uncompiled.com

There are a wide variety of logging functions and services on UNIX. Some of these, such as the Solaris audit facility, are limited to a particular variety of UNIX. It is important that the digital forensics analyst become familiar with the logging deployed on the UNIX system that they are reviewing. In particular, have a look at the syslog configuration file, the “/var/log” and “/var/run” directories and check if there are any remote log servers. Syslog is a network service that is most commonly run locally. This allows for the capability of sharing logs to a remote system.

Source

The Veterans Affairs Department’s inspector general has launched a criminal investigation into a physician assistant’s alleged downloading of veterans’ clinical data at its Atlanta medical center, sources have told Nextgov.

The assistant allegedly recorded two sets of patient data on to a personal laptop for research purposes. One set included three years’ worth of patient data and another held 18 years of medical information, according to a source familiar with the incident and who asked not to identified.

Roger Baker, VA’s chief information officer, commented on an item about the incident that was posted Monday evening on a Nextgov blog that the physician assistant’s laptop was never connected to the VA network and any data she recorded on her laptop was “hand entered.”

But the source told Nextgov the VA inspector general is investigating whether the assistant used two thumb drives to transfer the data to the laptop.

The department has not disclosed the number of patients involved in the incident, what kind of personal data was copied, or whether it plans to notify the veterans whose records were downloaded.

VA spokeswoman Katie Roberts said she cannot comment in detail on the Atlanta breach because it is under investigation. But in an e-mail, she stated, “VA is committed to protecting the privacy of veterans who have used our health care facilities. VA’s Office of Inspector General is currently investigating a report that a former VA physician assistant stored unauthorized clinical data about patients at the Atlanta [VA medical center] on a personal laptop computer.

“VA’s Office of Information and Technology is trying to gather more details about the circumstances, including the number of veterans whose information was involved and the nature of the information affected. The results of the investigation and analysis will help determine whether to send notifications and offers of credit protection services to the affected veterans.”

The inspector general has asked VA’s Office of Information and Technology, which Baker heads, to determine how many veterans were involved in the data breach and what kinds of personally identifiable or private health information might be involved.

The inspector general has determined that multiple documents on the laptop “appear to have come from an unapproved research project,” noted a document about the incident, which Nextgov obtained.

The incident is reminiscent of a 2006 cybersecurity breach at VA. In what was one of the largest security lapses in the department’s history, a Veterans Affairs analyst downloaded information on 26.5 million patients — practically every living veteran — on to the hard drive of his personal laptop so he could work on a research project at home. The laptop was later stolen and recovered. Investigators determined the personal information likely was not accessed.

But the breach resulted in VA instituting policies to bar the connection of personal computers to Veterans Affairs networks and to encrypt all patient data stored on department computers. Violation of the policies could result in could result in administrative, civil or criminal penalties.

In his comment on the Nextgov blog, Baker said those policies worked in the Atlanta case and the physician assistant was denied access to VA systems. In addition, a nurse scientist and visiting scholar at the medical center stopped the assistant from using the data after learning about the unapproved research project, according to the document on the incident. The nurse told the physician assistant to destroy the data, and when it was not destroyed, the nurse informed a research compliance officer in Atlanta on Feb. 8. The physician assistant resigned on Feb. 26, according to the document.

The breach illustrates the need for patients, not clinicians, to control their medical records, said Dr. Deborah Peel, founder of Patient Privacy Rights, a nonprofit based in Austin, Texas, that works to ensure medical information remains restricted. She said control should include a requirement to obtain a patient’s consent to send clinical information to another doctor or to use it for research. Peel added electronic consent software currently exists to automate the process.

Source

The last six months have been exciting for Digg’s engineering team. We’re working on a soup-to-nuts rewrite. Not only are we rewriting all our application code, but we’re also rolling out a new client and server architecture. And if that doesn’t sound like a big enough challenge, we’re replacing most of our infrastructure components and moving away from LAMP.

Perhaps our most significant infrastructure change is abandoning MySQL in favor of a NoSQL alternative. To someone like me who’s been building systems almost exclusively on relational databases for almost 20 years, this feels like a bold move.
What’s Wrong with MySQL?

