bob Aiello and Sasha Gilenson, CEO Co-founder of Evolven Software, discuss the challenges of implementing and supporting automated application deployment quote-badge So, as you have mentioned, the challenge is that you have so many technologies and have so many moving pieces that are inter-dependant and today - each of the pieces come with a lot of configuration To give you a specific example, you know, the WebSphere application and service, which is frequently used in the financial industry, comes with something like, 16,000 configuration parameters You know Oracle, has 100s and 100s, , about 1200 parameters, only at the level of database server configuration So, what happens is that there is a lot of information that you still need to collect, you need to centralize it -- Sasha Gilenson, CEO and Co-founder of Evolven Software The focus is overwhelmingly on automated application deployment That s a good thing, don t get me wrong, but there is more to deploying an application Today there is still little focus beyond the traditional applicationimage infrastructure components If you peruse some of the blogs and articles written on the subject by forerunners of the devops movement, you ll find that most of the focus remains on automating application deployment as it relates to the application tiers within a data center architecture There s little movement beyond that to include other data center infrastructure that must be integrated and configured to support the successful delivery of applications to its ultimate end-users That missing piece of the devops puzzle is an important one, as the operational efficiencies sought by enterprises by leveraging cloud computing , virtualization and dynamic infrastructure in general is, in part, the ability to automate and integrate that infrastructure into a more holistic operational strategy that addresses all three core components of operational risk security, availability and performance It is at the network and application network infrastructure layers where we see a growing divide between supply and demand On the demand side we see increases for network and application network resources such as IP addresses, delivery and optimization services, firewall and related security services On the supply side we see a fairly static level of resources people and budgets that simply cannot keep up with the increasing demand for services and services management necessary to sustain the growth of application services INFRASTRUCTURE AUTOMATION One of the key benefits that can be realized in a data center evolution from today to tomorrow s dynamic models is operational efficiency But that efficiency can only be achieved by incorporating all the pieces of the puzzle That means expanding the view of devops from the application deployment-centric view of today into the broader, supporting network and application network domain It is in understanding the inter-dependencies and collaborative relationships of the delivery process that is necessary to fully realize on the efficiency gains proposed to be the real benefit of highly-virtualized and private cloud architectural models This is actually more key than you might think as automating the configuration of say, WebSphere, in an isolated application-tier-only operational model may be negatively impacted in later processes when infrastructure is configured to support the deployment Understanding the production monitoring and routing switching polices of delivery infrastructure such as load balancers, firewalls, identity and access management and application delivery controllers is critical to ensure that the proper resources and services are configured on the web and application servers Operations-focused professionals aren t off the hook, either, as understanding the application from a resource consumption and performance point of view will greatly forward the ability to create and subsequently implement the proper algorithms and policies in the infrastructure necessary to scale efficiently Consider the number of touch points in the network and application network infrastructure that must be updated and or configured to support an application deployment into a production environment FirewallsOverwhelmed-by-To-Dos Load balancers application delivery controller Health monitoring load balancing algorithm Failover Scheduled maintenance window rotations Application routing switching Resource obfuscation Network routing Network layer security Application layer security Proxy-based policies Logging Identity and access management Access to applications by user device location combinations of the above Auditing and logging on all devices Routing tables where applicable on all devices VLAN configuration security on all applicable devices The list could go on much further, depending on the breadth and depth of infrastructure support in any given data center It s not a simple process at all, and the checklist for a deployment on the operational side of the table is as lengthy and complex as it is on the development side That s especially true in a dynamic or hybrid environment, where resources requiring integration may themselves be virtualized and or dynamic While the number of parameters needing configuration of a database, as mentioned by Sasha above is indeed staggering, so too are the parameters and policies needing configuration in the network and application network infrastructure Without a holistic view of applications as just one part of the entire infrastructure, configurations may need to be unnecessarily changed during infrastructure service provisioning and infrastructure policies may not be appropriate to support the business and operational goals specific to the application being deployed DEVOPS or OPSDEV devops missing Early on Alistair Croll twitterbird coined the concept of managing applications in conjunction with its supporting infrastructure web ops That term and concept eventually morphed into devops and been adopted by many of the operational admins who must manage application deployments But it is becoming focused on supporting application lifecycles through ops with very little attention being paid to the other side of the coin, which is ops using dev to support infrastructure lifecycles In other words, the gap that drove the concept of automation and provisioning and integration across the infrastructure, across the network and application network infrastructure, still exists What we re doing, perhaps unconsciously, is simply enabling us to build the same silos that existed before a whole lot faster and more efficiently The application is still woefully ignorant of the network, and vice-versa And yet a highly-virtualized, scalable architecture must necessarily include what are traditionally network-hosted services load balancing, application switching, and even application access management This is because at some point in the lifecycle both the ability to perform and economy of scale of integrating web and application services with its requisite delivery infrastructure becomes an impediment to the process if accomplished manually quote-badge By 2015, tools and automation will eliminate 25 percent of labor hours associated with IT services As the IT services industry matures, it will increasingly mirror other industries, such as manufacturing, in transforming from a craftsmanship to a more industrialized model Cloud computing will hasten the use of tools and automation in IT services as the new paradigm brings with it self-service, automated provisioning and metering, etc, to deliver industrialized services with the potential to transform the industry from a high-touch custom environment to one characterized by automated delivery of IT services Productivity levels for service providers will increase, leading to reductions in their costs of delivery -- Gartner Reveals Top Predictions for IT Organizations and Users for 2011 and Beyond Provisioning and metering must include more than just the applications and its immediate infrastructure it must reach outside its traditional demesne and take hold of the network and application network infrastructure simply to sustain the savings achieved by automating much of the application lifecycle The interdependence that exists between applications and the network must not only be recognized, but explored and better understood such that additional efficiencies in delivery can be achieved by applying devops to core data center infrastructure Other we risk building even taller silos in the data center, and what s worse is we ll be building them even faster and more efficiently than before --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html Operational Risk Comprises More Than Just Security icon-html Infrastructure 20 Cloud IT as a Service An Architectural Parfait icon-html Cloud Chemistry 101 icon-html Infrastructure 20 Isn t Just For Cloud Computing icon-html Infrastructure 20 Is the Beginning of the Story, Not the End icon-html Will DevOps Fork icon-html The Zero-Product Property of IT icon-html Don t Conflate Virtual with Dynamic icon-html Aligning IT with the Business by Decreasing Efficiency slideshare The New Network Technorati Tags MacVittie,devops,cloud computing,infrastructure 20,dynamic infrastructure,strategic point of control,development,architecture,automation,virtualization IMAGE http://www.secuobs.com/revue/news/288789.shtmlhttp://www.secuobs.com/revue/news/288789.shtml Secuobs.com : 2011-02-28 11:55:09 - Security - The claim a company is not a true security company because they don t focus solely on security products is a red herring image If I ask you to define a true security company, you might tend to fall back on the most obvious answer, Well, it s a company that focuses on security And then I would ask, Security of what And then you might answer, Well, of whatever it is the product secures, of course Of course What it boils down to is that the most common definition of a security company is one that focuses solely on providing solutions designed to secure X X may be the network, or an application, or the database, or storage The key isn t really what, but the implied focus only on a security product Period The assumption appearing to be that singularity of purpose is able to achieve higher quality All the folks at a security company are necessarily focused on security, right Which has got to be better than, say, only some of them Hogwash This is nothing less than a red herring a rhetorical or literary tactic of diverting attention away from an item of significance When used in technology it s generally an attempt to move the discussion away from a particular product or solution to the company, instead As if a company that offers other solutions can t offer a quality security product because, well, it s not a security company It s the same argument businesses used to use against IT spending they weren t in the business of IT, they said Except that they were by virtue of their growing interdependence on one another The same is true in the realm of technology Every company is or ultimately should be a security company The interdependence between any product that touches data and systems and security cannot and should not be a line in the sand It should, as is the case with operational risk, be a part of the overall strategy Security is people, it s processes, and it s technology Like the three strands that comprise operational risk, there are three distinct strands that make a company a security company people, process, and technology It s not about number of people dedicated to security, or the overall focus of the organization, or even the technology they produce It s a unique blend of all three that come together to create a solution that s capable of offering organizations the means by which they can address operational risk Lest I be accused of dissembling, let s dig a bit deeper into the definition of a security company , shall we THE NUMBERS GAME Can we base the definition on the number of folks dedicated to developing and supporting security solutions Not really Niche vendors, those who focus on one specific aspect of security, such as a web application firewall, generally have fewer resources available to dedicate to their solutions In some cases the niche vendor may have more employees, but not all are necessarily dedicated to security many are focused on packaging and deployment and management and APIs and, well, all the other features and functionality that is required of an enterprise-class infrastructure component today Playing the numbers game can actually backfire on a niche-vendor, as larger organizations have the resources to allow their security-focused employees to focus on security Organizations big and small - can also fudge the numbers Security is supposed to be the concern of every developer and architect, after all, so aren t they dedicated to security Surely they can be counted in the employee count game Obviously number of employees dedicated to security is not a good basis for such a definition, so perhaps we can base the definition on the number of security-related products the organization offers Or the number of customers specifically for those products Or the number of awards Or the number of you get the point, I m sure The numbers game is not a good one because numbers can be fudged and even when they aren t, numbers say nothing about the quality of the people, processes, or technology in use And it s never been about numbers in technology anyway, because throwing more people at a problem has never been recognized as a workable solution THE FOCUS GAME Another means of deciding whether a company is a security company or not is to focus on focus This is basically a rehash of the old jack of all trades, master of none argument that claims if you provide more than just security solutions, you obviously aren t a security company Especially if you didn t start with security and branch out from there This is red herring, designed to draw attention away from features and functionality and onto the people developing them Implicit in the claim is the assumption that all developers, architects, and engineers are dedicated to all solutions, and none are focused on security It s an insult to the folks who work on security in any organization that offers solutions across a broad range of enterprise concerns because it implies that they aren t as dedicated or focused on security as their counterparts employed by security-only solution organizations Which is generally simply not true It s a shell game, an attempt to refocus the attention on everything but security SECURITY IS NOT A PRODUCT Security is not a product, it never has been You can t buy security in a box, you can only buy and deploy solutions that address security and other operational risks that enable the implementation and enforcement of security policies designed to mitigate risk Security is processes, it s policies, and it s only partially out of the box The rest is completely about enabling the codification and subsequent enforcement of policies Security is a strategy, a means to protecting what s valuable to the business data Security is about determining every point along a data path where the security of that data might be compromised, and addressing it either through policy, process or product Sometimes all three Security isn t found in any single product, it can only be found in an architecture designed with the need to secure data and systems from the very beginning Security should be an integral part of every project from server virtualization to the network to the applications From secure remote access to integration From layer two through layer 7 Security isn t a thing , it s not tangible It s the ability to align a data center architecture with business and operational goals Security isn t a product and it certainly shouldn t be an afterthought It s part and parcel of what IT does and permeates every tier in the datacenter and it should be part and parcel for vendors, regardless of what product it is they develop Being a security company is a misnomer Most organizations making that claim are narrowly focused on one particular aspect of security such as application or network or storage A security company takes security into consideration at every layer of the stack at which they touch the data, the network, and the applications regardless of what product they ultimately produce If you focus on application security, that does not obviate your responsibility to the other layers of the stack upon which your solution is deployed Sure, you can stop the application-focused attack, but what about the network focused attack coming