Security

It's really easy to use ZFS dataset encryption to protect your data in a way so you have to know something and to own something to get access to encrypted data.

Darren Moffat wrote a great blog article about the internals of the ZFS encryption - "ZFS encryption what is on disk ?":

This article is about what is and isn't stored encrypted on disk for ZFS datasets that are encrypted and how we do the actual encryption. It does require some understanding of Solaris and ZFS debugging tools.

Darren wrote three really interesting articles about ZFS encryption: The first one is Introducing ZFS Crypto in Oracle Solaris 11 Express. This blog entry gives you a first overview how to use encryption for ZFS datasets. The second one titled "Assured delete with ZFS dataset encryption" explains how you can use the encryption feature to implement assured deletion with the "throwing the keys away" technique. Last but not least the article "Having my secured cake and Cloning it too (aka Encryption + Dedup with ZFS)" explains how deduplication and encryption work together in Solaris 11 Express.

One of the hidden gem of Solaris is the kssl feature. Long-time readers know this feature, as i wrote a tutorial about it. For the uninitiated: It's a in-kernel SSL proxy. Why should you put this in the kernel. Well, especially when you use a SSL-accelerator you have to jump from user space to kernel space and back several times as the SSL library (OpenSSL e.g) is in user space and the driver for the card is in kernel space. That jumping costs you a lot of time. There is an interesting article about Weblogic SSL performance in the BestPerf blog.

When you just want to take one thing out of this whole article, then just look at the first chart at the red and the blue line: Red is the system configured to provide SSL via kssl, blue is the system configured to provide SSL via Weblogic itself. Both systems are using the SSL hardware. I don't know how you would call it, but the difference is pretty significant. A good example, why kssl is such a nice tool. And it's just there in Solaris 10.

The german IT news portal Heise linked to an interesting paper: "Anonymous Bluetooth Probes for Measuring Airport Security Screening Passage Time: The Indianapolis Pilot Deployment".

An interesting concept: Anybody who just start the Bluetooth scan on her/his notebook knows that there are several mobile phones on almost any given location with a large audience propagating a unique id to the world by their MAC address. Using this information to derive some useful facts from it (for example: Duration of the average TSA massage) looks like as one of the more worthy targets for tradeoffs on privacy vs. useful services in favor to the second one. Especially as it's really easy to evade from this data collection: Just switch off the bluetooth function of your mobile.

PS: I would like a bluetooth scanner in the aircraft itself ... it's really interesting how many mobile phones are running inflight. Such a scanner could send a vcard containing "Just switch off your fscking mobile phone". Did that once a few minutes before takeoff ... that was very effective

There was some discussion about possible attack vectors for checksum-only deduplication. However i don't think the proposed vectors are really feasible. The first attack tries to create data corruption by foiling deduplication into using a thoughtfully created block, with the same checksum but different data. Another, less discussed attack vector, is gaining knowledge of a block by using a thoughtfully created block to foil dedup to show you a different block than the one you have actually written, as the checksum-only variant didn't stored your block, but just created a pointer to data written beforehand.

This is a nice example, why those backscatter airport scanners are not the solution of all problems in airport security. The interesting part starts at 18:05 of this video available in the ZDF mediathek (an public broadcasting network in Germany). Despite being scanned they are not able to find the thermite the scientist is carrying. The guy demoing the scanner doesn't look amused as well as Mr. Bosbach, a german politician who thinks that we should use such scanners, if they are able to protect the privacy of the scanned peoples.

It turned out that the images of a story about "What a nude scanner" in germanys favorite gossip catapult and tabloid were faked: BildBlog - a watchblog dedicated to this tabloid - reports in "Kehraus 2009" that this newspaper just used a "Negative" plugin of their favorite photo alteration application to create such photos from a cd containing photos of a nude woman...

There is a lot of discussion about the backscatter scanners (or as the media calls them: "nude scanners") in Germany at the moment. Technically it's in discussion for a long time. I wrote about it in 2005 after Bruce Schneier wrote about it. My thought at this moment was "Okay, they will need an aircraft blown out of the sky to force this into the public".

Personally i think the this is lobby at work at the moment. It's a big business to implement backscatter at all airports in germany alone. Just think about the central security area in Hamburg.10 entries ... ka-ching .... and Hamburg is a relatively small airport.

At first: I have no problem with backscatter scanning. Technically the current metal detectors look through my clothing as well. So if a backscatter scanner makes no images and instead just make "boink" (as we all know, scientific progress goes "boink") and then get a TSA massage, i'm fine with that.

