After trying to debug a boffo customer problem for around 15 minutes today, I finally figured out the root cause of the problem. The problem itself causes me to laugh a little bit, now that I know all of the details.
One of the important certificates issued and used by ipsCA (who I'd never heard of before today) expired on 29-december-2009. It's one thing for a certificate that helps secure a single website to expire ; it is another thing entirely when a CA's certificate expires.
This blog posting is where I was alerted to this problem.
This is a spectacular failure. Wow.
Showing posts with label security. Show all posts
Showing posts with label security. Show all posts
04 January 2010
21 June 2009
Beauty in Engineering
In terms of beauty in engineering, do you know what I find to be beautiful?
Well, here's one thing: it's coming up with a plan to secure a particular network protocol, documenting the plan, and then implementing the plan in code that executes in several radically different environments.
It is (perversely?) pleasurable to see seemingly random bytes be transmitted onto a wire from one peer on the network destined to another very different peer on the network and to have all of these bytes be decoded and authenticated properly. The mathematics behind this stuff is extremely pretty, and making it all work in the Real World is fascinating.
The icing on the cake is knowing that all of the code is efficient and scalable, and that the code has a reasonable test harness so that there are no hidden surprises.
As a character on a TV show once said, I love it when a plan comes together.
Well, here's one thing: it's coming up with a plan to secure a particular network protocol, documenting the plan, and then implementing the plan in code that executes in several radically different environments.
It is (perversely?) pleasurable to see seemingly random bytes be transmitted onto a wire from one peer on the network destined to another very different peer on the network and to have all of these bytes be decoded and authenticated properly. The mathematics behind this stuff is extremely pretty, and making it all work in the Real World is fascinating.
The icing on the cake is knowing that all of the code is efficient and scalable, and that the code has a reasonable test harness so that there are no hidden surprises.
As a character on a TV show once said, I love it when a plan comes together.
01 June 2009
Rant: Microsoft decreases Firefox's security with a forced plugin
Aaarrggh. I am frustrated.
I am somebody who tries to be serious about computer security. Also, I frequently find myself answering questions from friends and family like ``my computer is slow and it seems to be doing a lot of strange things -- can you tell me what is wrong with it?'' This line of questioning nearly always causes my head to throb. The whole state of security on Windoze machines is something that depresses me.
After performing various magic incantations to try to ``fix'' my friends and family's Windoze machines, I always tell my friends and family to stop using Microsoft's Internet Explorer. I look them right in the eye and tell them that I am deadly serious about this -- in my opinion this browser cannot be made to be secure. In fact, I tell them that in my opinion Internet Explorer would be a much better application if, when it first started running, it displayed a splash screen that stated:
Instead of running Internet Explorer, I tell my friends and family to run Firefox. This is a no-brainer. I mean, let's be clear: Firefox isn't totally secure either but it is The Right Choice for my friends and neighbors. One gentleman that I know thanked me a few months ago for recommending Firefox to him several years ago. He is a total computer neophyte, and from what I have been told, his computer has been acting fine for years, with no viruses or malware installed on it.
Anyways, getting back to my frustration: Microsoft, in their infinite wisdom, has decided to include a Firefox plugin in their Microsoft .NET Framework 3.5 Service Pack 1 update pushed to end-user's computers via Windows Update.
Some representative from Microsoft has explained the ``rationale'' for this decision:
Microsoft's actions here are totally crazy.
First of all, I seriously doubt that Microsoft got clear feedback like this.
Second of all, if Microsoft had wanted to publish an addon for Firefox, The Right Place for Microsoft to publish this addon would have been http://addons.mozilla.org/ . Instead of publishing this addon in the proper manner, letting end-users decide for themselves whether they wanted to install this addon or not, Microsoft has shoved this addon down the throats of end-users.
Third, it seems to me that this addon is yet more poorly designed insecure Microsoft crap. In fact, many people (such as myself) who run Firefox run this browser entirely for the reason that totally crazy insecure plugin crap like this hasn't been available for Firefox -- until now.
Fourth, continuing on with the grand nightmare that Microsoft has created here, Microsoft has installed this plugin at the machine level, and has provided no easy way for end-users to uninstall this enormous security problem from their machines. If an end-user wants to uninstall this plugin, they must resort to using the registry editor, which is far from easy.
Basically, here is what I imagine happened recently in Redmond: somebody at Microsoft observed that Firefox is steadily increasing its market share -- it might have even captured 10% of the market by now. This must have worried this in-duh-vidual from Microsoft, which is arguably one of the world's best monopolies. So, what to do about this? Easy! Produce a plugin that gives people all of the same sucky ``user-experience'' and ``security'' as Internet Explorer, and shove it down the throats of all of the people who use Firefox.
Way to go, Microsoft! I, for one, seriously doubt that this company has my best interests in mind with actions like this one.
I am somebody who tries to be serious about computer security. Also, I frequently find myself answering questions from friends and family like ``my computer is slow and it seems to be doing a lot of strange things -- can you tell me what is wrong with it?'' This line of questioning nearly always causes my head to throb. The whole state of security on Windoze machines is something that depresses me.