in ahead of it or behind it If the network attack takes your application security solution out of commission, then who s left holding the bag F5 can t sell you security Neither can any other vendor because it s not something that can be bought and sold F5 provides products, solutions, and even architectural advice that enable organizations to secure data center resources that allow the codification and enforcement of policies regarding access and delivery of data center resources that provide the means by which risk can be mitigated But it can t sell you security and neither can anyone else There is no such thing as a security company There are companies that sell security products and services and even security guards and security systems But you can t buy or sell security any more than you can buy or sell unicorns Yes, I m aware that you can buy CANNED Unicorn Meat from ThinkGeek But you can t buy a whole Unicorn, can you --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html Operational Risk Comprises More Than Just Security icon-html Challenging the Firewall Data Center Dogma icon-html More Users, More Access, More Clients, Less Control icon-html Attacks Cannot Be Prevented icon-html F5 Friday Multi-Layer Security for Multi-Layer Attacks icon-html The Many Faces of DDoS Variations on a Theme or Two icon-html What We Learned from Anonymous DDoS is now 3DoS icon-html There Is No Such Thing as Cloud Security icon-html The Impact of Security on Infrastructure Integration icon-html Authorization is the New Black for Infosec Technorati Tags MacVittie,F5,security,web application security,architecture,infrastructure 20,strategic point of control IMAGE http://www.secuobs.com/revue/news/288155.shtmlhttp://www.secuobs.com/revue/news/288155.shtml Secuobs.com : 2011-02-25 04:45:30 - Security - The story of Chromium security bug 48733, with guest Cris Neckar, part I It has been a long time now, but the story of Chromium security bug 48733 deserves to be told It involves intrigue in glibc and even gcc and notably I accidentally executed arbitrary code whilst playing with this bug The bug was reported in July 2010, and there were instantly some WTF aspects It caused a full browser crash on Linux, and the trigger seemed to be a long string Such a case would tend to suggest a buffer overflow but these are very unusual in Chromium code Upon further investigation, the crash was occurring in the glibc function fnmatch int fnmatch const char pattern, const char string, int flags And what was very strange was the trigger was not the pattern which is a complicated string format , but simply the string itself Further investigation narrowed the problem down to any long-ish few megabytes string, if the locale was set to UTF8 A simple C test program is included at the end of the post And here comes the killer I was playing around and ran the program like this on my 32-bit Ubuntu 904 machine aout 1073741796 And accidentally achieved arbitrary code execution The A characters making up the large input string actually correspond to the instruction inc pourcentsecx so I wound up executing a bunch of those So what was going on Probably best to tackle the list of interesting points in bullet form glibc had a bug where it would use alloca for the length of a user-supplied UTF8 string, times four with additional integer overflow in the times four This is good for at least a crash, because alloca extends the stack, which is typically limited to a few MB It seems uncommon for Linux distributions to compile packages with gcc flags that defend against stack extension attacks -- more about that in part II 32-bit Ubuntu releases used to lack DEP Perhaps they still do This permits the execution of code contained within heap chunks, and is key to the accidental code execution achieved But how did EIP get redirected The number passed to aout above is a bit magic glibc multiplies it by 4 sizeof wchar_t before passing it to alloca , which ends up with the value 2 32 - 112 This wraps the stack pointer, causing an effective decrease in the stack of 112 bytes The decrease in stack size leads to all sorts of havoc we're not sure, but most likely a local variable in a subfunction of the function that called alloca , pointing to the incoming heap string -- got plonked on top a saved EIP I no longer have the old version of Ubuntu to test with, and more recent glibcs are fixed, so I can't confirm Note that stack extension bugs like this often sidestep a lot of system defenses, such as stack canaries which are left undamaged and ASLR a valid address is automatically filled in It's another case where Ubuntu could really have used DEP see my older Firefox exploit for further proof How does part I end Of course, we reported the bug upstream to glibc http sourcewareorg bugzilla show_bugcgi id 11883 The somewhat terse response notes that the issue was fixed but not in which version Because of this, no glibc security advisories were released so apologies if your older but still supported Linux distribution might still have vulnerabilities in this area Although certainly not a bug in Chromium, we still paid the bug finder 1337 under the Chromium Security Reward program We did this partly just because we can, and we love encouraging all security research But also, we were able to work around this glibc bug in Chromium fairly trivially -- so we did so in short order As can be seen from the Chromium bug, we had all users protected in under 20 days from the original report, despite it not being our fault include include include include include int main int argc, const char argv size_t num_as char p setlocale LC_ALL, en_USUTF8 if argc 2 errx 1, Missing argument num_as atoi argv 1 if num_as 5 errx 1, Need 5 p malloc num_as if p errx 1, malloc failed memset p, 'A', num_as p num_as - 1 ' 0' p 0 'f' p 1 'o' p 2 'o' p 3 '' fnmatch anim 1-9j , p, 0 return 0 http://www.secuobs.com/revue/news/287601.shtmlhttp://www.secuobs.com/revue/news/287601.shtml Secuobs.com : 2011-02-21 14:15:41 - Security - Recognizing the relationship between and subsequently addressing the three core operational risks in the data center will result in a stronger operational posture Risk is not a synonym for lack of security Neither is managing risk a euphemism for information security Risk especially operational risk compromises a lot more than just security image In operational terms, the chance of loss is not just about data information, but of availability Of performance Of customer perception Of critical business functions Of productivity Operational risk is not just about security, it s about the potential damage incurred by a loss of availability or performance as measured by the business Downtime costs the business both hard and soft costs are associated with downtime and the numbers can be staggering depending on the particular vertical industry in which a business may operate But in all cases, regardless of industry, the end-result is the same downtime and poor performance are risks that directly impact the bottom line Operational risk comprises concerns regarding image Performance Availability reliability Security These three concerns are intimately bound up in one another For example, a denial of service attack left unaddressed and able to penetrate to the database tier in the data center can degrade performance which may impact availability whether by directly causing an outage or through deterioration of performance such that systems are no longer able to meet service level agreements mandating specific response times The danger in assuming operational risk is all about security is that it leads to a tunnel-vision view through which other factors that directly impact operational reliability may be obscured The notion of operational risk is most often discussed as it relates to cloud computing , but it is only that cloud computing raises the components of operational risk to a visible level that puts the two hand-in-hand CONSISTENT REPETITION of SUCCESSFUL DEPLOYMENTS When we talk about repeatable deployment processes and devops, it s not the application deployment itself that we necessarily seek to make repeatable although in cases where scaling processes may be automated that certainly aids in operational efficiency and addresses all facets of operational risk It s the processes the configuration and policy deployment involving the underlying network and application network infrastructure that we seek to make repeatable, to avoid the inevitable introduction of errors and subsequently downtime due to human error This is not to say that security is not part of that repeatable process because it is It s to say that it is only one piece of a much larger set of processes that must be orchestrated in such a way as to provide for consistent repetition of successful deployments that alleviates operational risk associated with the deployment of applications quote-badge Human error by contractor Northrop Grumman Corp was to blame for a computer system crash that idled many state government agencies for days in August, according to an external audit completed at Gov Bob McDonnell's request The audit, by technology consulting firm Agilysis and released Tuesday, found that Northrop Grumman had not planned for an event such as the failure of a memory board, aggravating the failure It also found that the data loss and the delay in restoration resulted from a failure to follow industry best practices At least two dozen agencies were affected by the late-August statewide crash of the Virginia Information Technologies Agency The crash paralyzed the departments of Taxation and Motor Vehicles, leaving people unable to renew drivers licenses The disruption also affected 13 percent of Virginia's executive branch file servers -- Audit Contractor, Human Error Caused Va Outage ABC News, February 2011 There are myriad points along the application deployment path at which an error might be introduced Failure to add the application node to the appropriate load balancing pool failure to properly monitor the application for health and performance failure to apply the appropriate security and or network routing policies A misstep or misconfiguration at any point in this process can result in downtime or poor performance, both of which are also operational risks Virtualization and cloud computing can imagecomplexify this process by adding another layer of configuration and policies that need to be addressed, but even without these technologies the risk remains There are two sides to operational efficiency the deployment configuration side and the run-time side During deployment it is configuration and integration that is the focus of efforts to improve efficiency Leveraging devops and automation as a means to create a repeatable infrastructure deployment process is critical to achieving operational efficiency during deployment Achieving run-time operational efficiency often utilizes a subset of operational deployment processes, addressing the critical need to dynamically modify security policies and resource availability based on demand Many of the same processes that enable a successful deployment can be and should be reused as a means to address changes in demand Successfully leveraging repeatable sub-processes at run-time, dynamically, requires that operational folks devops takes a development-oriented approach to abstracting processes into discrete, repeatable functions It requires recognition that some portions of the process are repeated both at deployment and run-time and then specifically ensuring that the sub-process is able to execute on its own such that it can be invoked as a separate, stand-alone process This efficiency allows IT to address operational risks associated with performance and availability by allowing IT to react more quickly to changes in demand that may impact performance or availability as well as failures internal to the architecture that may otherwise cause outages or poor performance which, in business stakeholder speak, can be interpreted as downtime RISK FACTOR Repeatable deployment processes address operational risk by reducing possibility of downtime due to human error ADAPTION within CONTEXT Performance and availability are operational concerns and failure to sustain acceptable levels of either incur real business loss in the form of lost productivity or in the case of transactional-oriented applications, revenue These operational risks are often addressed on a per-incident basis, with reactive solutions rather than proactive policies and processes A proactive approach combines repeatable deployment processes to enable appropriate auto-scaling policies to combat the flash crowd syndrome that so often overwhelms unprepared sites along with a dynamic application delivery infrastructure capable of automatically adjusting delivery policies based on context to maintain consistent performance levels quote-badge Downtime and slowdown can and will happen to all websites However, sometimes the timing can be very bad, and a flower website having problems during business hours on Valentine s Day, or even the days leading up to Valentine s Day, is a prime example of bad timing In most cases this could likely have been avoided if the websites had been better prepared to handle the additional traffic Instead, some of these sites have ended up losing sales and goodwill slow websites tend to be quite a frustrating experience -- Flower sites hit hard by Valentine s Day At run-time this includes not only auto-scaling, but appropriate load balancing and application request routing algorithms that leverage intelligent and context-aware health-monitoring implementations that enable a balance between availability and performance to be struck This balance results in consistent performance and the maintaining of availability even as new resources are added and removed from the available pool from which responses are served Whether these additional resources are culled from a cloud computing provider or an internal array of virtualized applications is not important what is important is that the resources can be added and removed dynamically, on-demand, and their health monitored during usage to ensure the proper operational balance between performance and availability By leveraging a context-aware application delivery infrastructure, organizations can address the operational risk of degrading performance or outright downtime by codifying operational policies that allow components to determine how to apply network and protocol-layer optimizations to meet expected operational goals A proactive approach has side effect benefits of shifting the burden of policy management from people to technology, resulting in a more efficient operational posture RISK FACTOR Dynamically applying policies and making request routing decisions based on context addresses operational risk by improving performance and assuring availability Operational risk comprises much more than simply security and it s important to remember that because all three primary components of operational risk performance, availability and security are very much bound up and tied together, like the three strands that come together to form a braid And for the same reasons a braid is stronger than its composite strands, an operational strategy that addresses all three factors will be far superior to one in which each individual concern is treated as a stand-alone issue --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html It s Called Cloud Computing not Cheap Computing icon-html Challenging the Firewall Data Center Dogma icon-html There Is No Such Thing as Cloud Security icon-html The Inevitable Eventual Consistency of Cloud Computing icon-html The Great Client-Server Architecture Myth icon-html IDC Survey Risk In The Cloud icon-html Risk is not a Synonym for Lack of Security icon-html When Everything is a Threat Nothing is a Threat icon-html The Corollary to Hoff s Law Technorati Tags MacVittie,F5,performance,security,availability,cloud computing,context-aware,strategy,devops IMAGE http://www.secuobs.com/revue/news/286603.shtmlhttp://www.secuobs.com/revue/news/286603.shtml Secuobs.com : 2011-02-18 13:56:03 - Security - Detecting attacks is good, being able to do something about it is better F5 and Oracle take their collaborative relationship even further into the data center, integrating web application and database firewall solutions to improve protection against web and database-focused attacks f5friday It is often the case that organizations heavily invested in security solutions designed to protect critical application infrastructure, such as the database, are unwilling to replace those solutions