Our primary motivation for moving away from MySQL is the increasing difficulty of building a high performance, write intensive, application on a data set that is growing quickly, with no end in sight. This growth has forced us into horizontal and vertical partitioning strategies that have eliminated most of the value of a relational database, while still incurring all the overhead.

Relational database technology can be a blunt instrument and we’re motivated to find a tool that matches our specific needs closely. Our domain area, news, doesn’t exact strict consistency requirements, so (according to Brewer’s theorem) relaxing this allows gains in availability and partition tolerance (i.e. operations completing, even in degraded system states). We’re confident that our engineers can implement application level consistency controls much more efficiently than MySQL does generically.

As our system grows, it’s important for us to span multiple data centers for redundancy and network performance and to add capacity or replace failed nodes with no downtime. We plan to continue using commodity hardware, and to continue assuming that it will fail regularly. All of this is increasingly difficult with MySQL.
Choosing an Alternative

Digg is committed to the use and development of open source software and we’re keen to avoid the cost of proprietary large-scale storage solutions. We were inspired by Google and Amazon’s broad use of their non-relational BigTable and Dynamo systems. We evaluated all the usual open source NoSQL suspects. After considerable debate, we decided to go with Cassandra.

Simplistically, Cassandra is a distributed database with a BigTable data model running on a Dynamo like infrastructure. It is column-oriented and allows for the storage of relatively structured data. It has a fully decentralized model; every node is identical and there is no single point of failure. It’s also extremely fault tolerant; data is replicated to multiple nodes and across data centers. Cassandra is also very elastic; read and write throughput increase linearly as new machines are added.

We experimented on our live site, replacing a relatively high scale MySQL component with a Cassandra alernative. These tests went well. You can read more about these experiments here.
Where We Are

At the time of writing, we’ve reimplemented most of Digg’s functionality using Cassandra as our primary datastore. We’ve supplemented Cassandra-based indexing using full text, relational and graph indexing systems. We’re getting used to dealing with eventual consistency.

We’ve been working on Cassandra itself too. We’ve made massive performance improvements: increased comparitor speed, added better compaction threading, reduced logging overhead, added row-level caching and implemented multi-get capability. We’ve also implemented native atomic counters using Zookeeper (you can probably guess why were motivated to add that feature :)

We’ve tested and improved the operational capabilities of Cassandra, upgrading its Rackaware capability, added slow query logging, improved the bulk import functionality and implemented Scribe support for improved logging. We’ve also done a ton of operational testing.

We’re open sourcing all our work on Cassandra.
What’s Next?

Currently our main focus is getting Digg’s latest release into general availability, but we’ll continue to lead the way in championing Cassandra’s development and adoption.

If you’re interested in joining a world-class team using cutting edge, NoSQL technology at scale, check out http://jobs.digg.com

Take it easy,
John Quinn. VP Engineering. (Digg: doofdoofsf, Twitter: doofdoofsf)

Source

We’ve made two improvements to AWS Import/Export.

You can now send us a “raw” or internal SATA drive all by itself, with no need for an enclosure. You don’t have to send connectors, cables, or power cords. Raw SATA drives appear to be the most cost-effective way to send large amounts of data from place to place.

If you have a SATA cradle (I use this one at home; others have told me that they like this one), you can connect the drive to your desktop machine without having to open up the enclosure.

Also, you can now send us drives with capacities up to 4 TB. Customers with the need to import or export large amounts of data will reduce the number of devices needed.

Don’t forget that tools like Bucket Explorer, the CloudBerry S3 Explorer, and the S3Fox Explorer make it easy to create your Import and Export jobs.

Source

I. BACKGROUND

GNU Tar and GNU Cpio are popular programs for managing archive
files. Both programs are included in many linux distributions. GNU Tar
is commonly used for exchanging source code archives.

Both programs include a client implementation for the remote mag tape
protocol (rmt). This protocol allows accessing a tape device attached
to a remote system via a rsh/ssh. It can also be used to
extract/create archive files on another system directly using Tar/Cpio
(although using rmt for accessing remote files is deprecated).