I'm not fine with high resolution nude photos of every one just want to fly, i'm not fine with spending millions for back scatter scanners, while the people at security can decide to flip burgers or searching people at almost the same wage, i'm not fine with dumbed down version of this scanners with software to protect the privacy as the bad-guys will find ways to use this dumbing-down to fool this device (i want just simple logic .. there is something else than your leather underpants or your latex bra under your clothing .... "boink" -> TSA massage). I'm not fine with with maximal invasive security counter measures, that just helps against past attacks, but not against future attacks.

The same politicians that force us into this back scatter scannings will be the first ones that will cry when the "Bild Zeitung" will publish the length of their private parts. Who prevents someone who can flip burgers for the same wage to get bribed for not seeing a bomb in his or her shift or for writing down interesting information about prominent people. In former times we used well-paid public servant for this task to reduce this risk ... but today.

And at the end those back scatter scanning is somehow futile anyways: Drug dealers found out that it's quite simple to hide drugs inside a person. Backscatter can't detect it, as it stops at the first layer of the skin. So what's the problem to substitute the cocaine with Semtex to create a not-so-intelligent bomb?

Gestern lief das Webseminar "Solaris 10 Security". Dieses möchte ich Euch nun als Video zur Verfügung stellen:


Ich hoffe es ist informativ für Euch. Der CC-Teil am Anfang ist etwas vereinfacht für Einsteiger in die Thematik. Ich möchte mich bei einem der Zuhörer für die freundliche Zurverfügungstellung der Aufzeichnung bedanken, nachdem das im Tool selber nicht funktionierte. Vielen Dank!

I'm really frustrated at the moment. My second webseminar "Solaris Security" was scheduled for today. We use WebEx for our presentations, so you use a java tool for the slides and use the ordinary telephone for the audio track of the presentation. Everything went well ... until some minutes into the presentation. I was thrown out of the telephone conference. I've noticed this situation 10 minutes later, so i've talked with the void for quite a while. I wasn't able to get back. I've tried with the fixed line, with my job cell phone, even with my private cell phone. But no chance. I wasn't able to get back into the call. At the end we stopped the call. In the hindsight the signs were on the wall, because there were significantly less users in the telephone conference than in related the WebEx tool session right from the start.

We have a new time for the call: 13.10.2009 from 14pm to 15pm. Sorry for any inconvenience. But this give others the chance to attend the meeting: So if you haven't been able to register for the event today, you can use the old form to register for the new date. Everyone else should already have the mail with the details for the next event.

PS: I've checked the Webex voice numbers a few minutes ago .. still broken ...

I've finalized the presentation i want to hold tomorrow. In a series of web seminars in german language i'm presenting on Solaris Security tomorrow afternoon. I don't think i will put the german version online at my own blog, but i'm thinking about an english version. I just integrated a short chapter about the Immutable Service Container. This is really an interesting concept introduced by Glen Brunette. But i have just an hour. So many topics and not enough time.

Whenever a friend asks me about a tip in regard of flying and getting rid of the fear of flying a give them some hints and at the end i make the joke "Oh, and then there are the people who ask you friendly to bend over while thy putting on a latex glove. Just relax". All muscles of the face just go south and the reactions are just to funny to leave out this joke. Just be sure, that you don't start to smile

The problem: I don't think that using a plane will be fun, when you think about the implications of the latest attack on a saudi prince: The assassin had the bomb inside of his body ... to be exact ... in his colon. That's looks to be the newest fashion in not-so-smart bomb technology. With George W. Bush i would be sure, that would lead to rectal probing for everyone. With Obama i have some hope, that they won't go this far. Perhaps we just see an increased rate of radiation induced cancer due to mandatory X-ray examinations at the airport, because the backscatter scanners (we call them "nude scanner" in Germany) are not capable to look into a body, just under the clothes.

PS: I don't know what Mr. Schaeuble will do in regard of this.

The cryptographic algorithm AES is everywhere. You find it in your router, you find in your OS. Your WiFi network use it. And probably the three-letter agency in your country,too . But how does it works? Jeff Moser wrote (well, it's more a comic) the "Stick Figure Guide to the Advanced Encryption Standard (AES)". A really great explanation of AES.

The Apache Foundation had a security breach a few days ago (no, not on the Solaris 10 system ), that led to the compromitation of their services. A nice information was the role that ZFS played in the recovery of this situation. The Infastructure Team wrote in their article about the recovery:

aurora.apache.org runs Solaris 10, and we were able to restore the box to a known-good configuration by cloning and promoting a ZFS snapshot from a day before the CGI scripts were synced over. Doing so enabled us to bring the EU server back online, and to rapidly restore our main websites. Thereafter, we continued to analyze the cause of the breach, the method of access, and which, if any, other machines had been compromised.