in favor of yet another solution This is not necessarily a matter of functionality or trust, but a decision based on reliance on existing auditing and management solutions that are a part of the existing deployment More information is good, but not if it simply becomes an entry in a log somewhere that is disconnected and not integrated into existing operational security processes Organizations already heavily invested in Oracle technologies are likely to consider deploying the Oracle Database Firewall to protect their critical business information residing in their Oracle database As enterprise customers deploy more web-based database applications, IT continues to face the challenge of securing both application and database environments from threats such as SQL injection and cross-site scripting attacks By using F5 and Oracle solutions together, customers can now benefit from enhanced protection for web-based database applications without unnecessarily increasing the auditing burden imposed by additional logging quote-badge 70pourcents of the top 100 most popular Web sites either hosted malicious content or contained a masked redirect to lure unsuspecting victims from legitimate sites to malicious sites Websense, 2009 -- WhiteHat F5, Strategically Blocking Cross-Site Scripting and SQL Injection Attacks pdf-icon This collaborative solution pairs F5 BIG-IP Application Security Manager ASM and Oracle Database Firewall to provide comprehensive database security from the application layer down to the database Oracle Database Firewall monitors traffic between applications and the database to detect and prevent SQL injection, privilege or role escalation attacks, and others Because its target is the database, it uses an innovative SQL grammar analysis approach that is highly accurate and scalable Unlike web application firewalls, it analyzes the intent of the SQL statements sent to the database It is not dependent on recognizing the syntax of known security threats, and can therefore block previously unseen attacks, including those targeted against an organization ASM, on oracle bigip db securitythe other hand, focuses on the detection and prevention of attacks at the application layer including SQL injection and through integration with Oracle Database Firewall ASM can notify the database firewall of the incoming threat Such notification includes the context of the request including user identity, session, IP address and time that is subsequently logged and acted upon according to Oracle Database Firewall policies, enabling a more comprehensive report of attacks Because this integration allows operators and administrators to correlate attacks with users, it can better enable the identification of attacks originating from inside the organization such as from compromised desktops or servers which can then be leveraged as a means to eradicate potential internal attack vectors such as bots and other trojans proliferating of late throughout the enterprise That s important, because a study conducted last year by Microsoft found that over 22 million PCs in the US were part of botnets, and that the US is the number one country consumed with botnet PCs With so many potential avenues of attack both internal and external to the organization, there simply can t be something as too much protection This F5 component of the solution is included with BIG-IP Application Security Manager at no additional fee Customers can contact their Oracle representative for pricing on Oracle Database Firewall For more information on Oracle Database Firewall, please visit wwworaclecom technetwork database database-firewall indexhtml --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 rss 8 AddThis Feed Button Bookmark and Share Related Resources pdf-icon Protect Web Applications and Data with F5 and Oracle Solution Overview slideshare F5 Adds Solutions for Oracle Database Presentation f5-red-125 F5 Solutions for Oracle Database Deployments MembersIcon2 F5 DevCentral Oracle F5 Group Forum icon-html F5 Friday BIG-IP WOM With Oracle Products icon-html F5 Friday THE Database Gets Some Love youtube F5 Access Policy Manager Oracle Access Manager Integration Part 1 icon-html Oracle Data Guard sync over the WAN with F5 BIG-IP icon-html F5 Friday Application Access Control - Code, Agent, or Proxy icon-html All F5 Friday Posts on DevCentral Technorati Tags MacVittieF5F5 FridayOracleOracle Database FirewallASMWAFweb application firewallsecurityapplication securitydatabase securityinfrastructure 20 IMAGE http://www.secuobs.com/revue/news/286202.shtmlhttp://www.secuobs.com/revue/news/286202.shtml Secuobs.com : 2011-02-16 15:45:54 - Security - HSTS, standing for HTTP Strict Transport Security, is a relatively new standard that aims to bolster the strength of HTTPS connections Hopefully it's about to catch on Google Chrome has supported HSTS for a while now, and Firefox support is imminent The stated benefits of HSTS include Defenses against sslstrip-like attacks The initial navigation to blahcom is automatically upgraded to HTTPS Zero tolerance for certification problems The user is not permitted to click through anything such as a self-signed cert HSTS also comes with some less obvious benefits and security boosts, which it's worth noting Mixed-content defense For same domain mixed-content situations, the fetches are automatically upgraded to HTTPS This can sometimes sidestep nasty bugs Secure cookie defense It's a pretty egregious bug for an HTTPS-only site to fail to mark its cookies Secure , but HSTS can defend against the cookie value being sent out plaintext Cookie forcing defense Cookie forcing is a pretty nasty MITM attack that I was playing with back in 2008 As long as HSTS is used in includeSubDomains mode, it can provide a defense against this subtle attack Latency win User who navigate to or bookmark the plain HTTP blahcom are automatically bounced straight to HTTPS, without having to go via an HTTP redirect In the future, I'm hopeful HSTS can be extended to provide defenses against possibly rogue CAs http://www.secuobs.com/revue/news/285669.shtmlhttp://www.secuobs.com/revue/news/285669.shtml Secuobs.com : 2011-02-16 13:51:29 - Security - Do you really need a firewall to secure web and application services Some organizations would say no based on their experiences while others are sure to quail at the very thought of such an unnatural suggestion datacenterdogma Firewalls are, in most organizations, the first line of defense for web and application services This is true whether those services are offered to the public or only to off-site employees via secure remote access The firewall is, and has been, the primary foundation around which most network security architectures are built We ve spent years designing highly-available, redundant architectures that include the firewall We ve deployed them not only at the edge but moved them further and further into the data center in architectures that have commonly become known as firewall sandwiches The reasons for this are simple we want to protect those services that are critical to the business and the primary means by which we accomplish that task is by controlling access to them via often simple but powerful access control In later years we ve come to rely upon additional intrusion detection systems such as IPS Intrusion Prevention Systems that are focused on sniffing out sometimes literally malicious attacks and attempts to circumvent security policies and stop them One of the core attacks against which such solutions protect services is a denial of service Unfortunately, it is increasingly reality that the firewall is neither able to detect or withstand such attacks and ultimately such devices fail often at a critical moment The question then is what to do about it The answer may be to simply remove the firewall from the critical data path for web services p THAT S UNNATURAL Just about anything is unnatural the first time you try it, but that doesn t mean it isn t going to work or that it s necessarily wrong One of my favorite fantasy series David Eddings Belgariad illustrates this concept quite nicely A couple of armies need to move their ships up an escarpment to cross a particular piece of land to get where they need to be Now usually fording historically involves manhandling ships across land This is hard and takes a lot of time No one looked forward to this process In the story, someone is wise enough to put these extremely large ships on wheels and then leverage the power of entire herds of horses to move them over the land, thus improving performance of the process and saving a whole lot of resources One of the kings is not all that sure he likes violating a precept that has always been akin to dogma you ford ships by hand quote-badge enchanters end game King Rhodar put on a perfectly straight face I ll be the first to admit that it s probably not nearly as good as moving them by hand, Anheg I m sure there are some rather profound philosophical reasons for all that sweating and grunting and cursing, but it is faster, wouldn t you say And we really ought to move right along with this It s unnatural, Anheg growled, still glaring at the two ships, which were already several hundred yards away Rhodar shrugged Anything s unnatural the first time you try it -- Enchanter s End Game , David Eddings p 147 Needless to say King Anheg eventually gave in and allowed his ships to be moved in this new, unnatural way, finding it to be more efficient and faster and ultimately it kept his men from rebelling against him for making them work so hard This same lesson can be applied to removing the firewall from the critical inbound data path of services Sure, it sounds unnatural and perhaps it is if it s the first time you re trying it, but necessity is the mother of invention and seems to also help overcome the feeling that something shouldn t be done because it hasn t been done before If you need convincing as to why you might consider such a tactic, consider a recent survey conducted by Arbor Networks showing an increasing failure rate of firewalls and IPS solutions due to attacks Eighty-six percent of respondents indicated that they or their customers have placed stateful firewall and or IPS devices in their IDCs Nearly half of all respondents a solid majority of those who actually have deployed these devices within their IDCs experienced stateful firewall and or IPS failure as a direct result of DDoS attacks during the survey period Only 14 percent indicated that they follow the IDC BCP of enforcing access policy via stateless ACLs deployed on hardware-based routers Layer 3 switches capable of handling millions of packets per second emphasis added -- Network Infrastructure Security Report Volume VI, Arbor Networks, Feb 1 2011 That is a lot of failures, especially given that firewalls are a critical data center component and are almost certainly in the path of a business critical web or application service But it s dogma you simply must have a firewall in front of these services Or do you BASIC FIREWALLING ISN T ENOUGH The reality is that you need firewall functionality services - but you also need a lot more You need to control access to services at the network layers but you also need to clip_image002mitigate access and attacks occurring at the application layers That means packet-based firewalls even with their deep packet inspection capabilities are not necessarily up to the task of protecting the services they re supposed to be protecting The Anonymous attacks taught us that attacks are now not only distributed from a client perspective, they re also distributed from a service perspective attacking not only the network but the application layers That means every device between clients and servers must be capable of handling not only the increase in traffic but somehow detecting and preventing those attacks from successfully achieving their goal denial of service During the anonymous attacks, discussions regarding what to do about traffic overwhelming firewalls resulted in what might be considered an unnatural solution removal of the firewall That s because the firewall was actually part of the problem, not the solution, and removing it from the inbound data path resulted in a more streamlined and efficient route that enabled continuous availability of services despite ongoing attacks without compromising security Yes, you heard that right Some organizations are running sans firewall and finding that for inbound web services, at least, the streamlined path is maintaining a positive security posture while ensuring availability and performance That doesn t mean they are operating without those security services in place, it just means they ve found that other components in the inbound data path are capable of providing those basic firewalling services without negatively impacting availability ATTACKS AREN T the ONLY PROBLEM It isn t just attacks that are going to pose problems in the near future for firewalls and IPS components The increase in attacks and attack surfaces are alarming, yes, but it s that combined with an increase in traffic in general that s pushing load on all data center components off the charts Cisco recently shared the results of its latest Visual Networking Index Forecast quote-badge By 2015, Cisco says that mobile data traffic will grow to 63 exabytes of data or about 1 billion gigabytes of data per month The report indicates that two-thirds of the mobile data traffic on carrier networks in 2015 will come from video services This trend follows a similar trend in traditional broadband traffic growth Read more http newscnetcom 8301-30686_3-20030291-266html ixzz1CtYWZPAk Cisco s report is obviously focused on service providers as they will bear the brunt of the increase in traffic and in many cases they bear the majority of the impact from denial of service attacks but that traffic is going somewhere, and somewhere is often your data center, accessing your services, increasing load on your data center infrastructure Load testing, to be sure, of an active architecture is important It s the only way to really determine what the real capacity for your data center will be and how it will respond under heavy load and that includes the additional strain resulting from an attack Cloud-based load testing services are available and can certainly be of assistance in performing such testing on live infrastructure And yes, it has to be live or it won t find all the cracks and fissures in your architecture It isn t your lab environment, after all, that s going to be under attack or stressed out by sudden surges in traffic Perhaps no problems exist, but you really don t want to find out there are when the pressure s on and you have to make the decision in the heat of the moment Try testing with your firewall, and without assuming you have solutions capable of providing the security services required in the inbound data path See if there is an impact positive or negative and then you ll be better able to make a decision in the event it becomes necessary Putting firewalls in front of your Internet services has been dogma for a long, long time But are they up to the task It would appear in many cases they aren t When a solid majority of folks have found their sites down due to firewall failure, we may need to rethink the role of a firewall in securing services That doesn t mean we ll come to a different conclusion, especially as only part of the architectural decisions made regarding data center security are dependent on technological considerations other factors such as risk tolerance by the business are often the driving factor and play a much larger role in such decisions whether IT likes it or not But it does mean that we should occasionally re-evaluate our data center strategies and consider whether traditional architectural dogma is still appropriate in today s environment Especially when that architectural dogma may be part of the problem --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 rss AddThis Feed Button Bookmark and Share Related blogs articles icon-html Infrastructure Matters Challenges of Cloud-based Testing icon-html The Strategy Not Taken Broken Doesn t Mean What You Think It Means icon-html Cloud Testing The Next Generation Network World icon-html Network Infrastructure Security Report Volume VI arbornetworkscom icon-html Load Testing as a Service A Look at Load Impact beta icon-html Cloud Testing The Next Generation icon-html To Boldly Go Where No Production Application Has Gone Before icon-html It s 2am Do You Know What Algorithm Your Load Balancer is Using icon-html Data Center Feng Shui Process Equally Important as