II. DESCRIPTION

The rmt client implementation of GNU Tar/Cpio contains a heap-based
buffer overflow which possibly allows arbitrary code execution.

The vulnerability is in the function rmt_read__ in lib/rtapelib.c:

/* Read up to LENGTH bytes into BUFFER from remote tape connection HANDLE.
Return the number of bytes read on success, SAFE_READ_ERROR on error. */
size_t
rmt_read__ (int handle, char *buffer, size_t length)
{
char command_buffer[COMMAND_BUFFER_SIZE];
size_t status;
size_t rlen;
size_t counter;

sprintf (command_buffer, “R%lu\n”, (unsigned long) length);
if (do_command (handle, command_buffer) == -1
|| (status = get_status (handle)) == SAFE_READ_ERROR)
return SAFE_READ_ERROR;

for (counter = 0; counter < status; counter += rlen, buffer += rlen)
{
rlen = safe_read (READ_SIDE (handle), buffer, status - counter);
if (rlen == SAFE_READ_ERROR || rlen == 0)
{
_rmt_shutdown (handle, EIO);
return SAFE_READ_ERROR;
}
}

return status;
}

The function first writes to the server how many bytes it wants to
read using sprintf() and do_command(). Then it reads the number of
bytes available into the variable status using get_status(). In the
for loop, the function reads status bytes from the server into the
buffer. However, it doesn't check whether status is actually less than
or equal the length of the buffer given by the parameter length. So a
malicious rmt server can overwrite data on the heap following the
buffer. Successful exploitation of this bug could possibly lead to
arbitrary code execution.

III. EXPLOIT VECTORS

The problem can be exploited when using an untrusted/compromised rmt
server. The impact is fairly low since rmt is rarely used today and
the rmt server is in most cases considered trustworthy.

However, this vulnerability can also be triggered when trying to
extract a tar file with a colon in the filename. In this case, tar
interprets the part before the colon as a hostname (or user () hostname)
and opens a rsh connection to this host. This may also be exploited if
the user uses the aunpack script from atool [1] to extract a tar
file. Many users of GNU Tar or atool don't know that rmt exists and
that tar treats filenames containing a colon differently. So a user
might run tar or aunpack on a file which he has received via email or
downloaded from a web page. Many users enter filenames using bash
auto-completion and thus might not even notice that there is anything
wrong with the filename.

For Cpio, this attack vector does not work since Cpio requires the
option --rsh-command to use rmt. Tar has compiled in the default value
"/usr/bin/rsh".

It is also possible that there are scripts out there which
automatically call Tar to extract a file with a name provided by an
untrusted source. If the script passes the filename with an (absolute
or relative) path or uses the --force-local option, this problem can
be avoided

Notes on rsh/ssh:

GNU Tar uses /usr/bin/rsh to execute the rmt server implementation
(/usr/bin/rmt) on the server. On most modern linux systems
/usr/bin/rsh is just a symlink to ssh. So an attempt to exploit this
vulnerability might make ssh ask the user whether to add a new key to
the known_hosts file. This gives users the possibility to cancel the
program and thus prevent successful exploitation. However, the problem
can still be exploited if the attacker has compromised a machine which
is already in the users known_hosts file or if the user has set
StrictHostKeyChecking to "no" in his ssh configuration.

IV. WORKAROUND

Do not use the integrated rmt client of GNU Tar/Cpio if the rmt server
is untrusted or potentially compromised. Always check that the
filename doesn't contain a colon when extracting tar files or use the
--force-local option.

V. SOLUTION:

Upgrade GNU Tar to version 1.23 and GNU Cpio to version 2.11.

Some Linux Distributions are going to release upgrades packages
today or in the next few days.

VI. DISCLOSURE TIMELINE

2010/02/12: Vendor and major Linux Distributions notified
2010/03/10: Public disclosure

VI. Credit

This vulnerability has been discovered by Jakob Lell from the
TU Berlin computer security working group (AGRS).

http://www.agrs.tu-berlin.de/parameter/en/

A copy of this advisory is also available on the following page:

http://www.agrs.tu-berlin.de/index.php?id=78327

[1] http://www.nongnu.org/atool/

Source

Pennsylvania’s chief information security officer, Robert Maley, has been fired, apparently for talking publicly at the RSA security conference last week about a recent incident involving the Commonwealth’s online driving exam scheduling system.

