One Wishes One Didn't Have To Repeat This...

...but just as in the days around five years ago or ten, when virtual computing was this new thing promising cheap, automatic solutions for everybody's issues, we STILL see three pesky security problems which virtualization adds to ALL THE OTHER SECURITY PROBLEMS that were present in computing in the first place. Here they are again.

THE USER INTERFACE

The place you go to remotely administer a rented server at some unknown location (maybe they'll tell you which data center the virtual machine's in; maybe it's not an issue) is a web page, with all the inherent vulnerabilities those things have. SQL injections, buffer overflows - the usual suspects. Does your infrastructure provider use secure coding practices? Maybe, maybe not.

THE HOST HYPERVISOR

The big program inside which the virtual computers live is called the hypervisor. It's a very big program. Programs - particularly those that talk to networks - are vulnerable to all kinds of nasties. Updates to those programs are needed to counteract the nasties. Is the hypervisor program on the hardware host at your provider that runs your VM updated? Was it written by the virtualization product maintainer using secure coding practices? Maybe, maybe not.

THE PROVIDER EMPLOYEES

Did you hire the people that run the hosts that your VM lives on? No? Then you can't fire them. And don't even know who most or any of them are. Do you trust them? Maybe, maybe not.

Other Concerns

Do you maintain your VMs via an automatic payment from a credit card? What happens if a payment fails to go through? POOF - all your VMs could disappear, along with settings, data, transactions, virtual switches and so on. That's a nasty surprise, particularly if your backup locations are also VMs at the same provider that are paid for in the same way. And unless you're paying through the nose for managed hosting (where designated admins do stuff for you), there's the nasty surprise of lack of administration, meaning that you're behind on updates, disk space checks, disabling of unneeded services, log rotation and all that stuff.

Not to bug you, but these things haven't changed since years ago, when first I griped about them. Happy networking!

UPDATE: Another issue I remember from my tech support days is where a certain major infrastructure provider only a few years ago was discovered to be recycling VM's! OS loads at the provider where I used to work took about as long as a real computer (30-45 min.). A way to improve that - which they may have implemented by now - would be to image a new machine quickly from a master image. But one of our competitors was providing (apparently) already-built builds of Windows Server that had been previously used by an earlier customer. To recycle, I suppose they just ran some command that reset to defaults. Perhaps they came up with a powershell script. It would have provided a "new" computer (virtual machine image) to a new customer who was no doubt impressed by the speedy delivery! But that same customer may have been confused by the data, configurations and users left in the build from some previous owner. Hilarious.

A few days ago on the radio...

Remember listening to the radio? Sure you do. I, in fact, get much of my news there since I haven't thrown together an HDTV antenna yet. But that's another story. I use the internet mostly for YouTube... Anyway, at this writing the latest and record-setting (a few weeks) government shutdown has just ended for a planned 3-week hiatus to get paychecks through to various agencies. A radio news story I heard a few days before the agreement worried that since the government services that maintain "do-not-call" registries would not be open for business, robocalls would be worse during the shutdown's duration.

If only journalists would look stuff up.

["Buuuuuut nooooooooooooooooooo..." - noted philosopher John Belushi]

It is beyond the scope of this post to note all the ways that telemarketers have gotten around the "do-not-call" registries, but it's worth noting that there's a different issue with the recent spate of robotic sales calls, many in languages other than the one you speak. They're coming through land lines, landline equivalent arrangements, cell phones and anything else that uses a telephone number. The operative concept here is "telephone", which predates the "smart" phone by quite a bit. Back in olden times, specifically the middle Leisure Suit era, there appeared a communications method called SS7, which did not anticipate computer control of phone switching networks. Actually that wasn't the problem. The problem only a few years back was that the standards committee folk that maintained SS7 in current times couldn't agree as to how to fix certain flaws...

Wikipedia's article on SS7

(This is not an endorsement of any online encyclopedia using lightly-vetted update arrangements; it was a better-than-average article at the time of this writing at least.)

So until a fix for the vulnerabilities/features of SS7 is produced, the robocall outbreak will continue regardless of the presence or absence of do-not-call lists, which address a different problem anyway.

IBM purchases Red Hat

At this time I know as much as you do. Big Blue has begun the acquisition process to absorb the largest Linux maintenance organization (in control of its own popular server Linux distribution) and this will affect many other smaller organizations that rely on Red Hat OS's. What will happen and what is IBM's motive here?

