Category Archives: Security

SFCB Authentication Flaw in VMware ESXi 4.1 Upgrade

According to CVE-2010-4573, also known as VMSA-2010-0020, a VMware ESXi 4.1 system upgraded from ESXi 3.5 or ESXi 4.0 may allow open authorization.

The flaw is related to the Small Footprint Common Information Model Broker (SFCB). If the SFCB daemon is running (on by default) or the configuration file (/etc/sfcb/sfcb.cfg) was changed before the upgrade, system authentication fails and any username and password combination is allowed. Detection of the flaw is trivial — just look in the configuration file:

Find the line with basicAuthLib, your deployment of ESX 4.1 is affected if the value for the parameter is basicAuthLib: sfcBasicAuthentication. Your system is not affected if the value for the parameter is listed as sfcBasicPAMAuthentication.

The official VMware workaround is thus to change “basicAuthLib: sfcBasicAuthentication” to “basicAuthLib: sfcBasicPAMAuthentication”.

Gazans Fire Anti-Tank Missles, Israelis Prepare for War

The BBC says a senior Israeli army officer is calling a war with Gaza “a question of when, not if”. The rearmament of Hamas is held up as evidence of new and greater concerns.

The Israeli-developed active protection system (APS) known as Trophy is designed to destroy missiles like the Russian-made AT-14 Kornet, one of which hit a Merkava Mk3 tank on 6 December.

The laser-guided missile – which carries 10kg (22lb) of high explosive – penetrated the tank’s armour, but did not injure its crew.

“Fortunately, it did not explode within the tank. It is a heavy missile that is among the most dangerous that we have seen on this front and was not used even during the Lebanon war,” [emphasis added] Israeli Chief-of-Staff Lt-Gen Gabi Ashkenazi told a closed-door parliamentary session on Tuesday.

My first thought is we now might have another clue related to the large shipments of small arms and explosives uncovered by police in Nigerian ports.

Nigeria’s secret service said on Tuesday it had intercepted 13 containers of weapons from Iran in what Israeli defense sources believe may be part of a new smuggling route from Iran to Hamas in Gaza.

Rocket launchers, grenades and other explosives camouflaged as building material were seized in the Nigerian port of Lagos after being unloaded from an Iranian ship.

That news story suggests Sudan or the Sinai might be involved in a land route but I would say it’s going through Eritrea, especially since Eritrea has been ordering Kornets for themselves since 2005. Ah, but before I fire up my usual anti-proliferation on the Horn of Africa line I have to check the Israeli reports on weapons used in the Lebanon war.

Apparently the Kornet was not only found there, but it saw active and successful use with guidance systems against Israeli tanks. It was blamed for Israel’s initial losses and the slow pace of advance into Lebanese territory.

You can read all about it and even look at pictures of the captured evidence in part two of the Human Shields document from the Terrorism Info site in Israel (Subtitle: PROOF OF THE LOCATION OF THE HEZBOLLAH’S MILITARY INFRASTRUCTURE AND OPERATIONAL ACTIVITIES CARRIED OUT FROM WITHIN THE CIVILIAN POPULATION.)

pg 33

“…the massive deployment of anti-tank squads armed with advanced Kornet missiles…”

[…]

pg 34

“Various arms and ammunition were seized in the village of Ghandouriyeh:

a. Eight complete kits of advanced Kornet anti-tank missiles (including heat-seeking devices, the missiles themselves, and shipping certificates)”

The report points out that the Kornet missiles were buried in homes, usually unknown to the residents, and were moved around the villages by men dressed in civilian clothing with motorbikes sometimes even waving white flags.

The BBC or the Israeli army must be trying to say something has changed about the Kornet missiles fired from Gaza (supplied by Iran via the Horn?), but it’s not clear from their story.

UK Marine Park May Block Diego Garcia Resettlement

Wikileaks has now resurfaced a debate over the fate of the indigenous Chagos population. It suggests the UK intended to use a marine park as a measure to prevent the resettlement of these islanders. Mauritius has now sued the UK:

A US cable from May 2009 quotes a discussion about the park with Foreign Office official Colin Roberts. “He asserted that establishing a marine park would, in effect, put paid to resettlement claims of the archipelago’s former residents,” the cable said. The Mauritian Prime Minister Navinchandra Ramgoolam said his government had filed a case before the International Tribunal for the Law of the Sea in Hamburg.

It is no surprise that the UK is politically opposed to resettlement claims. This is long-standing and bitter fight that has had some high-profile court cases already. Mauritius has even started to make a more aggressive sovereignty claim over Chagos, ironically. What is notable about the Wikileaks documents is how they frame the marine park and discuss ending resettlement claims a year after those claims already were struck down.

In 2008 I quoted a news article that said the UK courts ruled against allowing Chagos Islanders the right to resettle their home land. The reason given then was international security (e.g. an air base for strikes against Iraq, Iran; laundering controversial military equipment shipments to embargoed countries).

By a ruling of 3-2, the lords backed a government appeal that argued that allowing the islanders to return could have a detrimental effect on defence and international security.

The Chagos islanders were forced to leave in the first place because they lived on an island known as Diego Garcia, which I explained in 2007 had been appropriated by the US and UK when the West lost its political influence in Ethiopia.

A surveillance base and listening-post located in the highlands of the Horn of Africa, to “monitor” Soviet influence in the Middle East, was transitioned in a hurry to the small island in the Indian Ocean. The island was cleared so it could be a military installation and supply port. The risk of interference from indigenous residents was resolved by forcibly removing them and any claims to their property.