A source close to the matter said Maley was terminated for not getting the required approvals from the Commonwealth’s authorities to talk publicly about the incident.

Commonwealth rules explicitly require all employees to get approval from the appropriate authorities before they publicly disclose official matters, the source said.

A spokesman for the state’s governor, Edward Rendell, today confirmed that Maley is no longer working for the Commonwealth. But he refused to say if Maley had been terminated, citing privacy rules.

Maley, who was Pennsylvania’s CISO for more than four years, was part of a RSA conference panel discussing state cybersecurity issues last Thursday.

During the discussion, Maley talked about a recent incident involving a Philadelphia-area driving school that was trying to get early driving tests for its students. The source said someone at the school exploited a configuration “anomaly” in the Department of Transportation’s online driver’s test scheduling system.

The vulnerability allowed the school to essentially cut the line and schedule “a whole bunch of driver’s license exams” for its students, the source said.

The incident was reported to the state police, and the matter is currently under investigation, the source said.

Danielle Klinger, a spokeswoman for Pennsylvania’s Department of Transportation, confirmed today that a problem had been uncovered in the driver test scheduling system, and that the matter has been turned over to state police.

However, she contested several media reports that have described the incident as a hacking attack, and said that as far as the the department was aware, there had been no hack or breach of the system.

Maley’s dismissal comes amid ongoing budget and staff cuts at Pennsylvania’s IT security organization, the source said. Over the past 18 months to two years, the administration has cut information security budgets by close to 38%, and staff by 40%. They also put a “lockdown” on talking about cybersecurity, the source claimed.

Source

Automobile giant Ford Motor this year will debut vehicles with built-in WiFi — along with enhanced security features to prevent data breaches via its new cars.

Ford has offered the so-called Sync technology service it co-developed with Microsoft in most of its Ford, Lincoln, and Mercury vehicles since 2008. The technology lets drivers run their Bluetooth-enabled mobile phones and digital media players via their vehicles and use voice commands to operate them, for instance.

The automaker announced today that the second generation of its Sync technology — due out later this year and to include a full Windows CE operating system with a new driver interface called MyFordTouch — will come with a built-in browser and secured WiFi access. It will first debut in the 2011 Ford Edge and 2011 MKX Lincoln, and later, in the 2012 Ford Focus.

“We really began to focus on the security side when we began launching Sync, and it was [originally] for working with phones and media players,” says Jim Buczkowski, director of Ford electronics and electrical systems engineering. “Now we’re extending that system connectivity to include WiFi as another data path for customers in their vehicles … and we’re extending that security model for protecting WiFi.”

The WiFi will be broadcast via Sync using a USB-based modem, and Ford has updated its on-board firewalls to protect both the WiFi network as well as the vehicle’s operations. The WiFi network is set by default to WiFi Protected Access 2 (WPA2) encryption for secured access to the wireless network. It also will provide anti-malware protection for the MyFordTouch system.

Sukhwinder Wadhwa, manager of the Sync platform and technologies at Ford, says Ford doesn’t consider security to be an add-on feature. “We work closely with the Ford enterprise IT security [group] to use basically the same guiding principals for security” as they use for the enterprise security, Wadhwa says.

“Any software is first verified by Ford engineers and signed by Ford enteprise servers before it gets installed [in the vehicles],” he says.

Wadhwa says Ford also uses internal ethical hacking teams as well as third-party consultants to test out the security of the Sync features.

“They are proud that they enable WPA2 and a firewall by default on the access point, perform pairing over Bluetooth, and have some arbitrary DRM for preventing swapping hard drives of MP3s. It all sounds like pretty vanilla stuff, anything a decent home network set-up has,” says Nate Lawson, principal with Root Labs.

Wadhwa says Ford isn’t aware of any car-hacking incidents with its vehicles to date. “We do not want to have any incidents in the first place,” he says. “We are connecting consumer-grade devices [in the vehicle], and we want to make sure out of the chute we are protected from any bad devices out there, like memory sticks or whatever they put [into the vehicle],” he says.