Preparation icon-html Don t Conflate Virtual with Dynamic icon-html Data Center Feng Shui icon-html What We Learned from Anonymous DDoS is now 3DoS icon-html The Many Faces of DDoS Variations on a Theme or Two Technorati Tags MacVittie,F5,cloud computing,security,firewall,architecture,data center IMAGE http://www.secuobs.com/revue/news/285631.shtmlhttp://www.secuobs.com/revue/news/285631.shtml Secuobs.com : 2011-02-14 13:33:19 - Security - The definition of broken in IT is a lot more variable than in the real world Sometimes you should follow the strategy not taken imageDon and I maintain a number of servers on which we run various web sites for fun Early on we determined we really did need a firewall both because we wanted to better control our young children s access to the Internet and to prevent unwanted visitors We happened to have one land in our laps For the past well, many years now - it s been running with nary a glitch to trip us up In other words, it ain t broke And yet we ve seen increasingly odd behavior in delivery of content over the past couple of years, mostly related to video but often also related to AJAX-heavy web applications We managed to narrow down the culprit to one component that aged firewall It makes sense, if you think about it That firewall was designed to be top-of-the line it s an enterprise-class firewall for its day Its day, unfortunately, was one on which very little video was delivered and web applications were little more than CGI form submissions hidden within a set of static HTML pages VPN traffic, video, VoIP No traffic of this type was flowing over the Internet let alone enterprises in the days that firewall was conceived, designed and developed But now that s a regular occurrence, and the poor thing simply can t handle the load nor the complex interaction between not only applications but components, too As far as we re concerned, it s broken through no fault of its own and it s time to retire it to the Information Highway Graveyard in the ether THIS AIN T YOUR DADDY S DATA CENTER Core network and application delivery infrastructure in your data center is probably working just fine Routers are routing, switches are switching It isn t that new routers route better or differently, it s mostly about throughput and rate of transfer these days, which has exponentially increased since the time you acquired the solutions That has definitely changed The frequency with which a wide variety of content is accessed, delivered, and exchanged via your data center infrastructure is radically different than that with which the same was exchanged years ago in your daddy s or mommy s data center The infrastructure is not, technically speaking, broken But it may not be working the way it should because it wasn t engineered to handle the load and usage patterns of today It was engineered to handle yesterday s traffic and yesterday s architectural models Static models, brittle models Models that certainly didn t take into consideration dynamism and virtualization and cloud computing and a multitude of mobile devices Not only are yesterday s infrastructure components ill-equipped to handle today s usage and traffic patterns, they don t play well with others they aren t all able to integrate and collaborate with other components That s necessary not only to achieve an acceptable economy of scale but to assure that the benefits ascribed to today s dynamic architectural models can be realized DATA CENTER STRATEGY REBOOT If you re going to need to upgrade and modernize components and it s likely you will then it s probably also time to reconsider your data center strategy Because like components, it was probably based on a data center and environment that no longer exists and does not take into consideration all the new models and approaches to not only delivering applications but managing the infrastructure that accomplishes the tasks associated with that goal This is a non-trivial task and requires as much investment in upgrading processes as it does products You ve got to move from load balancing to application delivery from scaling servers to scaling services from securing networks to protecting information The latter of all these requires new approaches, perhaps new solutions, but also new processes and new ways of looking at the data center It requires that you look at the data center as an architecture, not an assembly line as a means to an end and not the end itself It s a strategic change of direction that requires a more collaborative environment not just between infrastructure components but between people, too Robert Whitely twitterbird of Forrester said it well in a recent blog, It s Time to Reboot Your Infrastructure Operations Strategy blockquote And that s where the need to reboot I O comes in This year s I O research and events will focus on how you streamline I O people, processes, and technology to support empowered employees The goal is not to achieve cloud economics, but to take steps to get at least one order of magnitude less expensive in running your infrastructure and operations emphasis added This is a turning point, a fork in the road, for many organizations that have long relied on simply piece-mealing products into the data center without considering imagehow those products might impact both operational and functional processes of delivering applications which, when you get down to it, is what all of IT is really about doing either directly or indirectly A new strategy is necessary to address the increasingly complex interactions required of data center components to not only scale efficiently in technological terms but in management and financial terms As enterprise architecture is necessary to provide a framework in which applications can be deployed, integrated and managed so is a data center architecture necessary today to provide a framework in which network and application delivery network components can be deployed, integrated and managed Such an architecture provides a core set of policies that govern the processes by which repeatable deployments and tasks can be accomplished and technology-focused policies for security, access and scalability can be applied When pundits, experts, and analysts talk about cloud computing being an opportunity and a catalyst for change, this is the underlying truth of what they re trying to get at Cloud computing represents a fundamental shift in the way we think not just about compute or infrastructure or even services themselves, but about how those things are delivered, managed, and secured It s about a strategy, not a solution It s about processes, not products It s about what it does, not what it is The question is will you adopt the strategy, as Robert Frost put it, less traveled Will you continue to trod the path that leads to the same destination as it always has or will you take the initiative and adopt the strategy less traveled by that leads to a new and different and one hopes more efficient and capable data center The time is now to rethink your strategy and start putting into place more collaborative components and processes, the kind that will lead to a more agile, efficient operational posture --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html Focus of Cloud Implementation Depends on the Implementer icon-html It s Time to Reboot Your Infrastructure Operations Strategy icon-html Cloud Chemistry 101 icon-html Data Center Feng Shui Process Equally Important as Preparation icon-html The Zero-Product Property of IT icon-html Don t Conflate Virtual with Dynamic icon-html It s Called Cloud Computing not Cheap Computing icon-html Infrastructure 20 Cloud IT as a Service An Architectural Parfait icon-html The Cloudy Enterprise Hours More Important Than Dollars icon-html Don t Throw the Baby out with the Bath Water Technorati Tags MacVittie,F5,data center,strategy,cloud computing,virtualization,infrastructure 20,architecture IMAGE http://www.secuobs.com/revue/news/285058.shtmlhttp://www.secuobs.com/revue/news/285058.shtml Secuobs.com : 2011-02-11 22:12:15 - Security - IMAGE News of a successful attack that almost instantly gives full access to an iPhone's password keychain made its way around the Web on Thursday after Germany's Fraunhofer Institute for Secure Information Technology revealed the exploit to IDG News Service While the fact that hackers could access a device's keychain in such a short time certainly sounds alarming, the attack isn't entirely new, and is actually a product of Apple's DRM approach to security, one iOS security expert told Ars Fraunhofer SIT's exploit first relies on physical access to an iPhone, so an attacker has to get your iPhone away from you before digging in In most cases like this, you would likely want to use Apple's now free remote wipe feature in order to protect your data, but remote wipe is easily thwarted by removing the device's SIM card Any attacker sophisticated enough to decrypt the keychain will know this trick Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/284717.shtmlhttp://www.secuobs.com/revue/news/284717.shtml Secuobs.com : 2011-02-11 13:48:50 - Security - Nokia s brutally honest assessment of its situation identifies what is not always obvious in the data center - it s about an ecosystem f5friday In what was certainly a wake-up call for many, Nokia s CEO Stephen Elop tells his organization its platform is burning In a leaked memo reprinted by Engadget and picked up by many others, Elop explained the analogy as well as why he believes Nokia is in trouble Through careful analysis of its competitors and their successes, he finds the answer in the ecosystem its competitors have built -comprising developers, applications and more blockquote The battle of devices has now become a war of ecosystems, where ecosystems include not only the hardware and software of the device, but developers, applications, ecommerce, advertising, search, social applications, location-based services, unified communications and many other things Our competitors aren t taking our market share with devices they are taking our market share with an entire ecosystem This means we re going to have to decide how we either build, catalyse or join an ecosystem If you re wondering what this could possibility have to do with networking and application delivery, well, the analysis Elop provides regarding the successes of a mobile device vendor can be directly applied to the data center The nature of data centers and networks is changing It s becoming more dynamic, more integrated, more dependent upon collaboration and connections between devices components that have traditionally stood alone on their own But as data image center models evolve and morph and demands placed upon them increase the need for contextual awareness and collaboration and the ability to be both reactive and proactive in applying policies across a wide spectrum of data center concerns, success becomes as dependent on a components ability to support and be supported by an ecosystem Not just the success of vendors, which was Elop s focus, but success of data center architecture implementations To counter the rising cost and complexity introduced by new computing and networking models requires automation, orchestration, and collaboration across data center components cloud computing and virtualization has turned the focus from technology focused components to process-oriented platforms From individual point solutions to integrated, collaborative systems that encourage development and innovation as a means to address the challenges arising from extreme dynamism F5 Networks Wins VMware Global Technology Innovator Award Charlie Cano accepts VMware's Technology Innovator Partner of the Year Award on behalf of F5 Yesterday we took home top honors for enhancing the value of VMware virtualization solutions for companies worldwide At VMware Partner Exchange 2011, VMware s annual worldwide partner event, F5 was recognized with VMware s Technology Innovator Partner of the Year Award Why is that important Because it recognizes the significant value placed on building a platform and developing an ecosystem in which that platform can be leveraged to integrate and collaborate on solutions with partners and customers alike And it is about an ecosystem it is about collaborative solutions that address key data center challenges that may otherwise hinder the adoption of emerging technologies like cloud computing and virtualization A robust and flexible application delivery platform provides not only the means by which data and traffic can be dynamically delivered and secured, but also the means through which a more comprehensive strategy to address operational challenges associated with increasingly dynamic data center architectures can be implemented The collaboration between VMware and F5 s BIG-IP platforms is enabled through integration, through infrastructure 20 enabled systems that create an environment in which flexible architectures and dynamism can be managed efficiently In 2010 alone, F5 and VMware collaborated on a number of solutions leveraging the versatile capabilities of F5 s BIG-IP product portfolio, including Accelerated long distance live migration with VMware vMotion The joint solution helps solve latency, bandwidth, and packet-loss issues, which historically have prevented customers from performing live migrations between data centers over long distances An integrated enterprise cloudbursting solution with VMware vCloudDirector The joint solution simplifies and automates use of cloud resources to enhance application delivery performance and availability while minimizing capital investment Optimized user experience and secure access capabilities with VMware View The solution enhances VMware View user experience with secure access, single sign-on, high performance, and scalability Since joining VMware s Technology Alliance Partner program in 2008, F5 has driven a number of integration and interoperability efforts aimed at enhancing the value of customers virtualization and cloud deployments, said Jim Ritchings, VP of Business Development at F5 We re extremely proud of the industry-leading work accomplished with VMware in 2010, and we look forward to continued collaboration to deliver new innovations around server and desktop virtualization, cloud solutions, and more It is just such collaboration that builds a robust ecosystem that is necessary to successfully move forward with dynamic data center models built upon virtualization and cloud computing principles Without this type of collaboration, and the platforms that enable it, the efficiencies of private cloud computing and economy of scale of public cloud computing simply wouldn t be possible F5 has always been focused on delivering applications, and that has meant not just partnering extensively with application providers like Oracle and Microsoft and IBM, it has also meant partnering and collaborating with infrastructure providers like HP and Dell and VMware to create solutions that address the very real challenges associated with data center and traffic management Elop is exactly right when he points to ecosystems being the key to the future In the case of network and application networking solutions that ecosystem is both about vendor relationships and partnerships as much as it is solutions that enable IT to better align with business and operational goals to reduce the complexity introduced by increasingly dynamic operations VMware s recognition of the value of that ecosystem, of the joint solutions designed and developed through partnerships, is great validation of the important role of the ecosystem in the successful implementation of emerging data center models --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html F5 Friday Join Robin IT Hood and Take Back Control of Your Applications icon-html F5 Friday The Dynamic VDI Security Game icon-html WILS The Importance of DTLS to Successful VDI icon-html F5 Friday Elastic Applications are Enabled by Dynamic Infrastructure icon-html F5 Friday Efficient Long Distance Transfer of VMs with F5 BIG-IP WOM and NetApp Flexcache icon-html F5 Friday Playing in the Infrastructure Orchestra tion icon-html Why Virtualization is a Requirement for Private Cloud Computing f5-small-logo F5 VMware View Solutions f5-small-logo F5 VMware vSphere Solutions pdf-icon Application Delivery for Virtualized Infrastructure MembersIcon2 DevCentral - VMware F5 Solutions Topic Group Technorati Tags MacVittie,F5,F5 Friday,VMware,Vmware View,vSphere,partners,ecosystem,infrastructure 20,dynamic data center IMAGE http://www.secuobs.com/revue/news/284595.shtmlhttp://www.secuobs.com/revue/news/284595.shtml