Diego Garcia was not just a lone desolate spot in the sea that the US developed to protect the free world from the Red threat, as most reports used to say. It really was a place thousands of people called home before American soldiers landed and stripped them of their property, identity and livelihood.

A year earlier, in 2007, I referenced a film called Stealing a Nation and an article in The Guardian called Paradise cleansed. Both give a detailed look at the UK foreign policy attitude towards the Chagos population and their claims.

To get rid of the [Diego Garcia] population, the Foreign Office invented the fiction that the islanders were merely transient contract workers who could be “returned” to Mauritius, 1,000 miles away. In fact, many islanders traced their ancestry back five generations, as their cemeteries bore witness. The aim, wrote a Foreign Office official in January 1966, “is to convert all the existing residents…into short-term, temporary residents.”

What the files also reveal is an imperious attitude of brutality. In August 1966, Sir Paul Gore-Booth, permanent under-secretary at the Foreign Office, wrote: “We must surely be very tough about this. The object of the exercise was to get some rocks that will remain ours. There will be no indigenous population except seagulls.” At the end of this is a handwritten note by DH Greenhill, later Baron Greenhill: “Along with the Birds go some Tarzans or Men Fridays…” Under the heading, “Maintaining the fiction”, another official urges his colleagues to reclassify the islanders as “a floating population and to “make up the rules as we go along”.

They certainly have a way with words.

Thus the recent news, spurred by Wikileaks, is a new tactic for this same old fight. A marine park is clearly an easier pitch to the international community than claims of UK defense and international security. But I do not see why the park must be mutually exclusive to resettlement of the indigenous population. The whole idea of a park should use concepts of security to allow coexistence. Risks are reduced through study in order to prevent long-term negative impact. An area is set aside to ensure that the native species are not harmed or lost while new and old visitors are allowed to live there too.

“We are interested in the preservation of our homeland and we are backing the British Government on this,” said Allen Vincatassin, chairman of the Crawley-based Diego Garcian Society, the main islanders’ group in the UK. “We support the MPA and we believe the issue is separate from resettlement.”

The question then becomes whether the UK can accept a marine park operated for interests other than just their foreign office and military.

Health Risk of Low-Fat Milk

Body Earth has an excellent blog post on the Health Risks of Low-Fat Milk

For years my family only drank low-fat milk. It’s supposed to help us keep our weight down and reduce the risk of heart disease, right? Wrong. In fact, reduced-fat milk can harm our health. We now steer clear of the stuff whenever possible.

[…]

We always drink whole milk and cream now (never ultra-pasteurized) from cows that eat grass. Whole milk is a wonderful food that comes with the fat needed to use the fat-soluble vitamins (A, D, E, and K) it contains.

Definitely worth reading. I always stuck with whole milk and avoided low-fat milk because the data that said whole milk was fattening seemed inconclusive to me. Obviously it had not been a problem in the past, so what had suddenly changed it to a high-risk food? Moreover, I recognized that fat is necessary for brain development and other healthy body requirements. Whole milk, with just 3.5% fat, seemed like a great and time-tested option.

I also have noticed that arguments for low-fat are severely lacking. Whole Food’s puts this example forward as evidence of something remarkable:

A recent study conducted by the New York Department of Health and Mental Hygiene has shown the dramatic impact that milk choices can have on intake of calories and fat. Over a 4-year period (2006-2009), the New York City Department of Education shifted it milk purchases over from whole milk and chocolate milk made from whole-milk or low-fat milk to fat-free milk (whether unflavored or chocolate). In other words, students in 5 city boroughs (Manhattan, Queens, Brooklyn, Staten Island, and the Bronx) were only able to purchase fat-free milks in school by the end of this 5 year period. As a result, the New York Department of Education ended up purchasing and serving 4.6 billion fewer calories from milk products and 422 million less grams of fat!

Dramatic impact to what? What does their meaningless statistic prove? They banned whole milk and then did basic math on the difference between milk types. This is like saying they switched from selling 2 pencils per student to selling 1 pencil per student, for 1,000 students, and…amazingly ended up selling 1,000 fewer pencils! They do not say anything about the health or behavior of those in the study. Did they buy less milk? Lose weight? Get better grades? Anything? If this is their best and only example, they must not have seen any positive results worth reporting.

My guess is Whole Foods sells low-fat because they know it is popular right now. My guess is also that Whole Foods did not actually read the study when they used it as an example (they also did not include it in their references). If they had, they might have noticed this caveat:

…no data were collected on total food consumption during the school day, so the effect of the milk switch on overall diet is unknown. Students might compensate for the averted calories/fat from milk by changing their consumption patterns.

Compare that with a doctoral thesis in Sweden by a nutritionist who found that children drinking whole milk more than once a day had a lower body mass index than those who did not drink, or rarely drank, milk.

Maybe this tells us that children who drink a lot of milk also lead a more active lifestyle, or it is served to them along with healthier foods compared with the other kids, but at least the study tries to explain results with a measurable benefit instead of meaningless numbers.

The Soviet Union was famous for pushing meaningless calculations around. I had an economics professor once who had studied real cases where success was measured on output without factoring input. It had led to all kinds of absurd attempts to cheat and manipulate the measures. If a factory was measured on area output, the input would be spread as thinly as possible. If they were measured by weight, the input was collected into small and dense areas. Take the production of glass windows, for example. All the windows either were so thin they immediately broke or they were so thick they did not fit the frames.

From what I can tell, based on measures and studies so far, whole milk is still the safest, healthiest and best-tasting option. That is why I avoid low-fat milk.