The critical theory is that IBM is no longer a tech company but a holding company which purchases income streams they do not see a need to create internally (higher cost). If these purchased acquisitions do not continue to perform, their role in IBM is superseded by later acquisitions. The tech status is maintained in order to convince Wall Street that nothing has changed in the board room over the decades.

A pragmatic theory is that, although the original generations of engineers have left the boardroom, IBM soldiers on by purchasing concerns representing the Next Big Thing, thus remaining relevant. In tech, things change quite a bit, and so a chameleon has a good chance of survival. The adaptor (the most flexible actor) is the survivor.

From the small company's perspective, if the worst happens and Red Hat support suffers, is a migration to another distribution of Linux possible and reasonable? My guess is yes, since Nix-based systems are very similar to each other and control of the Linux kernel is not present at Red Hat itself. Candidates? I dunno. Debian is being hotly discussed. Old timers would look at BSD versions. Operations with fat budgets may consider OSX Server (out since 1999). Stay tuned!

Freeeeeeeeee!!!!!

A wise person once said "If it's free, the price is right." There's lots of free formatting to be had at freeformatter.com, to the tune of more than formatting, actually. Here are the main categories of free conversion, help, code, etc. only a click away:

Formatters
Validators
Encoders & Decoders
Code Minifiers / Beautifiers
Converters
Cryptography and Security
String Escaper and Utilities
Web Resources - including a Lorem Ipsum generator?!

I'm only just getting familiar with many of these tools and many I don't even know what are good for (bad English but you understand). I have a word of caution for you regarding the Cryptography section, though: use at your own risk.

I don't mean to suggest that there are flaws with the tools. As far as I know, the tools work just fine. What I don't trust is endpoint security (me and a BUNCH of people smarter than me). Your hashes or SHA-whatevers are probably handled flawlessly by this free website, but if they're being created via a compromised laptop or (gag) phone, then browser https won't save the day.

So for best results, use these free tools from a box and network you trust, rather than over free wifi at a coffee shop or over the library system at a high school. And not with a laptop that hasn't been updated in a year.

Just sayin'.

Phone Call From A High Powered Computer Professional In India

Ladies and gentlemen, it was a good day.

The phone rang at home.

After a recorded message that alleged that computer activity at my location (not specified, naturally) would somehow be critically noted by Apple (with which I do not have any subscription relationship), a list of phone system choices were enumerated. I chose the "staff operator" option, hoping for further indications that it was a phony pitch. As I suspected, a live Indian voice alleging computer problems at my location began some lame but vaguely threatening story, so I loudly and rudely interrupted with:

Me: "Are you reporting virus activity?! If so, give me a type or a sub-type!!"
India guy: "Um, no, your..."
Me: "Is this a NETWORK ISSUE, a MOBILE ISSUE or a DESKTOP ISSUE?!"
India guy (attempting a more aggressive stance): "Um, no, Sir, this regards your Apple ID - "
Me: "DO YOU HAVE A TRACKING NUMBER? DO YOU HAVE A DISCOVERY DATE? WHAT ABOUT ANY O.S. VERSIONS?"
India guy, louder: "Sir, your Apple - "
Me, very loudly: "I DON'T HAVE AN APPLE ID, YOU IDIOT!!! (bellowing now) HOW IS THE VIRUS CLASSIFIED?!!!"

He mysteriously hung up. Most fun I've had in years.

Any systems analyst, devops management bigwig or network security professional would have been able to give some specific observation if there was really a problem, and would have done so confidently. Funny how that didn't happen.

Nobody calling you cold has any idea what computer activity is happening at your location. These are at best telemarketers, and at worst, criminals. Have a little fun with them!