Secuobs.com : 2011-02-07 21:53:54 - Security - IMAGE Internet vigilante group Anonymous turned its sights on security firm HBGary on Sunday evening in an attempt to teach HBGary a lesson you'll never forget The firm had been working with the Federal Bureau of Investigation FBI to unmask members of Anonymous following the group's pro-WikiLeaks attacks on financial services companies, and was prepared to release its findings next week HBGary had been collecting information about Anonymous members after the group's DDoS attacks on companies perceived to be anti-WikiLeaks The firm had targeted a number of senior Anonymous members, including a US-based member going by the name of Owen, as well as another member known as Q In addition to working with the FBI for a fee, of course , HBGary's CEO Aaron Barr was preparing to release the findings this month at a security conference in San Francisco Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/283506.shtmlhttp://www.secuobs.com/revue/news/283506.shtml Secuobs.com : 2011-02-07 15:42:54 - Security - IMAGE Nasdaq OMX, the company that operates the Nasdaq stock exchange, has said that part of its online network has been penetrated by unknown hackers Suspicious files were discovered on Nasdaq servers, triggering a federal investigation into the matter The company stressed that servers and networks that handle trading activity show no signs of compromise Discovery of the breach happened late last year, triggering a Secret Service investigation to try and find out who was responsible and what the possible motive might have been Since then, both the FBI and Department of Justice have joined in the investigation, as Nasdaq's exchange is consider a critical part of the US economic infrastructure The attack happened on servers that run Nasdaq's Directors Desk web app, which allows corporation board members to store and share certain company-related information The suspicious files, which may have been part of some type of malware, were immediately removed from the system once discovered Nasdaq OMX originally did not publicly reveal that its systems had been compromised so that federal investigators could conduct their investigation without alerting the perpetrators However, news of the hack was reported by The Wall Street Journal on Saturday, which cited anonymous sources with knowledge of the incident That prompted the company to make an official statement, saying there is no evidence that any customer information was accessed Nasdaq's trading platforms, which run on servers separate from Directors Desk, were also not affected At no point was any of Nasdaq OMX s operated or serviced trading platforms compromised, the company told The New York Times So far, the extent of the attacks appears to be the hackers merely explored the system, possibly looking for additional vulnerabilities NYT also noted that Nasdaq is responsible for about 19 percent of US stock trades If hackers could directly affect trades or merely just damage Nasdaq's trust relationship with traders, it could have a significant impact on the US economy A report in 2009 noted that the US's heavy reliance on a digital infrastructure and information-based economy made it particularly vulnerable to such attacks Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/283396.shtmlhttp://www.secuobs.com/revue/news/283396.shtml Secuobs.com : 2011-02-05 01:38:50 - Security - IMAGE After a quiet January Patch Tuesday, Microsoft will be issuing 12 updates fixing 22 vulnerabilities for February's Patch Tuesday These patches will update Windows, Internet Explorer, and the Visio diagramming software Three bulletins, including the Internet Explorer patch, earn the most severe Critical rating The remaining nine, including the Visio fix, earn a still significant Important score All bar three of the fixes will require a reboot Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/283138.shtmlhttp://www.secuobs.com/revue/news/283138.shtml Secuobs.com : 2011-02-01 03:01:43 - Security - IMAGE Microsoft has issued a security bulletin warning of a new unpatched Windows vulnerability affecting all Windows versions from Windows XP through to Windows 7, except for Server Core installations of Windows Server 2008 and Windows Server 2008 R2 The flaw enables attackers to cause victims to run malicious scripts by visiting a web page The flaw was disclosed on January 15, and proof-of-concept code has been published The flaw lies in the way Windows handles MHTML files MHTML is a mechanism devised by Microsoft to encapsulate a web page and all the objects it needs scripts, images, stylesheets into a single MHTML file, to make it easier to save and e-mail web pages Along with support for the files themselves, Windows supports special MHTML URLs it is this support that contains the security flaw Microsoft has not released a patch yet, nor has the company released a timetable for the patch MHTML files can be prevented from loading scripts, which blocks known attacks on the flaw by changing some registry settings, and the company has an automated Fix it to apply the change automatically The company says that it has seen no indications of exploitation in-the-wild Though the flaw was disclosed on January 15, it's a variation of a problem first discovered in 2004, and first reported in 2007 After the 2007 report, Microsoft issued a patch, but as the latest report reveals, the patch was not completely effective Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/282040.shtmlhttp://www.secuobs.com/revue/news/282040.shtml Secuobs.com : 2011-01-31 14:04:00 - Security - Claiming SSL is not computationally expensive is like saying gas is not expensive when you don t have to drive to work every day gas_prices_large My car is eight years old this year It has less than 30,000 miles on it Yes, you heard that right, less than 30,000 miles I don t drive my car very often because, well, my commute is a short trip down two flights of stairs I don t need to go very far when I do drive it s only ten miles or so round trip to the grocery store So from my perspective, gas isn t really very expensive I may use a tank of gas a month, which works out to well, it s really not even worth mentioning the cost But for someone who commutes every day especially someone who commutes a long-distance every day gas is expensive It s a significant expense every month for them and they would certainly dispute my assertion that the cost of gas isn t a big deal My youngest daughter, for example, would say gas is very expensive but she s got a smaller pool of cash from which to buy gas so relatively speaking, we re both right The same is true for anyone claiming that SSL is not computationally expensive The way in which SSL is used the ciphers, the certificate key lengths, the scale has a profound impact on whether or not computationally expensive is an accurate statement or not And as usual, it s not just about speed it s also about the costs associated with achieving that performance It s about efficiency, and leveraging resources in a way that enables scalability It s not the cost of gas alone that s problematic, it s the cost of driving, which also has to take into consideration factors such as insurance, maintenance, tires, parking fees and other driving-related expenses MYTH SSL is NOT COMPUTATIONALLY EXPENSIVE TODAY SSL is still computationally expensive Improvements in processor speeds in some circumstances have made that expense less impactful Circumstances are changing Commoditized x86 hardware can in fact handle SSL a lot better today than it ever could before when you re using 1024-bit keys and easy ciphers like RC4 Under such parameters it is true that commodity hardware may perform efficiently and scale up better than ever when supporting SSL Unfortunately for proponents of SSL-on-the-server, 1024-bit keys are no longer the preferred option and security professionals are likely well-aware that easy ciphers are also easy pickings for miscreants In January 2011, NIST recommendations regarding the deployment of SSL went into effect While NIST is not a standards body can require compliance or else, they can and do force government and military compliance and have shown their influence with commercial certificate authorities All commercial certificate authorities now issue only 2048-bit keys This increase has a huge impact on the capacity of a server to process SSL and renders completely inaccurate the statement that SSL is not computationally expensive anymore A typical server that could support 1500 TPS using 1024-bit keys will only support 1 5 of that around 300 TPS when supporting modern best practices, ie 2048-bit keys ssl-perf-table Also of note is that NIST recommends ephemeral Diffie-Hellman - not RSA - for key exchange, and per TLS 10 specification, AES or 3DES-EDE-CBC, not RC4 These are much less easy ciphers than RC4 but unfortunately they are also more computationally intense, which also has an impact on overall performance Key length and ciphers becomes important to the performance and capacity of SSL not just during the handshaking process, but in bulk-encryption rates It is one thing to say a standard server deployed to support SSL can handle X handshakes connections and quite another to simultaneously perform bulk-encryption on subsequent data responses The size and number of those responses have a huge impact on the consumption rate of resources when performing SSL-related functions on the overall server s capacity Larger data sets require more cryptographic attention that can drag down the rate of encryption that means slower response times for users and higher resource consumption on servers, which decreases resources available for handshaking and server processing and cascades throughout the entire system to result in a reduction of capacity and poor performance Tweaked configurations, poorly crafted performance tests, and a failure to consider basic mathematical relationships may seem to indicate SSL is not computationally expensive yet this contradicts most experience with deploying SSL on the server Consider this question and answer in the SSL FAQ for the Apache web server blockquote Why does my webserver have a higher load, now that it serves SSL encrypted traffic SSL uses strong cryptographic encryption, which necessitates a lot of number crunching When you request a webpage via HTTPS, everything even the images is encrypted before it is transferred So increased HTTPS traffic leads to load increases This is not myth, this is a well-understood fact SSL requires higher computational load which translates into higher consumption of resources That consumption of resources increases with load Having more resources does not change the consumption of SSL, it simply means that from a mathematical point of view the consumption rates relative to the total appear to be different The amount of resources consumed by SSL which is really the amount of resources consumed by cryptographic operations is proportional to the total system resources available The additional consumption of resources from SSL is highly dependent on the type and size of data being encrypted, the load on the server from both processing SSL and application requests, and on the volume of requests Interestingly enough, the same improvements in capacity and performance of SSL associated with modern processors and architecture is also applicable to intermediate SSL-managing devices Both their specialized hardware if applicable and general purpose CPUs significantly increase the capacity and performance of SSL TLS encrypted traffic on such solutions, making their economy of scale much greater than that of server-side deployed SSL solutions THE SSL-SERVER DEPLOYED DISECONOMY of SCALE Certainly if you have only one or even two servers supporting an application for which you want to enable SSL the costs are going to be significantly different than for an organization that may have ten or more servers comprising such a farm It is not just the computational costs that make SSL deployed on servers problematic, it is also the associated impact on infrastructure and the cost of management Reports that fail to factor in the associated performance and financial costs of maintaining valid certificates on each and every server and the management creation of SSL certificates for ephemeral virtual machines are misleading Such solutions assume a static environment and a deep pocket or perhaps less than ethical business practices Such tactics attempt to reduce the capital expense associated with external SSL intermediaries by increasing the operational expense of purchasing and managing large numbers of SSL certificates including having a ready store that can be used for virtual machine instances As the number of services for which you want to provide SSL secured communication increase and the scale of those services increases, the more costly it becomes to manage the required environment Like IP address management in an increasingly dynamic environment, there is a diseconomy of scale that becomes evident as you attempt to scale the systems and processes involved DISECONOMY of SCALE 1 CERTIFICATE MANAGEMENT Obviously the more servers you have, the more certificates you need to deploy The costs associated with management of those certificates especially in dynamic environments continues to rise and the possibility of missing an expiring certificate increase with the number of servers on which certificates are deployed The promise of virtualization and cloud computing is to address the diseconomy of scale the ability to provision and ready-to-function server complete with the appropriate web or application stack serving up an application for purposes of scale assumes that everything is ready Unless you re failing to properly provision SSL certificates you cannot achieve this with a server-deployed SSL strategy Each virtual image upon which a certificate is deployed must be pre-configured with the appropriate certificate and keys and you can t launch the same one twice This has the result of negating the benefits of a dynamically provisioned, scalable application environment and unnecessarily increases storage requirements because images aren t small Failure to recognize and address the management and resulting impact on other areas of infrastructure such as storage and scalability processes means ignoring completely the actual real-world costs of a server-deployed SSL strategy It is always interesting to note the inability of web servers to support SSL for multiple hosts on the same server, ie virtual hosts blockquote Why can't I use SSL with name-based non-IP-based virtual hosts The reason is very technical, and a somewhat chicken and egg problem The SSL protocol layer stays below the HTTP protocol layer and encapsulates HTTP When an SSL connection HTTPS is established Apache mod_ssl has to negotiate the SSL protocol parameters with the client For this, mod_ssl has to consult the configuration of the virtual server for instance it has to look for the cipher suite, the server certificate, etc But in order to go to the correct virtual server Apache has to know the Host HTTP header field To do this, the HTTP request header has to be read This cannot be done before the SSL handshake is finished, but the information is needed in order to complete the SSL handshake phase Bingo Because an intermediary terminates the SSL session and then determines where to route the requests, a variety of architectures can be more easily supported without the hassle of configuring each and every web server which must be bound to IP address to support SSL in a virtual host environment This isn t just a problem for hosting cloud computing providers, this is a common issue faced by organizations supporting different hosts across the domain for tracking, for routing, for architectural control For example, apiexamplecom and wwwexamplecom often end up on the same web server, but use different hosts for a variety of reasons Each requires its own certificate and SSL configuration and they must be bound to IP address making scalability, particularly auto-scalability, more challenging and more prone to the introduction of human error The OpEx savings in a single year from SSL certificate costs alone could easily provide an ROI justification for the CapEx of deploying an SSL device before even considering the costs associated with managing such an environment CapEx is a onetime expense while OpEx is recurring and expensive DISECONOMY of SCALE 2 CERTIFICATE KEY SECURITY The simplistic nature of the argument also fails to take into account the sensitive nature of keys and certificates and regulatory compliance