Signed by Sony | TechSNAP 192

chris

8 years ago

If we could rebuild the Internet from scratch, what would we change? It’s more than just a thought experiment. We’ll share the details about real world research being done today!

Plus we dig through the Sony hack, answer a ton of great question & a rocking roundup!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Reinventing Computers And The Internet From Scratch, For The Sake Of Security

DARPA funded research is looking at how we might design the Internet if we had to do it over again
Many decisions that were made 30 and 40 years ago when UNIX and TCP/IP were designed, may be done differently today
The overall project has a number of sub-projects:
- CRASH – Clean-Slate Design of Resilient, Adaptive, Secure Hosts
- MRC – Mission-Oriented Resilient Clouds
- CTSRD – Clean Slate Trustworthy Secure Research and Development (Custard)
BERI: Bluespec Extensible RISC Implementation: a open-source hardware-software research and teaching platform: a 64-bit RISC processor implemented in the high-level Bluespec hardware description language (HDL), along with compiler, operating system, and applications
CHERI: capability hardware enhanced RISC instructions: hardware-accelerated in-process memory protection and sandboxing model based on a hybrid capability model
TESLA: temporally enforced security logic assertions: compiler-generated runtime instrumentation continuously validating temporal security properties
SOAAP: security-oriented analysis of application programs: automated program analysis and transformation techniques to help software authors utilize Capsicum and CHERI features
The goal is to design newer secure hosts and networks, without having to maintain backwards compatibility with legacy systems, the biggest problem with changing anything on the Internet
This is why there are still things like SSLv3 (instead of just TLS 1.2+), why we have not switched to IPv6, and why spam is still such a large problem
I for one would definitely like to replaced SMTP, but no one has yet devised a plan for a system that the world could transition to without breaking legacy email while we wait for the rest of the world to upgrade
“Corporations are elevating security experts to senior roles and increasing their budgets. At Facebook, the former mantra “move fast and break things” has been replaced. It is now “move slowly and fix things.””
For performance reasons, when hardware and programming languages were designed 30 and 40 years ago, it was decided that security would be left up to the programmer
The CHERI project aim to change this, by implementing ‘Capabilities’, a sandboxing and security mechanism into the hardware, allowing the hardware rather than the software to enforce protections, preventing unauthorized access or modification of various regions of memory by malicious or compromised applications.
CHERI, and the software side of the project, Capsicum, are based on FreeBSD, but are also being ported to Linux, where Google plans to make extensive use of it in its Chrome and Chromium browsers.
Additional Coverage

Sony Internal Network Hacked

No, this is not Episode 3 of TechSNAP, Sony was hacked, again
Hackers identifying the selves as Guardians of Peace (GOP) claim to have stolen as much as 100TB of data from Sony
One questions how they managed to exfiltrate such a huge amount of data without being noticed. A full 1 GBPS internet connection would have to run at full capacity for 10 days to move that much data. It seems a lot of the data was likely compressible, but unreleased movies etc would not be
At this point, only about 40GB of data has been leaked, mostly internal documents
“The data dump includes employee criminal background checks, salary negotiations, and doctors’ letters explaining the medical rationale for leaves of absence. There are spreadsheets containing the salaries of 6,800 global employees, along with Social Security numbers for 3,500 U.S. staff. And there is extensive documentation of the company’s operations, ranging from the script for an unreleased pilot written by Breaking Bad creator Vince Gilligan to the results of sales meetings with local TV executives.”
When will companies learn that a spread sheet is not a secure place to store sensitive information
In a memo to Employees Sony Pictures Entertainment chiefs Michael Lynton and Amy Pascal said “While we are not yet sure of the full scope of information that the attackers have or might release, we unfortunately have to ask you to assume that information about you in the possession of the company might be in their possession,”
Additional Coverage – CNET – 47,000 Social Security Numbers leaked, Celebrity Data included
Additional Coverage – Sony Employees receive email threats: “your family will be in danger”
Additional Coverage – BuzzFeed – Inside the Sony Data
Additional Coverage – Gizmodo – Sony hack worse than thought
Additional Coverage – Washington Post
Additional Coverage – Edgadget
Additional Coverage – The Verge
George Clooney predicted the Sony Hack in December (in a now leaked email)
Additional Coverage – BitDefender – Take Aways from the Sony Hack
Additional Coverage – ArsTechnica – Attackers also stole certificates to sign malware

Feedback:

Jupiter Dev Summit on Monday the 15th
Remotely activate/disable firewall rules?
AuthPF (works, especially remotely)
FreeNAS/ZFS Filesystem Relationships
Screenshot
Naming software bugs like storms
[ways to use as much bandwidth a possible? ](https://www.reddit.com/r/techsnap/comments/2oftzo/ways_to_use_as_much_bandwidth_a_p
ossible/)
Malware Authorship Language
31C3 – The 31st Chaos Communication Congress Who will be there?