The Galesburg, Illinois Hack

The below link provides the first coverage I've seen of a break-in just uncovered that happened during the 2016 US elections regarding several Illinois towns not of large but of average size. Mostly involved is Galesburg, in far western Illinois about halfway between Chicago and Des Moines, Iowa. The county seat of Knox County, it has a population of about 32,000, making it not Wall Street or Sunset Boulevard but plain old ordinary whitebread middle America. Here's the story link:

Eric Shawn Story

The story indicates that Homeland Security found connections to voter registration computers in Galesburg through servers in the Netherlands operated by a Russian entity called the GRU. Notice that that isn't the FSB (the modern descendant of the famous KGB, which was the Soviet near-equivalent of the CIA). FSB is a civilian agency that would be the usual candidate for infiltration of foreign elections (see the Christopher Andrew books "The Sword And The Shield" and "The World Was Going Our Way" for data on that). But this time it's apparently Russian military intelligence, which is what (in Russian) GRU stands for. That would be a rough equivalent of our DIA, or Defense Intelligence Agency, probably adding the duties of our NRO (National Reconnaissance Office) which operates observation satellites and NGA (National Geospatial-Intelligence Agency), basically a huge combat cartography service.

There are two things to note here (beyond a timely reminder that as far as we know, no votes in any American election have been changed by any foreign state-sponsored operator). First, it's interesting that GRU is doing their own work as opposed to relying on another Russian agency for it. It could be that GRU doesn't trust FSB to give them accurate or complete material. So it's not just that there's a problem with Russia being interested in election activity in the US (along with many other allied and opposed countries, I'll guess). There could be a problem with multiple unrelated Russian entities that do their own intelligence gathering due to interagency competition like you see from time to time in the Pentagon. That could have many implications for catching these types in that one may see unrelated but current Russian signatures because one isn't looking at one Russian group but in fact at two or three separate ones.

Second, it's noted but not trumpeted in the story that what got broken into were computers holding voter registration records, not computer-based voting machine systems. There were earlier such stories; the Galesburg story is the latest. This indicates that the particular risk here was not about votes being changed, but about the risk of the list of registered voters being subject to deletion, addition or alteration as well as exfiltration. That last refers to downloading or copying the list for later action, which is apparently all that DHS thinks happened.

Regardless, the exposure is that local government systems are not the most closely guarded or up-to-date systems anybody has, and any interested party foreign or domestic has some chance to break in. If indeed no votes have been changed in any local, county, state or national election (as with courthouse fires in olden times), I must credit airgapping of networks and individual computers that are known risks, and can't be replaced or upgraded due to lack of funds. The plan might be "if they're protection risks just don't network them". That would be a good, cheap form of firewalling that would interest a manager with no budget. I mean, if these devices are still running 386 processors and Win2K, would you get on the internet with them?

Hypothesis

The "Meltdown" and "Spectre" vulnerabilities are currently making the news and fixes are being fielded as I type. There is an impression that these processor-centric problems are not fixable. Well, kinda. I'll (at the risk of looking uninformed if you compare my picture here to CERT or somebody) offer a grossly simplified explanation. Bottom line, though, is UPDATE EVERYTHING. It's a software issue, at least immediately.

The kernel of any operating system is the internal part of it (be it Windows, Linux, CP/M, whatever - everything has a kernel)... the "guts" part that handles matters more fundamental than human interaction. It has three jobs: file system management, memory management and CPU scheduling (the "job stack"). That second matter about managing memory is key for the current issues. A kernel knows details about how the physical processor (or cloud simulation thereof) arranges physical memory and the kernel itself is what decides what and how much memory goes to this process, that application or that other cron job when fired.

Suppose - just suppose - that the Bad Guy could stick a virus (surreptitious unauthorized kernel module in this case) into a kernel. That would in theory give the ability to this virus/worm/nasty to eavesdrop upon exactly what memory locations a particular interesting process was using, as well as the ability to look into those locations and see (before wipe) if any data is left there after the process happens. If the nasty finds data, it could then copy it and send it to the IP address of Nasty Person Central, at least if network-capable and if sensing any usable connection to the outside world. Which would be a good bet.

Processor redesign could make this crack harder but will take months or years to put into the plans of all the chip makers. Software changes are possible quickly though, and are being rolled out now and will continue to be developed for months. The action plan:

1. DO ALL BACKUPS IN CASE PATCHES BREAK SOMETHING.

2. RESEARCH AND FIND PATCHES FOR YOUR STUFF.

3. WARN DOWNSTREAM USERS OF MAINTENANCE TIME WINDOWS BEFORE THEY HAPPEN.

4. PATCH ALL OPERATING SYSTEMS AND APPLICATIONS THAT MAY BE AFFECTED BY MEMORY EXFILTRATION PROBLEMS.

5. Follow authorities like the common vulnerabilities page and NixCraft for the latest news and workarounds.