issues that may require hardware-based storage and management of those keys regardless of where they are deployed FIPS 140-2 level 2 and above While there are secure and compliant HSM Hardware Security Modules that can be deployed on each server, this requires serious attention and an increase of management and skills to deploy The alternative is to fail to meet compliance not acceptable for some or simply deploy the keys and certificates on commoditized hardware increases the risk of theft which could lead to far more impactful breaches For some IT organizations to meet business requirements they will have to rely on some form of hardware-based solution for certificate and key management such as an HSM or FIPS 140-2 compliant hardware The choices are deploy on every server note this may become very problematic when trying to support virtual machines or deploy on a single imageintermediary that can support all servers at the same time, and scale without requiring additional hardware software support DISECONOMY of SCALE 3 LOSS of VISIBILITY SECURITY AGILITY SSL all the way to the server has a profound impact on the rest of the infrastructure, too, and the scalability of services Encrypted traffic cannot be evaluated or scanned or routed based on content by any upstream device IDS and IPS and even so-called deep packet inspection devices upstream of the server cannot perform their tasks upon the traffic because it is encrypted The solution is to deploy the certificates from every machine on the devices such that they can decrypt and re-encrypt the traffic Obviously this introduces unacceptable amounts of latency into the exchange of data, but the alternative is to not scan or inspect the traffic, leaving the organization open to potential compromise It is also important to note that encrypted bad traffic, eg malicious code, malware, phishing links, etc does not change the nature of that traffic It s still bad, it s also now hidden to every piece of security infrastructure that was designed and deployed to detect and stop it A server-deployed SSL strategy eliminates visibility and control and the ability to rapidly address both technical and business-related concerns Security is particularly negatively impacted Emerging threats such as a new worm or virus for which AV scans have not yet but updated can be immediately addressed by an intelligent intermediary whether as a long-term solution or stop-gap measure Vulnerabilities in security protocols themselves, such as the TLS man-in-the-middle attack, can be immediately addressed by an intelligent, flexible intermediary long before the actual solutions providing the service can be patched and upgraded A purely technical approach to architectural decisions regarding the deployment of SSL or any other technology is simply unacceptable in an IT organization that is actively trying to support and align itself with the business Architectural decisions of this nature can have a profound impact on the ability of IT to subsequently design, deploy and manage business-related applications and solutions and should not be made in a technical or business vacuum, without a full understanding of the ramifications ----------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html The Anatomy of an SSL Handshake Network Computing icon-html Get Ready for the Impact of 2048-bit RSA Keys Network Computing icon-html SSL handshake latency and HTTPS optimizations semicompletecom icon-html Black Hat PKI Hack Demonstrates Flaws in Digital Certificate Technology DarkReading icon-html SSL TLS Strong Encryption FAQ apacheorg icon-html The Open Performance Testing Initiative icon-html The Order of Network Operations icon-html Congratulations You do no nothing faster than anyone else icon-html Data Center Feng Shui SSL icon-html WILS SSL TPS versus HTTP TPS over SSL icon-html F5 Friday The 2048-bit Keys to the Kingdom icon-html TLS Man-in-the-Middle Attack Disclosed Yesterday Solved Today with Network-Side Scripting Technorati Tags MacVittie,F5,SSL,architecture,security,performance,certificates,key,PKI IMAGE http://www.secuobs.com/revue/news/281843.shtmlhttp://www.secuobs.com/revue/news/281843.shtml Secuobs.com : 2011-01-28 15:06:08 - Security - Mobile users cloud computing End-runs around IT security by developers The trend has always existed, it s just speeding up now IT needs to take back control and fast But first IT needs the tools with which to do that f5friday Let s ignore the horrible acting by Kevin Costner in Robin Hood Prince of Thieves I personally prefer Russell Crowe in the 2010 version but that s me and unfortunately they cover two different periods of Robin Hood s legendary life so we re stuck with the lesser version and let s just focus on a couple key lines concepts that are relevant to the topic at hand Robin Hood is trying to convince his not-so-merry band of men to fight back against the Sheriff of Nottingham One of the men complains Yeah, but what about image our kids The sheriff has taken all they've got too Robin Hood s response, in typical heroic-tale style is Then, by God, we'll take it back While business and mobile users and developers haven t quite taken all IT has got in terms of control, they have taken more than a fair share And that s dangerous, because a business user is not the business and thus their demands and desires do not always march lock-step in line with business needs or requirements They may demand, for example, that you ensure they can access applications from their iPad but the business might not be willing to introduce that just yet or for all applications Auditors as far as I m aware don t accept users are really careful as meeting a compliance or other regulatory requirement Perhaps accessing the intranet is okay, but the application through which millions of dollars worth of transactions flow well, they can t justify the potential risk of that data ending up on a mobile device that could be next week s Show and Tell gadget at the local grade school The business is not its users, and it often has some stringent security and access policies which its users would rather simply ignore The problem is users may not be aware of such a policy and even if they are, they may be wont to believe it doesn t apply to them And because their iPad is personal it s not managed or governed by IT and using WiFi, you may be aware that their use is increasing but from a technological standpoint you can t do much about it You ve lost control because your security policy enforcement is focused on things like networks and application types, not devices and locations and even specific users LUCKILY THIS is NOT MEDIEVAL ENGLAND Sure, you may feel like getting medieval on your users, but really that s not an acceptable response Seriously It s not What you need is a technological solution that can provide the means by which you can actively enforce access policies and which allows you to dynamically adjust those policies as new technology emerges and is brought into the organization and that may circumvent intentionally or otherwise the core security policies the business needs to enforce That s why it was very exciting when earlier this week we announced the availability of BIG-IP Access Policy Manager for LTM VE LAB or PRODUCTION LTM VE only image BIG-IP Access Policy Manager APM is able to control access to applications and resources not just based on identity but also on other variables associated with context That s variables like device type, state of the endpoint, location, and even network and data-center based conditions and status By leveraging context, APM can provide a dynamic, flexible active policy enforcement method that better aligns technology use with business goals and needs especially those related to application access BIG-IP APM integrates with existing methods of authentication, and allows rich policy for authorization based on user, endpoint inspection and more And yes, our endpoint inspection and secure remote access solutions support iOS devices Organizations can allow only secured devices, or restrict access to a specific set of applications from others the choice is up to the implementer because regardless of network, or device, APM puts IT back in control of application access While there are lots of folks familiar with the core BIG-IP platform and our flagship load balancing and availability solution, Local Traffic Manager LTM , many aren t as familiar with APM or aren t understandably comfortable with testing out a new solution by deploying it on a production-level, critical infrastructure component like LTM The availability of APM as a module for LTM in a virtual form-factor offers an easier means of evaluating APM or simply using it to pre-configure and test desired access policies before moving them into production My cohort Peter Silva, has written a bit more in depth on the newest virtual member of the BIG-IP family and how to leverage its capabilities to Simplify VMware View Deployments Be sure to check it out So go ahead, test it out Join the modern version of Robin Hood s merry band of IT and take back control of your applications Happy Securing Access --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html Simplify VMware View Deployments icon-html F5 Accelerates VMware View Deployments with BIG-IP Access Policy Manager on a Virtual Platform icon-html BIG-IP Local Traffic Manager Virtual Edition icon-html BIG-IP Access Policy Manager pdf-icon Application Delivery and Load Balancing for VMware View Desktop Infrastructure pdf-icon Deploying F5 Application Ready Solutions with VMware View 45 pdf-icon Optimizing VMware View VDI Deployments pdf-icon Global Distributed Service in the Cloud with F5 and VMware User-Group-icon F5 VMWare Solutions User-Group-icon Security Compliance User-Group-icon BIG-IP LTM VE Technorati Tags MacVittie,F5,F5 Friday,secure remote access,VMware,APM,BIG-IP,access control,security IMAGE http://www.secuobs.com/revue/news/281397.shtmlhttp://www.secuobs.com/revue/news/281397.shtml Secuobs.com : 2011-01-25 19:55:49 - Security - IMAGE A survey of cyberspace says that the United States enjoys the honor of being the world's top attack traffic source, accounting for 12 percent of all such malicious data eight percent of the globe's in the third quarter of 2010 This could represent the activities of infected hosts that are looking for other hosts to spread to, or it may represent brute force attempts to log in to other systems, according to the Akamai Corporation's David Belson It's all in the server maker's latest State of the Internet report registration required Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/280681.shtmlhttp://www.secuobs.com/revue/news/280681.shtml Secuobs.com : 2011-01-25 13:19:36 - Security - It used to be that mobile access implied remote access That s no longer true As the variety of clients continue to expand along with the venues from which we users can access corporate resources the ability to intelligently enforce access-control policies also increases in strategic importance canhazipadEvery time we add a new access method in the enterprise we go through a period in which we expend a lot of time and energy trying to figure out how to control that access The consumerization of IT, for example, in which consumer-grade devices gadgets have been slowly but surely permeating every facet of the business have led to a need for IT not only to support but manage, ie control access from, such devices The lure of virtual desktop infrastructure VDI continues to be strong, providing myriad benefits for IT in terms of management, security, and simplified support across a broader variety of clients But it also introduces challenges that must be addressed lest the benefits of a VDI implementation become quickly lost Performance can be significantly impacted by the deployment of VDI, and the access-control challenges introduced are nothing if not non-trivial blockquote The server farm will carry a higher processing load, and will need more highly specified storage systems, by comparison with a more conventional client server architecture Some firms may need to fund a network upgrade also, to cope with higher data transport demands emphasis added -- Forrester Research Analyst Andrew Parker, Desktop Virtualization How Will It Impact Desktop Outsourcing Costs If prognosticators are correct, these challenges will become serious impediments to successful VDI implements as early as this year 2011 The latest projections from research firms regarding the deployment of virtual desktop technology is staggering Gartner forecasts the install base will almost triple this year 2011 , noting HVD Hosted Virtual Desktop works best with well-managed environments Currently, that means fully locked down But it is hardly advantageous to overload an already overloaded admin and operations staff by requiring yet another layer of access control specifically to address virtual desktops and mobile device access What s needed is something strategic, something more intelligent that can apply access policies based on context such that access to corporate resources can be managed more consistently across the growing variety of endpoints and locations from which those resources are being requested CONTROL and CONTEXTimage The one thing that is common across most emerging data center and deployment models today is control, or more accurately the loss of control it imparts on IT VDI, mobile endpoints, cloud computing These technologies all share one common and complexifying attribute they potentially erode the control IT needs over access to resources to ensure that corporate data and applications remain secure and uncompromised Introduce a few emerging threat vectors thanks to cloud computing and virtualization into the picture and the need for access control and endpoint management becomes not just a nice to have, but a critical component to the long-term security of data, applications, and the data center network Even if you do have access control under, well, control, when you introduce the distributed nature of cloud computing and virtualization and you start running into problems associated with a loss of context in which to evaluate and apply that control It s not enough to know that User A is requesting a virtual desktop you also need to know from where and what device that user is making such a request It is important to understand whether User A is attempting to access resources from their home network or an Internet cafe somewhere in Bangladesh The ability to dynamically apply graded authentication and authorization to resources based on the context of a request is also increasingly important in a world where a user may flip seamlessly from iPhone to Windows desktop to Blackberry tablet Hey, it s coming It ll happen And that is a bigger problem than some might think because it s not just iPhone on Verizon or AT T that s a problem, it s an iPad that may be connected via WiFi from within your own network 1 Unauthorized Smartphones on Wi-Fi Networks Smartphones create some of the greatest risks for enterprise security, mostly because they're so common and because some employees just can't resist using personal devices in the office -- even if their employers have well-established policies prohibiting their use The danger is that cell phones are tri-homed devices -- Bluetooth, Wi-Fi and GSM wireless, says Robert Hansen, founder of Internet security consulting firm SecTheory LLC Employees who use their personal smartphones at work introduce a conduit that is vulnerable to potential attack, he explains -- Six security leaks to plug right now, ComputerWorld January 2011 So it isn t just from where, it s from what device You can t just lock down applications and resources based on the network Context-awareness is an integral or should be an integral part of any remote access-based strategy and increasingly it will be important to a general resource control strategy because mobile device no longer implicitly means remote Mobile devices are inside the perimeter and they aren t going away VDI is gaining traction quickly because of its security and management benefits If you re going to deliver a fully configured and ready to use desktop via some virtual desktop infrastructure, you need to be concerned about where that desktop might be going and who might be requesting it The only thing you can do is control access and delivery via infrastructure solutions that are intelligent enough to enforce policies based on a combination of variables And that control of access and delivery will almost certainly need to look inward in addition to outward and cloudward, to ensure that those