Friday, October 17. 2008Policy-based routing on Linux
A customer system needed to be upgraded and for several reasons it was supposed to be moved from Windows server to Linux (more on that another time). The server was supposed to be moved from one IP range to another as we are moving from our old Provider Aggregatable (PA) IP addresses to our "new" Provider Indepedent (PI) addresses.
I set the system up and it was supposed to be a hard cutover on one day. It quickly turned out that this was not feasible (again, for several reasons, e.g. the amount of data to copy over was too big). So, finally, it was decided that the cutover was to be smooth: the majority of data was rsync'ed over from Windows in the days before the cutover date, then the rest on the cutover day. The SSL certificate was to be copied over on day X and the new server running Linux should take over the IP address of the old (Windows) server. As the system was now multihomed we needed to cope with asymmetric routing. First off, we thought it should be possible to hide all incoming traffic to the old IP addresses behind the internal IP address of the firewall - but it turned out our product does not allow for that.  The solution to this is policy-based routing: if the packet goes out on Interfacenew, a different routing decision needs to be taken than when it would go out Interfaceold. Fortunately, Linux does allow for this with the iproute2 package: you can have several routing tables glued together with a routing policy, i.e. a set of rules that controls the selection of the routing table. If a rule matches and a route is selected from a routing table the packet gets routed according to this route. If there is no matching route the rule traversal continues. In our setup this means, that all packets from IPPI-Space should get routed to the PI-Space gateway whereas all packets from IPPA-Space should get routed to the PA-Space gateway. Currently, the default gateway is the PA-Space one, so we don't have to do much. In Debian/Ubuntu syntax, the network is then setup through /etc/network/interfaces with a stanza like the following:
And for the Interface in the PI address space, the stanza looks like this:
The two post-up lines are the magick in here: the first adds a rule to the routing policy that, for all traffic originating from the PI space interface, a lookup should be performed in routing table PI-Space. Then, we add a second default route to that very same routing table. Now, whenever a packet goes out Interface eth1, the kernel checks if there is a matching route in routing table PI-Space. As we have a default route, this will always match and the packet gets routed to the gateway in our PI space.Obviously, all other traffic originates on eth0 so the "normal" routing table will be used, thus this traffic will go out via the gateway residing in the PA address space.loose endsActually, the kernel does not check a routing table named "PI-Space". It will use a numerical identifier that is mapped in /etc/iproute2/rt_tables like this:
Thursday, November 23. 2006
Monday, June 26. 2006Requiescat In Pacem, WinFS
Today, Heise Newsticker (German only) mentioned that Microsoft finally killed WinFS for good. Of course, they are going to call it differently (like: "[...] WinFS has always been about many things – a new model to enrich how users manage information, rich storage technology, and sometimes also a packaging of technology.[...]" according to Quentin Clark from the WinFS team). But, let's face it: there won't ever be a separate piece of software to install that will enable us to use advanced features and fast search procedures.
Why? Difficult question. Personally, I guess that they got overwhelmed by the complexity and the tight integration philosophy that is so deeply ingrained into Microsoft products. Trying to fit too much into it until they realized that pulling the plug is the only valid solution. What does it mean? Well, it's a big deal for Vista (or, rather, a huge blow to Vista) as the only really useful advanced feature for Vista won't ever be available. Obviously, Microsoft miscalculated something quite important. While I won't go so far as calling it a Doomsday scenario for Microsoft, as an analyst I would be wary and start investing in other companies. And the security linkage? Well, if you really want to have one - think for a bit about what something like this could mean to the security initiative and the overall state of Microsoft software. Will they ever be able to handle their boatloads of highly complex software? I doubt it, but then, I'm a heretic and a sceptic anyway.
Monday, June 26. 2006Identity: Information, Theft, Cards - Culture!
With the continuing theft of personal identifying information (PII) in the US the old question pops up all over: why is what Americans understand as "identity theft" not a problem in Europe? I think three main factors need to be taken into account here:
These issues in combination make illicit information access much riskier in Europe than it is in the US. Oh, and it shows that identity documents don't have to be such a bad concept as many US and UK citizens make them out to be. Over at the Identity Corner, Stefan Brands has an interesting series of articles about the UK identity cards:
Monday, June 12. 2006WTF - Apple's OS X is NOT As Secure As a Fortress?!
