I’ve been watching this for a while now, and took note of a recent ruling in a US court which said you have no expectations of privacy at the border when returning from international travel. This means that when you are returning from an international flight to the US you are not on US ground when you land, and you miss out on many of your constitutional protections, apparently. Border agents can take ALL your electronic devices and make copies of the data, they can compel you to login to your computer, they can request encryption keys, they can do all of this with out having a reason for suspicion. All those emails, love letters, family pictures, they can all become goverment property just because they feel like it. There are no formal rules regulating it either yet.

If you don’t think this is a problem, I suggest you invite the police to come into your home and search through all your records, all your receipts, all your drawers, everything. I’m sure they can find some little law somewhere you broke (got an illegal radar detector? Didn’t pay USE tax on those internet purchases? Maybe a bad cop finds some intimate photos of you and the wife and decides to earn some money on the side by blackmailing you, or just enjoy them personally), cross your fingers.

Right now there is little to NOTHING you can do about it. And this hasn’t received much attention from mainstream press yet, which is sad. It’s all done in the name of protecting against terrorist and child molesters, and it will likely help neither of those causes. What it does mean are your corporate secrets on those company laptops are now the Government’s. All those personal moments in email and photos are now the Government’s. Your new idea you haven’t gotten patented yet that was going to let you break into the big time? Yeah, gov’t has it now.

If you worry at all about this (which you should if you travel internationally) you should write your representatives. They could at least have the common courtesy of setting some regulations and limitations on it. Oh, and yes other Governments can do this too. Flying into the UK? Yes they can search you just the same. Think twice about your laptop, smartphone, pda, they hold a LOT of information.

Here is a good article talking about how you might be able to do to protect your “Intellectual Property” (I hate that term, but at least I’m using it for good, kinda). Schneier on Security

Busy once more trying to finalize the Security Track for LinuxWorld San Francisco. Will be hard to top some of the speakers from last year, but I’ve got some very interesting topics this year. I just always forget how hard it is to coordinate all the different speakers’ times and communication.

Last year I actually missed out on attending LinuxWorld as I was on baby watch (the little one was due any day around that time), but looking forward to making it this year!

I run several servers, all of which run linux, OpenSSH, and Apache HTTPD. Some run VSftpd as well (legacy requirements). They all are attacked by brute force hacking attempts daily, yes daily. Every day I go through my logs and see the 10’s of thousands of attempted break in attacks. It’s annoying, it tends to make the log files very long to look through. Even my parsed and abstracted log reports are forced into long lists of attacking IP addresses and attempted usernames. Here is an example from just today on ONE server:

Failed SSH logins: 2971

Failed FTP logins: 18,415

Faild SMTP logins: 1656

And this is not a server hosting super popular websites or mirrors. This is just a no name server hosting a couple of websites. In the past I used to contact the owners of the IP addresses these came from, but it became tedious and difficult. They’re often internet providers dynamic IPs of clients, which the ISP tends to not care they are attacking my server (most likely, they are trojaned anyways).

All these attempted attacks do is waste resources. They waste my bandwidth, processing, and storage (the log files).

Just me deciding to put into writing one of my daily annoyances.

Well, today is a good day not to live or work in Germany if you make your living with technology.  Today Germany officially makes it illegal to use or develop security tools which could at all be used as “hacking tools” regardless of actual use or intent.  That means you can’t create or use a tool to scan your own network for errors in security that you made.  So you’ll just have to wait until some Black Hat hacker breaks into your network to learn of your mistakes.  Man is this a stupid law..

Germany enacts “anti-hacker” law

Here is a good article on what SELinux in RHEL 5 has brought to the table. Some cool new features and a lot more protection:

http://www.redhatmagazine.com/2007/05/04/whats-new-in-selinux-for-red-hat-enterprise-linux-5/

There is also some interesting points in the comment section. Basically, a reminder that NO security mechanism is 100% safe, but it’s better than nothing and should always be considered when looking at what you need for your deployment.

— @page { size: 8.5in 11in; margin: 0.79in } P { margin-bottom: 0.08in } –>

Ok, been a busy busy couple of months, two conferences down, two scheduled.

In February, I helped with the new LinuxWorld/OpenSolutions World Summit in NY. The show did pretty well, but the weather really messed it up (warning to others, don’t schedule a conference during a massive snow/ice storm, really messes things up LOL). I missed most of the first day when my 4 hour drive turned into around 8 hours, and I didn’t get to leave until 4 hours later than planned. The show’s presentation are are being pod casted here:

http://www.linuxworld.com/events/

Next on the list was the FOSE 2007 show where I helped organize the Tux.org non-profit booth. We handed out over 1,000 issues of Linux Journal with an intro to Linux flier, over 1000 CD/DVD Linux Distros, a couple dozen live FreeBSD CDs, and numerous other giveaways. We had some generally interested people talk to us and it’s nice to see more and more people actually know what Linux is and what OpenSource really means. Here’s some information on what we were doing:

http://www.cyberigor.com/fose/

Well, that takes care of what’s been happening, Now coming up this week is the ShmooCon conference:

www.shmoocon.org

I love this conference, has some great speakers, Bruce Potter and the rest of the Shmoo Group do an amazing job with it. Starts in about 3 hours, going to be a fun weekend!

