Security by the Horns | TechSNAP 83

Show Notes:

Get TechSNAP on your Android:

• Callisto – Android App
• Jupiter Broadcasting – Android App by ShaneQful

Browser Affiliate Extension:

• Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

How a Network Snafu in Indonesia Blocked Google in California

• At around 02:24 UTC on November 6th, about 3–5% of the internet lost the ability to reach Google
• Apparently due to a hardware failure, routers at the Indonesian ISP Moratel started broadcasting BGP routes for Google’s IP ranges
• This caused traffic to be routed to Indonesia for anyone who was fewer hops away from Moratel than from Google
• This had the largest impact in Hong Kong and on the US West Coast, because Moratel’s largest upstream providers is PCCW, a large Hong Kong based transit provider with a lot of peering in California
• The problem was fixed around 02:50 UTC when Moratel shutdown the failed router and disabled peering with Google
• Detailed Analysis

---

Researchers use side channel attack to steal the crypto keys from a virtual machine

• The researchers demonstrated the ability to steal the private encryption keys from a victim VM from an attacker VM on the same physical machine
• This means that an attacker than rents an Amazon EC2 instance on the same physical node as you, may be able to steal your private encryption keys
• There are obvious security implications of this for both Public and Private cloud hosting
• The researchers used an access-driven side channel attack, along with some novel methods of avoiding noise and detecting when their VM was running on a different processor than the victim VM, and they were no longer sharing a cache
• The researchers were able to reconstruct the 457-bit private exponent of a 4096 bit modulus with high accuracy, leaving the attacker to brute force on 10,000 possible exponents to find the correct one
• The attack uses Instruction Cache Spying, and Inter Process Interrupts to preempt the CPU of the victim VM on a regular basis in order to get consistent readings
• Full Paper

*
+ More images of @Netflix CDN hardware from #MeetBSD

Google researcher warns against using Sophos anti-virus

• A google security engineer, Tavis Ormandy, working on his own time has discovered a number of flaws in the Sophos antivirus
• He recommends against using Sophos unless the company can adapt to avoid making numerous newbie mistakes, and to issue patches much more quickly
• Ormandy has released a paper titled Sophail: Applied attacks against Sophos Antivirus
• “Active Sophos users should refrain from testing the examples described in this paper on production systems. Disk I/O on Sophos installations is intercepted by a minifilter that requires a userspace process to permit the operation. Interfering with the userspace process will cause I/O to fail systemwide, panic your machine and cause irretrievable data loss.”
• Specifically, a number of the flaws are the result of “poor development practices and coding standards”
• Ormandy also found that Sophos BOPS (Buffer Overflow Protection System), designed to provide “faux-ASLR” on XP systems, disabled real ASLR on Vista and 7, “allowing attackers to develop reliable exploits for what might otherwise have been safe systems.”
• Ormandy was also critical of Sophos for a lack of response when he reported numerous working exploits against their product
• Sophos Response (with timeline)
• Sophos plans to fix another vulnerability, where a malformed file can cause Sophos to halt entirely, on November 28th
• Sophos initially estimated it would take six months to produce a patch that involved fixing a “single line of code”. According to Ormandy, Sophos subsequently agreed to two months.
• Two years ago, Ormandy was the center of a controversy after he released a proof of concept exploit for a Windows XP flaw just five days after reporting it to Microsoft

---

Feedback:

• Secure logging : techsnap
• auditdistd
• NetBSD syslog w/ TCP and TLS
• syslog-ng
• Retiree who loves TechSNAP!
• Unfair load balancing?
• What’s with the URLs?
• Spying on the Scammers

Round Up:

• MegaUpload redo is shut down even before debut
• Firefox gets strict about enforcement of HTTPS protection
• Microsoft to drop Messenger, switch to Skype
• Skype gave personal information on a 16 year old user to a private security firm
• Apple considering using iPad processors in future Macs
• VUPEN claims to have 0-day exploits for Windows 8 and IE 10 even before its release
• Hacker leaks VMware ESX kernel source code online
• Some smart meters broadcast your usage data over unencrypted wifi for everyone to read
• During EFF case, government claims you don’t own your data stored in the cloud, and they can access it at any time
• IEEE develops standards for voting machines