Wadhwa says the hardware-based firewall technology is made up of two “separate entities” so that the consumer side of the firewall that handles what can connect can’t pass information to the vehicle’s processor, or vice versa. ”

All of Ford’s vehicles in the next five years will come with the secure WiFi option, according to Ford.

Meanwhile, the automaker’s Sync service, which comes standard in some higher-end models and for an optional monthly fee in other models, already comes with phone-pairing protection, an encrypted jukebox hard drive for the driver’s music library, a valet-mode option that locks all programmed navigation destinations from view, an engine immobilizer, and keyless entry features.

Source

Cisco (NASDAQ: CSCO) today announced a major advancement in Internet networking — the Cisco® CRS-3 Carrier Routing System (CRS) — designed to serve as the foundation of the next-generation Internet and set the pace for the astonishing growth of video transmission, mobile devices and new online services through this decade and beyond.

With more than 12 times the traffic capacity of the nearest competing system, the Cisco CRS-3 is designed to transform the broadband communication and entertainment industry by accelerating the delivery of compelling new experiences for consumers, new revenue opportunities for service providers, and new ways to collaborate in the workplace.

Overview:

* The Cisco CRS-3 triples the capacity of its predecessor, the Cisco CRS-1 Carrier Routing System, with up to 322 Terabits per second, which enables the entire printed collection of the Library of Congress to be downloaded in just over one second; every man, woman and child in China to make a video call, simultaneously; and every motion picture ever created to be streamed in less than four minutes.

* The Cisco CRS-3 enables unified service delivery of Internet and cloud services with service intelligence spanning service provider Internet Protocol Next-Generation Networks (IP NGNs) and data center. The Cisco CRS-3 also provides unprecedented savings with investment protection for the nearly 5,000 Cisco CRS-1 deployed worldwide. Cisco’s cumulative investment in the Cisco CRS family is $1.6 billion, further underscoring the company’s commitment.

* AT&T, one of the world’s largest telecommunications companies, recently tested the Cisco CRS-3 in a successful completion of the world’s first field trial of 100-Gigabit backbone network technology, which took place in AT&T’s live network between New Orleans and Miami. The trial advances AT&T’s development of the next generation of backbone network technology that will support the network requirements for the growing number of advanced services offered by AT&T to consumer and business customers, both fixed and mobile.

* The Cisco CRS-3 is currently in field trials, and its pricing starts at $90,000 U.S.

Highlights and Capabilities for the Next-Generation Internet:

* Unmatched Scale: With a proven multi-chassis architecture, the Cisco CRS-3 can deliver up to 322 tbps of capacity, more than tripling the 92 tbps capacity of the Cisco CRS-1 and representing more than 12 times the capacity of any other core router in the industry.
* Unique Core and Data Center/Cloud Services Intelligence: In addition to capacity requirements, the growths of mobile and video applications are creating new multidirectional traffic patterns with the increasing emergence of the data center cloud. The new Cisco Data Center Services System provides tight linkages between the Cisco CRS-3, Cisco Nexus family and Cisco Unified Computing System (UCS) to enable unified service delivery of cloud services. This intelligence also includes carrier-grade IPv6 (CGv6) and core IP/MPLS technologies that permit new IP NGN architectural efficiencies required to keep pace with the rapidly growing cloud services market. Unique capabilities include:
o Network Positioning System (NPS) — provides Layers 3 to 7 application information for best path to content, improving consumer and business experiences while reducing costs.
o Cloud virtual private network (VPN) for Infrastructure as a Service (IaaS)-enables ‘pay-as-you-go’ for compute, storage and network resources by automating Cisco CRS-3 and Cisco Nexus Inter-Data center connections for Cisco UCS.
* Unprecedented Savings: The Cisco CRS-3 offers dramatic operational expense savings and up to 60 percent savings on power consumption compared to competitive platforms. The Cisco CRS-3 also delivers significant capital expenditures savings and investment protection for existing Cisco CRS-1 customers. The new capabilities in the platform can be achieved by reusing the existing chassis, route processors, fans and power systems with the addition of new line cards and fabric. These upgrades can be performed in-service and be provided by Cisco Services to ensure a smooth transition.
* Silicon Innovation: The Cisco CRS-3 is powered by the new Cisco QuantumFlow Array Processor, which unifies the combined power of six chips to work as one, enabling unprecedented levels of service capabilities and processing power. Making this implementation even more unique is its ability to deliver capabilities with a fraction of the power required by lesser performing chipsets. The Cisco QuantumFlow Array chipset was designed to provide the new system the ability to scale with the ever increasing demands being placed on the IP NGN by the many different applications and billions of devices being used by both businesses and consumers in the Zettabyte era.