Oh holy Guacamole! OS X has lots of heap and buffer overflows! Quick, buy Vista and all will be well again! Oh, right. Vista isn't out yet. You've just switched to Apple because of all the exploits and dangers of running XP or some *gasp* older version of Windows. And now you're still insecure?!
Why, yes, of course. There is no such thing as And let's not forget that OS X is a revamped version of NeXTSTEP, the OS of the famous NeXT computer. That one was said to be riddled with local exploits, so don't expect OS X to be much better. As OS X is gaining market share, it will become more and more the target of choice for malware programmers. What is different, though, is the use of administrative accounts (like on Windows where accounts by default are administrator accounts). On OS X, the only administrator account, root, is disabled, and to run administrative tasks one has to enter the password (this is a better-working equivalent to the runas command in Windows).Moral of this? If someone tells you they are offering perfect security, chances are they are lying and only want your money. Be careful, always - it's a dangerous world out there.
Monday, June 12. 2006ESAG vanished
I've written twice before about the European Security Advisory Group. I thought I'd check up on them again - only to find they have gone as quietly as they appeared. telepolis guesses (I believe correctly) that it was just a smokescreen for the US DoD propaganda group called Office of Strategic Influence.
Good riddance - another open book closed.
Friday, February 3. 2006"Nah, we don't need no steenkin' study!"
As could be expected the European Commission "sees no need" for a study about the effects of the advance collection of data they have decided to enforce. Heise covers this yesterday (German only).
Friday, February 3. 2006RFID Based Passports With BAC Vulnerable
In a current news item Heise reports that the Dutch security company Riscure found a way to brute-force attack the encryption of the Dutch ePassports. Let's recap: the ICAO has issued a set of guidelines on "Machine Readable Travel Documents" that basically states that passports and other travel documents should use an RFID chip that can be used to read the individual's data contactless. Apparently the field strength is strong enough to be read from several meters distance. However, the transmission is encrypted by "Basic Access Control" (BAC) where the key is comprised of the serial number of the document itself, it's issue date and it's invalidation date. This gives about 56 bit of key length (which is not really that much and it's questionable if it will be safe to use on a mid-term timeframe. Now, the issuer of the Dutch ePassports uses sequential serial numbers and the number of documents issued is basically constant per time unit. This gives a linear connection between the issue date and the passport serial number, thus effectively reducing key length to about 35 bit - which is easily breakable in a few hours without special hardware equipment.
This attack vector is valid for every document that uses BAC and uses predictable serial numbers for the documents! What hasn't been stated so far is the fact that once the key is known the RFID chip could theoretically be read everywhere. Consider a country that's gone off the deep end with hysterics about terrrorism and thus has installed RFID scanners throughout what they consider critical points. Now they only need those scanners hooked up to a central database where all keys to all passports ever seen entering has been stored and they can easily find out where a person goes (given they take their passport with them).
Monday, November 28. 2005What type of RPG player are you?
Law's Game Style created with QuizFarm.com via kris
Wednesday, November 23. 2005Airline Passenger Data Transmission To US May End
In 2003 the US ordered airlines to transmit flight passenger data for all flights ending in, stopping over in or just crossing US American territory. It was made clear that all data was to be stored in raw form and would be subject to further analysis, leading to profiling of passengers, all, of course, in the name of fighting terrorism. It is completely unclear what sort of profiling will be done and what else the US government will be doing with the data (e. g. handing it over to some commercial data brokers like gasp ChoicePoint for analysis). The Washington Post has a good summary as well.
The EU Commission and the EU Council caved in instead of taking a strong position against this practice and declared the US data handling processes as equivalent to European processes and, in general, good enough. This led to a huge outcry from the EU Parliament and several Civil Rights organizations (like the European Digital Rights Initiative) but both the Commission and the Council wouldn't budge. Now, however, things start to look a bit brighter: the Advocate General at the Court of Justice at the European Communities recommends to annul the Council decision about the agreement. The Court will have to rule about a law suit by the Parliament against the Commission and the Council decisions. The recommendation of the General Attorney are not binding but in most cases the Court will follow advisory opinions. References: Heise Newsticker (German) Washington Post
Wednesday, November 23. 2005The City of Dis
Well, what do you know? I've landed in Dis after taking the Dante's Inferno test:
The Dante's Inferno Test has banished you to the Sixth Level of Hell - The City of Dis! Here is how you matched up against all the levels:
Take the Dante Inferno Hell Test Thanks to Adam.