policies are appropriate enforced The hardest part of doing that is to do so without sacrificing performance and without blowing out your budget --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html What Lies Ahead in Desktop Virtualization 2011 Predictions icon-html Desktop Virtualization How Will It Impact Desktop Outsourcing Costs icon-html WILS The Importance of DTLS to Successful VDI icon-html F5 Friday The Dynamic VDI Security Game icon-html F5 Friday Secure, Scalable and Fast VMware View Deployment icon-html Cloud Needs Context-Aware Provisioning icon-html Call Me Crazy but Application-Awareness Should Be About the Application icon-html The IP Address Identity Disconnect icon-html The Context-Aware Cloud icon-html Location, Location, Location Technorati Tags MacVittie,F5,VDI,virtualization,mobile applications,access control,security,context-aware,strategic point of control IMAGE http://www.secuobs.com/revue/news/280608.shtmlhttp://www.secuobs.com/revue/news/280608.shtml Secuobs.com : 2011-01-24 17:24:38 - Security - Both are taken for granted but provide vital services without which you and your digital presence would be lost In the case of DNS, that should be taken literally image Mom She s always there, isn t she She kissed away your bumps and bruises You treated her like Google before you had access to the web and, like Google, she came through every time you needed to write a report on butterflies or beetles or the pyramids at Giza You asked her questions, she always had an answer You didn t spend as much time with her as you grew older and discovered you knew way more than she did, didn t you but when you needed money or life kicked you in the face, she was there for you, as always Steady, reliable, good old mom You d be lost without her, wouldn t you Go ahead give her a call, shoot her an e-mail, write on her Facebook wall, order some flowers I ll wait Now that we re ready, consider that there are some components of your infrastructure that are just as valuable to your organization s digital presence as your Mom is to you Unfortunately we also tend to take them for granted TAKEN FOR GRANTED DNS is rarely mentioned these days except when it s the target of an attack Then we hear about it and for a few moments DNS is as it should be a critical data center service It s like Mother s Day, only without the dandelions posing as flowers and Hallmark cards But once the excitement over the attack is over, DNS goes back into the bowels of the data center and keeps chugging along, doing what it does without complaint, patiently waiting to be appreciated once again Okay, okay Enough of the guilt trip But the truth is that DNS is often overlooked despite its importance to just about everything we do It is the first point of contact with your customers, and it is the gatekeeper to your entire domain Without it, customers can t find you and if they can t find you, you can t do business It s the cornerstone, the foundation, the most critical service on the Internet And yet it remains largely unprotected The reasons for that are many, but primarily it s because DNS needs to interact with the public, with the unknown Its purpose in the architecture of the Internet is to be the authoritative source of where a given service resides Queries to the root servers happen on the order of millions of times a second Other DNS services are similarly stressed There are two primary concerns for DNS 1 Load 2 Authenticity Load is a concern because it s possible to take out a DNS server simply by overloading it with requests It s a denial of service attack on your entire organization that takes away the ability of clients to find you making you all but invisible to the entire Internet The second problem is one that s more recent, but just as dangerous authenticity This issue speaks to the ability to hijack your DNS or poison the cache such that customers looking for your latest gadget or service or what have you end up listening to Justin Bieber instead Okay, maybe that s too harsh an image Maybe they redirect to a competitor s site, or to a porn site, or something less horrifying than Bieber You get the picture it s bad for you and your organization s reputation when this happens Point is, your DNS services can be hijacked and the result is that your sites and applications are effectively lost to the general public Customers can t find you, remote or roaming employees can t access business critical applications, and you might find yourself associated with something with which you d rather not have your organization tied DON T MAKE DAD ANGRY Your DNS infrastructure is critical DNS itself is an aging protocol, yes, but it does what it s supposed to do and it does so in a scalable, non-disruptive way But it does need some attention, particularly in the area of load and authenticity angry dadTo help relieve some of the stress of increasing load and the potentially devastating impact of an overload from attack, consider the benefits of load balancing DNS Load balancing DNS much in the same way as load balancing web services and applications provides a plethora of options in architecture and resource distribution that can address heavy load on DNS infrastructure cloud computing can play a role, here, if the DNS services are virtualized in the architecture by an upstream application delivery solution The strategy here is to scale out DNS as needed to meet demand That s of particular importance if the upstream components if there are any are not capable of detecting and responding to a DNS-based DDoS attack It ll cost you a pretty penny to scale out your DNS farm to respond, but on the scales balancing uptime of your entire digital presence with costs, well, even the business understands that trade-off image Don t discount the impact of a dynamic data center on DNS DNS wasn t designed to be constantly updated and yet the nature of highly virtualized and cloud computing environments requires just that rapid changes, frequently That will have an impact on your DNS infrastructure, and can negatively impact the costs associated with managing IP addresses This is the core of the economy of scale problem associated with the network in relation to cloud computing and virtualization It s why automation and orchestration process will become critical to the successful implementation of IT as a Service-based initiatives Yet another facet of DNS that might have been thus far overlooked To address the Justin Bieber problem, ie hijacking or poisoning of a DNS cache, implement DNSSEC It s one of the few new standards specifications relating to DNS to hit the wires literally and it s a good one DNSSEC, if you aren t familiar, leverages the foundation of a public key infrastructure to sign records such that clients can be assured of authenticity Because miscreants aren t likely to have the proper keys and certificates with which to sign responses, hijacking your name services really can t happen in a fully DNSSEC-compliant world Problem is, it s not a fully DNSSEC compliant world Yet Movement is slow, but the root servers are being protected with DNSSEC and that means it s time for organizations everywhere to start considering how to implement a similar solution in their own infrastructure Because it s quite possible that one day, clients will reject any non-secured response from a DNS service And if you think your mom feels bad when you don t answer her calls damn caller ID anyway your DNS service will feel even badder Or the business will, which is probably worse cause that s like your dad getting on your case for not answer your phone when your mom calls DNS CRITICAL to CLOUD-BASED STRATEGIES As we continue to move forward and explore how IT can leverage cloud-based compute to extend and enhance our IT strategies we find more and more that DNS is a critical component to those strategies Extending the data center to include external, cloud-deployed applications requires that customers be able to find them which means DNS When migrating applications between locations for any reason, DNS becomes a key player in the move ensuring new and existing connections are properly directed to the right location at the right time DNS is one of the core technologies required to implement a cloud bursting strategy pdf-icon DNS is the foundation upon which dynamic and mobile compute can be leveraged both internal and external to the data center DNS is key to cloud computing, whether it s public, private, or hybrid DNS is old, yes It s outdated, yes It is like just like your mom And like your mom, it should be treated with the respect it deserves given its critical role in just about every facet of your organization s digital life --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html It s DNSSEC Not DNSSUX icon-html VeriSign We will support DNS security in 2011 icon-html New DNS exploit now in the wild and having a blast icon-html The Official, Unofficial, DNS Security Extensions Blog icon-html The End of DNS As We Know It icon-html Taking Down Twitter as easy as DNS icon-html Building a Cloudbursting Capable Infrastructure icon-html Cloud Balancing, Cloud Bursting, and Intercloud pdf-icon Achieving Enterprise Agility in the Cloud Cloudbursting with VMware, BlueLock, and F5 pdf-iconDNSSEC The Antidote to DNS Cache Poisoning and Other DNS Attacks F5logo DNSSEC Solutions webcast DNSSEC Compliance is Easier Than you Think Technorati Tags MacVittie,F5,DNSSEC,DNS,infrastructure,infrastructure 20,virtualization,cloud computing,security IMAGE http://www.secuobs.com/revue/news/280337.shtmlhttp://www.secuobs.com/revue/news/280337.shtml Secuobs.com : 2011-01-24 13:31:47 - Security - Cloning Boomeranging Trojan clouds Start up CloudPassage takes aim at emerging attack surfaces but it s still more about process than it is product Before we go one paragraph further let s start out by setting something straight this is not a cloud is insecure or cloud security oh noes post Cloud is involved, yes, but it s not necessarily the source of the problem - that would be virtualization and processes or a lack thereof Emerging attack methods and imagebotnet propagation techniques can just as easily be problematic for a virtualization-based private cloud as they are for public cloud That s because the problem isn t with necessarily cloud, it s with an underlying poor server security posture that is made potentially many times more dangerous by the ease with which vulnerabilities can be propagated and migrated across and between environments That said, a recent discussion with a cloud startup called CloudPassage has given me pause to reconsider some of the ancillary security issues that are being discovered as a result of the use of cloud computing Are there security issues with cloud computing Yes Are they enabled or made worse because of cloud computing models Yes Does that mean cloud computing is off-limits No It still comes down to proper security practices being extended into the cloud and potentially new architectural-based solutions for addressing the limitations imposed by today s compute-on-demand-focused offerings The question is whether or not proper security practices and processes can be automated through new solutions, through devops tools like Chef and Puppet, or require manual adherence to secure processes to implement CLOUD SECURITY ISN T the PROBLEM, IT S THE WAY WE USE IT AND WHAT WE PUT IN IT We ve talked about cloud security before and I still hold to two things first, there is no such thing as cloud security and second, cloud providers are, in fact, acting on security policies designed to secure the networks and services they provide That said, there are in fact several security-related issues that arise from the way in which we might use public cloud computing and it is those issues we need to address These issues are not peculiar to public cloud computing per se, but some are specifically related to the way in which we might use and govern cloud computing within the enterprise These emerging attack methods may give some credence to the fears of cloud security Unfortunately for those who might think that adds another checkmark in the con list for cloud it isn t all falling on the shoulders of the cloud or the provider in fact a large portion of the problem falls squarely in the lap of IT professionals CLONING One of the benefits of virtualization often cited is the ability to easily propagate a gold image That s true, but consider what happens when that gold image contains a root kit A trojan A bot-net controller Trojans, malware, and viruses are just as easily propagated via virtualization as web and application servers and configuration The bad guys make a lot of money these days by renting out bot-net controllers, and if they can enlist your cloud-hosted services in that endeavor to do most of the work for them, they re making money for nothing and getting bots for free Solution Constant vigilance and server vulnerability management Ensure that guest operating system images are free of vulnerabilities, hardened, patched, and up to date Include identity management issues, such as accounts created for development that should not be active in production or those accounts assigned to individuals who no longer need access BOOMERANGING Public cloud computing is also often touted as a great way to reduce the time and costs associated with development Just fire up a cloud instance, develop away, and when it s ready you can migrate that image into your data center production environment So what if that image is compromised while it s in the public cloud Exactly the compromised image, despite all your security measures, is now inside your data center, ready to propagate itself Solution Same as with cloning, but with additional processes that require a vulnerability scan of an image before its placed into the production environment, and vice-versa SERVER VULNERABILITIES How the heck could an image in the public cloud be compromised, you ask Vulnerabilities in the base operating system used to create the image It is as easy as point and click to create a new server in a public cloud such as EC2, but that server the operating system may not be hardened, patched, or anywhere near secured when it s created That s your job Public cloud computing implies a shared customer-provider security model, one in which you, as the customer, must actively participate blockquote the customer should assume responsibility and management of, but not limited to, the guest operating system and associated application software it is possible for customers to enhance security and or meet more stringent compliance requirements with the addition of host based firewalls, host based intrusion detection prevention, encryption and key management emphasis added -- Amazon Web Services Overview of Security Processes August 2010 Unfortunately, most public cloud provider s terms of service prohibit actively scanning servers in the public cloud for such vulnerabilities No, you can t just run Nexxus out there, because the scanning process is likely to have a negative impact on the performance of other customers services shared on that hardware So you re left with a potentially vulnerable guest operating system the security of which you are responsible for according to the terms of service but yet cannot adequately explore with traditional security assessment tools Wouldn t you like to know, after all, whether the default guest operating configuration allows or disallows null passwords for SSH Wouldn t you like to know whether vulnerable Apache modules like python are installed Patched Up to date Catch-22, isn t it Especially if you re considering migrating that image back into the data center at some point IT S STILL a CONTROL THING One aspect of these potential points of exploitation is that organizations can t necessarily extend all the security practices of the data center into the public cloud If an organization routinely scans and hardens server operating systems even if they are virtualized they can t continue that practice into the cloud environment Control over the topology architecture and limitations on modern security infrastructure such components often are not capable of handling the dynamic IP addressing environment inherent in cloud computing make deploying a security infrastructure in a public cloud computing environment today nearly impossible Too, is a lack of control over processes The notion that developers can simply fire up an image out there and later bring it back into the data center without any type of governance is, in fact, a problem This is the other side of devops the side where developers are being expected to step into