Source

The development team behind secure shell server OpenSSH have released version 5.4, which includes a range of new functions and fixes a number of bugs in the previous version.

Following a transition period of more than 10 years, OpenSSH 5.4 finally disables, by default, the old SSH protocol version 1. The legacy SSH version, which is no longer considered secure, can still be used by adjusting the appropriate settings in the configuration file. Where certificates are used to authenticate users and computers, version 5.4 offers a new minimal OpenSSH format. Key pairs for users can be revoked using the new RevokedKeys option. Host keys can be revoked in the known_hosts file.

Using the -W switch and a host:port argument, OpenSSH 5.4 can be started in netcat mode, which connects a local computer’s standard input channel (stdio) to a port on a remote PC. The SFTP server, which carries out FTP-like file transfer, now protects file sharing settings from being overwritten (read-only mode) and can, if required, set explicit privileges when generating new files (umask) at the command line. The SFTP client now has tab completion for commands and paths and supports recursive get and put commands which allows entire file trees to be transferred between client and server.

Source

The former National Security Agency technical director told the RSA Conference he doesn’t trust cloud services and bluntly admonished vendors for leaving software vulnerabilities unpatched sometimes for years.

Speaking for himself and not the agency, Brian Snow says that cloud infrastructure can deliver services that customers can access securely, but the shared nature of the cloud leaves doubts about attack channels through other users in the cloud. “You don’t know what else is cuddling up next to it,” he says.

Snow was speaking as a member of the annual cryptographers panel at RSA Conference. Another panelist said he doesn’t trust clouds either, but his reluctance was based upon worry about what NSA might be up to.

Adi Shamir a computer science professor at Israel’s Weizmann Institute of Science and also the “S” in the RSA encryption algorithm, warned against trusting cloud computing services for the same reason he suspects the confidentiality of transmissions over telecom networks and the Internet. He says the phone systems are secure, but that major crossroads in their networks are tapped by the NSA. “There’s a pipe out of the back of an office at AT&T in San Francisco to NSA,” he said.

Government access to assets entrusted to public cloud providers will be similar, he says. He suspects in some cases cloud providers will be companies influenced by government spy agencies, similar to the way Crypto AG security gear gave the NSA backdoor access to encrypted messages sent by foreign governments that had bought the gear. “Please don’t use Crypto AG,” he said.

On another topic, Snow said many commercial applications and security products contain known flaws or shortcomings that users accept without understanding them or analyzing them thoroughly. That trust is similar to the trust investors had in unsound Wall Street derivative investment products, he said. Just as the country’s financial markets melted down last year, he said network security could face a “trust-bubble meltdown”.

He alluded to a 17-year-old Microsoft vulnerability that went unpatched. Fixing such problems before they are exploited gives vendors a commercial advantage, so they should do so. “Fix vulnerabilities before you first smell an attack,” he said. “End of message.”

Also during the panel, Snow acknowledged that cryptographers for the NSA have been losing ground to their counterparts in universities and commercial security vendors for 20 years but still maintain the upper hand in the sophistication of their crypto schemes and in their ability to decrypt.

“I do believe NSA is still ahead, but not by much — a handful of years,” said Snow, the former technical director for the agency. “I think we’ve got the edge still.”

He said that in the 1980s there was a huge gap between what the NSA could do and what commercial encryption technology was capable of. “Now we are very close together and moving very slowly forward in a mature field,” Snow said.

Source