Finally LinuxWorld/OpenSolutions World San Francisco 2007 is starting up. Hoping to get some real good speakers lined up for the Security track (which I’m track chair for). Anyways, not much to see, but here’s the site for that:

http://www.linuxworldexpo.com/live/12/events/12SFO07A

Well, once again, I seem to be sparse on the posts. Maybe it’s because I’ve been busy with LinuxWorld Summit NY, or trying to get a new software project at work finished, or maybe cause I’m devoting my free time to my new Nintendo Wii. Well truthfully it’s a little of all the above (and a lot of getting my new software project working), but I did run across this little interesting tidbit:

http://www.nintendoworldreport.com/newsArt.cfm?artid=12687

I hadn’t seen this published broadly, but it appears that the version of opera currently under beta testing to Wii users (any Wii owner can download and play with Opera 9 on their Wii for free) has a vulnerability that can at minimum cause the Wii to hard lock. Currently there is no reported exploit that can run code on the Wii, which would normally be a threat from this exploit, and not clear if it ever will given that Game Consoles are usually pretty strict in what code is or isn’t allowed to run.

Anyways, interesting to see how the age of the desktop vulnerability has come to the game consoles world, even Nintendo. Wonder how long it takes them to issue a fix?

Ok, been meaning to write a little about this, just couldn’t find the time.

To ALL those in charge of taking private information via secure webforms (credit cards, SSN, etc..) PLEASE READ THIS.

Yes, you must use an SSL encrypted webpage, yes you must only give that information collected to those who are directly responsible for billing the transaction. But DO NOT EMAIL all the information to anyone, and certainly don’t include it in the confirmation email!

I say this because I recently registered for a workshop I plan on attending. I’m not going to name the institution that is running it, nor am I going to mention the name of the course (though I must admit if I was presenting at the workshop I would be very pissed to learn that this was how they were sending confirmation emails). My company is paying for the workshop so they used the company credit card and the administrative assistant took care of the registration for me. Shortly after they registered me, I received the confirmation email. What did I find in that email that they sent to me (and to one other email address that we didn’t recognize), my contact information, all the contact information for the person holding our company card, the full credit card number, the Expiration date, and the CCV Code!

They emailed out everything you could possibly need to use the credit card at any online vendor in a plain text email over the unencrypted PUBLIC INTERNET!!!!

The fact that they had a nice SSL encrypted website to take this information just made the situation worse. Through their actions they have violated the trust relation they setup by presenting what appeared to be a secure internet transaction. By emailing the information they collected back over the internet, they placed that information at even more risk than if it was not emailed, but didn’t use an SSL cert. Now our credit information is being cached unencrypted on at least 2 email servers (most likely 4 or more) for who knows how long. If those machines are compromised or someone was having fun watching that traffic, they could now be purchasing a couple of big screen HDTV’s maybe a laptop or 4, subscribing to every porn site they want, etc..

People have got to remember that your responsibility for the secure transaction on the web doesn’t end at the SSL encrypted webform. It continues for as long as you hold and maintain that private information. End-to-end, review your policies, before it comes back to bite you.

I’ve been nice and I’m trying to work with these people to make sure they get this corrected. So far they seem to be listening (though action is a little slower). Hopefully they will get it, time will tell. If I had been someone less friendly, this could have been a much bigger headache for them.

Ok, here is the actual interview that I had with Network World.  I really like how it came out, I think Phil Hochmuth did an excellent job taking what I had said and presenting it to the reader.  This is also the interview where they had taken the quote from for the previous article.   Well here it is if you are interested:

LinuxWorld experts: Securing Web-based application on Linux

A pretty good article about the upcoming LinuxWorld/OpenSolutions World Conference and expo came out in the online magazine Network World today. I was even quoted in it at the bottom of the second page. It was an interesting interview, and I believe I rambled on for way too long, but they managed to get my main point, that is, Security is about finding the right compromises, and there are good tools now and in the near future to help us get there.

Now there is one small issue, and I’m posting this as a correction. I am not currently working on development of SELinux technology. I am working on some policy stuff, but I am not active in the community development of the technology currently. I have worked on it in the recent past, and plan to continue in the near future (though I am thinking of helping out indirectly via SEDarwin). I just wanted to make that clear. I support SELinux, I’m trying to help promote and improve SELinux, but I’m not a core developer of the technology. There are others such as the NSA, Trusted Computer Solutions, IBM, Tresys Technology and several other groups and companies that are putting in the hard work to make this technology a reality in the production world.

Here is the article for those interested.

« Previous PageNext Page »

Copyright © 2015 · All Rights Reserved · Cafaro's Ramblings