Thursday, November 17. 2005Security Convergence
"Security Convergence" is the subject of The Alliance between ISACA, ISSA and ASIS. Seeing what the focus of all the three groups is it really does make sense: ISACAs main operational field is Governance, especially IT governance; ISSA is "the global voice of information security" and ASIS is primarily concerned with physical security.
It's pretty clear that those three fields do converge more and more, so The Alliance is an important step in the right direction. It will help to open the eyes of security professionals worldwide to the other fields. It will, thus, help to raise a more business oriented security program in enterprises. We shouldn't expect too much in too little time, however: I don't believe that many companies understand at the moment that security is something that needs to be considered in a (I hate to use the term, but it does fit so nicely) wholistic way. So, at the Network Security Conference/Security Management Conference of ISACA in Amsterdam last Monday the panel discussion was just about this: "Security Convergence". I was invited to represent ISSA at the panel. It was rather interesting to see the different points of view on the panel - and in the audience. Another member of the panel, Carl Thorp, stayed on for the day (I had to get back unfortunately) and reported that there were quite a few interesting discussions about the convergence thing. However, it seems to be of prime import to define what "Convergence" really means. It will be interesting to see the discussions around the term in the near future.
Monday, November 14. 2005First time to the Netherlands
I've been invited to represent ISSA at a panel discussion at the ISACA Network Security/Security Management Conference in Amsterdam. It's my first time to the Netherlands and, unfortunately, I won't have any time to do some sightseeing.
The panel discussion is about The Alliance between ISACA, ISSA and ASIS about the convergence of physical security and information security. The folks are great and I wish I had more time to spend here.
Thursday, November 3. 2005The Dangers of Inference
Here I am, taking a strong stance about government agencies that collect data and use inference to think about what it might possibly mean. There's no lack of wrong inferring to be done that way, starting from false assumptions about coherence of incoherent data or by simply interpreting too much into too little data.
And suddenly I find myself here, doing exactly the same: thinking F-Secure jumped on the bandwagon of Mark Russinovich's posting at sysinternals for their excellent work of analyzing the Sony DRM Rootkit. Independently, I should say, because that is what they did. They did not, however, manage to make it clear how they got wind of the thing (which they did earlier than Russinovich and were in contact with Sony to discuss the issue). After Mark published his findings, F-Secure thought it was now time to publish theirs, too. Can't blame them, really. I blame myself, however, for jumping to unjustified conclusions. Ah well, as I said: inference is bad.
Tuesday, November 1. 2005Ch-ch-ch-changes
Jon Toigo is annoyed at the lack of progress the information security field has made since the Medieval. I feel his pain, too. But what are the alternatives? Or rather, why are we still using the same concepts? Are we just too stupid to come up with something new or are the concepts just so basic and so sound that there is no better way? Let's take a look at the items Jon mentions.
Interestingly enough, the bad guys don't seem to have learned either how to circumvent the safeguards we set up. Either they are as caught in our ways of thinking or there simply Is No Better Way at the moment. What do you think? All of this, however, has nothing to do with vendors coming up with new products all along instead of listening to what the customers want - just like in the storage market. Thanks for the eye-opener, Jon!
|
Calendar
QuicksearchStatische SeitenBlog AdministrationArchivesKategorienlinksGetaggte Artikel anti-recruiting bürgerrechte barcamp security metrics blackout bundestrojaner crisis crisis management egoshooter federal trojan filme flickr geschichte incident management information investigations jobleads killerspiele law enforcement malware management media medien medienkompetenz power supply problem problem management recruiting security spam stöckchen strafverfolgung trojan umfragen zeitläufteTop ExitsBlog abonnierenMapflickr photostream
Powered by |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