After performing various magic incantations to try to ``fix'' my friends and family's Windoze machines, I always tell my friends and family to stop using Microsoft's Internet Explorer. I look them right in the eye and tell them that I am deadly serious about this -- in my opinion this browser cannot be made to be secure. In fact, I tell them that in my opinion Internet Explorer would be a much better application if, when it first started running, it displayed a splash screen that stated:
Friendly reminder: by running this browser, you are authorizing one or (probably many) more people who most likely reside in eastern Europe or the Far East to be able to run arbitrary code on your machine. These people will be in complete control of your computer. They will be able to steal anything from your computer, and be able to use your computer to mount attacks against other computers. Have fun on the Internet, and thank you for choosing a Microsoft product!
| OK! |
Instead of running Internet Explorer, I tell my friends and family to run Firefox. This is a no-brainer. I mean, let's be clear: Firefox isn't totally secure either but it is The Right Choice for my friends and neighbors. One gentleman that I know thanked me a few months ago for recommending Firefox to him several years ago. He is a total computer neophyte, and from what I have been told, his computer has been acting fine for years, with no viruses or malware installed on it.
Anyways, getting back to my frustration: Microsoft, in their infinite wisdom, has decided to include a Firefox plugin in their Microsoft .NET Framework 3.5 Service Pack 1 update pushed to end-user's computers via Windows Update.
Some representative from Microsoft has explained the ``rationale'' for this decision:
A couple of years ago we heard clear feedback from folks that they wanted to enable a very clean experience with launching a ClickOnce app from FireFox.
Microsoft's actions here are totally crazy.
First of all, I seriously doubt that Microsoft got clear feedback like this.
Second of all, if Microsoft had wanted to publish an addon for Firefox, The Right Place for Microsoft to publish this addon would have been http://addons.mozilla.org/ . Instead of publishing this addon in the proper manner, letting end-users decide for themselves whether they wanted to install this addon or not, Microsoft has shoved this addon down the throats of end-users.
Third, it seems to me that this addon is yet more poorly designed insecure Microsoft crap. In fact, many people (such as myself) who run Firefox run this browser entirely for the reason that totally crazy insecure plugin crap like this hasn't been available for Firefox -- until now.
Fourth, continuing on with the grand nightmare that Microsoft has created here, Microsoft has installed this plugin at the machine level, and has provided no easy way for end-users to uninstall this enormous security problem from their machines. If an end-user wants to uninstall this plugin, they must resort to using the registry editor, which is far from easy.
Basically, here is what I imagine happened recently in Redmond: somebody at Microsoft observed that Firefox is steadily increasing its market share -- it might have even captured 10% of the market by now. This must have worried this in-duh-vidual from Microsoft, which is arguably one of the world's best monopolies. So, what to do about this? Easy! Produce a plugin that gives people all of the same sucky ``user-experience'' and ``security'' as Internet Explorer, and shove it down the throats of all of the people who use Firefox.
Way to go, Microsoft! I, for one, seriously doubt that this company has my best interests in mind with actions like this one.
11 August 2008
Report from BlackHat 2008
I was pretty psyched that my employer sent me out to Black Hat last week. It was nice to hang out with a bunch of people who are enthusiastic about discussing computer security issues.
I wish I could have spent the entire week at the conference. Maybe next year. I got a good taste for the issues at hand, but I found myself yearning for more technical content.
The marquee talk that was presented at Black Hat was given by Dan Kaminsky on the subject of DNS security. I didn't actually attend this talk because it was mobbed and I am already very familiar with this issue. Basically, the problem Kaminsky has brought to light has to do with the low-level details of how the DNS protocol works. A sufficiently skilled attacker can poison a DNS server using faults in how the DNS protocol is specified and implemented. Kaminsky presented a significant new attack in this space.
After having some time to reflect on this attack, I am struck by how similar Kaminsky's attack is to a previous attack -- the attack first documented by Morris and made famous by Mitnick (who attacked Shimomura). This style of attack has been well-understood for decades now. When you get down to it, if an attacker decides to attack a protocol that is protected with easily guessable sequence numbers (or else the attacker can flood the host that he/she wishes to attack), the security of the protocol will soon be compromised.
Look how far we (haven't) come...
I wish I could have spent the entire week at the conference. Maybe next year. I got a good taste for the issues at hand, but I found myself yearning for more technical content.
The marquee talk that was presented at Black Hat was given by Dan Kaminsky on the subject of DNS security. I didn't actually attend this talk because it was mobbed and I am already very familiar with this issue. Basically, the problem Kaminsky has brought to light has to do with the low-level details of how the DNS protocol works. A sufficiently skilled attacker can poison a DNS server using faults in how the DNS protocol is specified and implemented. Kaminsky presented a significant new attack in this space.
After having some time to reflect on this attack, I am struck by how similar Kaminsky's attack is to a previous attack -- the attack first documented by Morris and made famous by Mitnick (who attacked Shimomura). This style of attack has been well-understood for decades now. When you get down to it, if an attacker decides to attack a protocol that is protected with easily guessable sequence numbers (or else the attacker can flood the host that he/she wishes to attack), the security of the protocol will soon be compromised.
Look how far we (haven't) come...
Subscribe to:
Posts (Atom)