operations and not only find but subsequently address vulnerabilities in the server images they may be using in the cloud Joe McKendrick, discussing the latest survey regarding cloud adoption from CA Technologies, writes blockquote The survey finds members of security teams top the list as the primary opponents for both public and private clouds 44pourcents and 27pourcents respectively , with sizeable numbers of business unit leaders managers also sharing that attitude 23pourcents and 18pourcents respectively Overall, 53pourcents are uncomfortable with public clouds, and 31pourcents are uncomfortable with private clouds Security and control remain perceived barriers to the cloud Executives are primarily concerned about security 68pourcents and poor service quality 40pourcents , while roughly half of all respondents consider risk of job loss and loss of control as top deterrents -- Joe McKendrick twitterbird , Cloud divide senior executives want cloud, security and IT managers are nervous Control, intimately tied to the ability to secure and properly manage performance and availability of services regardless of where they may be deployed, remains high on the list of cloud computing concerns One answer is found in Amazon s security white paper above deploy host-based solutions But the lack of topological control and inability of security infrastructure to deal with a dynamic environment they re too tied to IP addresses, for one thing make that a sounds good in theory, fails in practice solution A startup called CloudPassage, coming out of stealth today, has a workable solution It s host-based, yes, but it s a new kind of host-based solution one that was developed specifically to address the restrictions of a public cloud computing environment that prevent that control as well as the challenges that arise from the dynamism inherent in an elastic compute deployment CLOUDPASSAGE rodney_02_tn If you ve seen the movie Robots then you may recall that the protagonist, Rodney, was significantly influenced by the mantra, See a need, fill a need That s exactly what CloudPassage has done it fills a need for new tools to address cloud computing-related security challenges The need is real, and while there may be many other ways to address this problem including tighter governance by IT over public cloud computing use and tried-and-true manual operational deployment processes CloudPassage presents a compelling way to fill a need CloudPassage is trying to fill that need with two new solutions designed to help discover and mitigate many of the risks associated with vulnerable server operating systems deployed in and moving between cloud computing environments Its first solution focused on server vulnerability management SVM - comprises three components Halo DaemonCloudPassageDashboard-HiRes-screenshotpublic The Halo Daemon is added to the operating system and because it is tightly integrated it is able to perform tasks such as server vulnerability assessment without violating public cloud computing terms of service regarding scanning It runs silently no ports are open, no APIs, there is no interface It communicates periodically via a secured, message-based system residing in the second component Halo Grid Halo Grid The Grid collects data from and sends commands to the Halo Daemon s It allows for centralized management of all deployed daemons via the third component, the Halo Portal Halo Portal The Halo Portal, powered by a cloud-based farm of servers, is where operations can scan deployed servers for vulnerabilities and implement firewalling rules to further secure inter and intra-server communications Technically speaking, CloudPassage is a SaaS provider that leverages a small footprint daemon, integrated into the guest operating system, to provide centralized vulnerability assessments and configuration of host-based security tools in the cloud where the cloud is private, public, or hybrid The use of a message-based queuing-style integration system was intriguing Discussions around how, exactly, Infrastructure 20 and Intercloud-based integration could be achieved have often come down to a similar thought message-queuing based architectures It will be interesting to see how well Cloud Passage s Grid scales out and whether or not it can maintain performance and timeliness of configuration under heavier load, common concerns regarding queuing-based architectures The second solution from CloudPassage is its Halo Firewall The firewall is deployed like any other host-based firewall, but it can be managed via the Halo Daemon as well One of the exciting facets of this firewall and the management method is that eliminates the need to touch every server upon which the firewall is deployed It allows you to group-manage host-based firewalls in a simple way through the Halo Portal Using a simple GUI, you can easily create groups, define firewall policies, and deploy to all servers assigned to the group What s happening under the covers is the creation of iptables code and a push of that configuration to all firewall instances in a group What ought to make ops and security folks even happier about such a solution is that the cloning of a server results in the automatic update The cloned server is secured automatically based on the group from which its parent was derived, and all rules that might be impacted by that addition to the group are automagically updated This piece of the puzzle is what s missing from most modern security infrastructure the ability to automatically update modify configuration based on current operating environment context, if you will This is yet another dynamic data center concern that has long eluded many how to automatically identify and incorporate newly provisioned applications virtual machines into the application delivery flow Security, load balancing, acceleration, authentication All these things that are a part of application delivery must be updated when an application is provisioned or shut down Part of the core problem with extended security practices into dynamic environments like cloud computing is that so many security infrastructure solutions are not Infrastructure 20 enabled and they are still tightly coupled to IP addresses and require a static network topology, something not assured in dynamically provisioned environments CloudPassage has implemented an effective means by which at least a portion of the security side of application delivery concerns related to extreme dynamism can be more easily addressed As of launch, CloudPassage supports Linux-based operating systems with plans to expand to Windows-based offerings in the future --------------------------------------------------------------------- Connect with Lori Connect with F5 o_linkedin 1 o_rss 1 o_facebook 1 o_twitter 1 o_facebook 1 o_twitter 1 o_slideshare 1 o_youtube 1 AddThis Feed Button Bookmark and Share Related blogs articles icon-html CloudPassage icon-html Control, choice, and cost The Conflict in the Cloud icon-html The Corollary to Hoff s Law icon-html Infrastructure 20 Squishy Name for a Squishy Concept icon-html The Cloud Metastructure Hubub icon-html Does a Dynamic Infrastructure Need ARP for Applications icon-html Shadowserver realtime botnet stats icon-html Don t Conflate Virtual with Dynamic icon-html Attacks Cannot Be Prevented icon-html There Is No Such Thing as Cloud Security icon-html The Impact of Security on Infrastructure Integration icon-html Rational Survivability Technorati Tags MacVittie,F5,security,cloud computing,virtualization,CloudPassage,firewall,SVM,server vulnerability management,dynamic data center,boomeranging,cloning,vulnerability assessment,SaaS IMAGE http://www.secuobs.com/revue/news/280281.shtmlhttp://www.secuobs.com/revue/news/280281.shtml Secuobs.com : 2011-01-20 15:54:18 - Security - IMAGE A pair of researchers presenting at the Black Hat DC conference are showing off an amusing new attack against laptops and smartphones that's initiated simply by plugging the phone into the PC In a way, it's an obvious attack Instead of making a USB-connected smartphone appear to a host computer as a phone, make it appear to be a mouse or a keyboard and then use that mouse or keyboard to take control of the computer The computer can't tell a real keyboard with real user input apart from a fake one, so is powerless to prevent exploitation The researchers also described how such an attack could propagate the phone could install malware to the PC that would in turn install malware to any new phones They also devised a mechanism to allow one smartphone to directly attack another, using a specially modified USB cable Attacking computers via USB is nothing new the first PlayStation 3 hacks exploited flaws in the console's USB drivers, for example but this approach is novel in that the attackers aren't exploiting coding errors in the computer's USB software they're simply pretending to be a different kind of hardware, one that can do things to the PC that a phone can't The researchers used Android hardware to perform their attack, but in principle it could use pretty much any smartphone Android's open nature makes it the easiest to work with, but a jailbroken iPhone would work just as well To work, the hardware merely has to have a programmable USB controller that can be made to masquerade as an input device To combat such attacks, the researchers say that operating systems must offer the ability to filter USB packets, and alert users more effectively to attempts to connect input devices Current operating systems automatically enable any USB input devices plugged in, with little Windows, Mac OS X or no Linux obvious indication that new hardware has been added Better notifications, along with an ability to refuse to allow the device to connect, would prevent the attacks from succeeding Though whether operating system authors bother is another question as physical access is required, and a similar attack could be made by just typing directly on the computer's keyboard, the real risk in practice is likely to be negligible Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/279567.shtmlhttp://www.secuobs.com/revue/news/279567.shtml Secuobs.com : 2011-01-20 04:45:19 - Security - How do you execute code in a turing complete language via the tag Why, by combining an XSL transform into an SVG image of course I stumbled across this old file in my archives http cevans-appappspotcom static expensive_xsl_svghtml If you run it eg in Chrome, it'll consume a load of CPU and subsequently memory if you let it crank I expect it'll do the same in any WebKit browser, and Opera's error message implies it has all the pieces to follow suit if I tweaked the file a bit It's not a significant security issue, but it's an interesting quirk It works because SVG and XSL are both XML formats, and XSL can use a self-referential construct to operate on itself as the input document If the XSL output XML is valid SVG syntax, then it will render So you can probably pull some crazy tricks to generate a complicated SVG on the fly My sample file doesn't get that far it simply deliberately runs an expensive stylesheet transform with a large output If anyone wanted to play with this, there may be interesting issues with the unusual context the XSL is executing in What if you used xsl import or the document XPath function What origin is used for security checks , etc http://www.secuobs.com/revue/news/279501.shtmlhttp://www.secuobs.com/revue/news/279501.shtml Secuobs.com : 2011-01-20 00:17:22 - Security - IMAGE IMAGE Questions have been raised about the involvement of US government researchers in the creation of a digital weapon that experts believe may have sabotaged centrifuges at a uranium-enrichment plant in Iran Researchers at the Idaho National Laboratory, which is owned by the US Department of Energy, may have passed critical information to Israel about vulnerabilities in a system that controls Iran s enrichment plant at Natanz That information was then used to create and test the so-called Stuxnet worm that was unleashed in a joint cyber attack on Natanz, according to the New York Times Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/279436.shtmlhttp://www.secuobs.com/revue/news/279436.shtml Secuobs.com : 2011-01-20 00:17:22 - Security - IMAGE On Tuesday the FBI arrested and charged two men in their mid-20s for their involvement in last year's attack on AT T servers that mined over 100,000 e-mail addresses from iPad 3G owners Andrew weev Auernheimer and Daniel JacksonBrown Spitler were taken into custody and charged in federal court with one count each of fraud and conspiracy to access a computer without authorization The criminal complaint filed in US District Court in the District of New Jersey has been released, which includes excerpts of some 150 pages of IRC chat logs between Auernheimer, Spitler, and other members of a self-professed troll group known as Goatse Security Those chat logs, turned over to the FBI by an unnamed confidential source, reveal that the group Auernheimer in particular wanted to embarrass AT T publicly over the security flaw they discovered and make the stock price go down in order to troll the company Auernheimer also attempted to spin the story in the press and attempt to paint Goatse Security as a legitimate data security company, and later attempted to destroy evidence after it was announced that the FBI planned to investigate the matter Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/279435.shtmlhttp://www.secuobs.com/revue/news/279435.shtml Secuobs.com : 2011-01-19 22:13:14 - Security - IMAGE Can your boss use your e-mails to your attorney against you Whenever you send those e-mails from your work account, apparently An appeals court in the Sacramento Third Appellate District has upheld a lower court's decision in a wrongful-termination case, saying that attorney-client communications can no longer be considered confidential if you have waived your rights to work e-mail privacy The case was brought by Gina Holmes against her employer, Petrovich Development Company Holmes had an e-mail tiff with her boss, Paul Petrovich, over whether she had misled him about her pregnancy during her interview Petrovich expressed frustration with having hired someone who was pregnant and needed to go on an extended leave, and Holmes was quick to remind him of her rights under California law and the employee handbook Read the rest of this article Read the comments on this post http://www.secuobs.com/revue/news/279335.shtmlhttp://www.secuobs.com/revue/news/279335.shtml Secuobs.com : 2011-01-18 21:26:46 - Security - IMAGE Facebook has put off its plan to allow developers access to users' phone numbers and home addresses The company posted an update on its Developer Blog Tuesday morning, saying that it got useful feedback about the decision and that it would be making changes so that it's clearer when users are about to share such sensitive info As a result, the feature is being turned off until a better solution is found Privacy advocates got up in arms after the company announced that developers would be able to access a whole new level of personal info through its API, as long as the users gave them permission Security firm Sophos issued a solemn warning on its blog about the move the firm pointed out that Facebook app developers already manage to trick users into giving them access to personal data, and the situation will only get worse with real addresses and phone numbers in the mix Read the rest of this article Read the comments on this post http://www.secuobs.com/revue/news/279036.shtmlhttp://www.secuobs.com/revue/news/279036.shtml Secuobs.com : 2011-01-18 17:04:54 - Security - IMAGE Stalker apps on Facebook apps that claim to show you who's been looking at your profile are not real We're telling you that up front because it's not quite obvious to the people who use Facebook, including many Ars readers we know because we see the posts you guys make there Yes, it's incredibly tempting to believe that you will be able to see each time your high school sweetheart cruises your photos, or anytime your crazy housemate does a relationship status check on you without them ever knowing that you're watching them back But alas, it is impossible The apps that have made their way around the social network lately have been a mixture of phishing scams and twists of the truth We've decided it was time to explain why you shouldn't believe anyone who claims you can surreptitiously find out who's been Facebook stalking you Read the rest of this article Read the comments on this post IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/278955.shtmlhttp://www.secuobs.com/revue/news/278955.shtml