Category Archives: Security

Google Fights (Chinese) Treats

The Chinese might have responded with too much haste to the most recent accusations by Google. The English news from Xinhuanet has made some amusing and unfortunate errors. This one is probably my favourite:

In fact, individual criminals, rather than states, are the major treat to Internet safety, as some U.S. experts say.

I would like to know which experts say this. Criminals are a major treat? Do these treats leave a sour taste?

The next one makes me think that the Chinese editors might have relied too much on Google translate.

The chimerical complaints by Google have become obstacles for enhancing global trust between stakeholders in cyberspace.

If only Google had known that their language engine would be used to draft the letter against them. Oh, the fun they could have had.

Although China does not identify the experts it cites, mentioned above, they don’t seem to mind accusing Google of failing to identify theirs. Double standard?

Then unidentified American security investigators said, they traced the attackers to computers at Chinese Shanghai Jiaotong University and Lanxiang Vocational School, according to the New York Times.

And then they try for some humour.

The report amused many Chinese at that time since Lanxiang Vocational School enjoys a good fame at training chefs for local restaurants.

But the American investigators suggested that the school had the capacity to stage the cyber attacks and made the world’s No. 1 search engine suffer. It is really hard for people with common sense to understand.

Well, actually, I don’t know about that since security experts in America often tout their culinary skills. I know one who brags about his “short-order cook” training, another who writes guides to restaurants, and another just retired to start a chocolate company.

It could just be that Americans think very highly of culinary skill while the Chinese…well, apparently common sense to them is you don’t want to eat the food made by graduates of the Lanxiang Vocational School. Americans who saw the school’s name might have thought “good fame at training chefs” meant something like Culinary Arts instead of “do you want fries with that”.

Never mind the messenger(s). The historic trend of attacks has been away from states and towards groups/individuals, away from clear definitions of victory and towards mixed levels of compromise. That was a large point of my Dr. Stuxlove presentation earlier this year. Google might believe it knows reasons why China is sponsoring or even supporting attacks but the company has yet to provide anything even close to a proof.

It is hard not to wonder about the timing and the reason they chose to announce this breach. Does Google make a major news announcement every time they think someone not in China is responsible for breaching their security?

A source familiar with the incident said this was not the first time a Google employee has been dismissed as the result of a privacy breach

I am reminded of a comment I made on Bruce’s blog the other day about the US intelligence community’s recently published review on McCarthy-ism. I ranted a bit but the follow-up comments by Eric and Dirk are excellent. Definitely worth checking their perspectives out if you have a moment.

Speaking of Bruce, he declares this whole flap non-newsworthy but I know he is into good food and I bet he hasn’t taken into account the criminal treats.

2011 DECnet Remote Exploit

Whoa, blast from the past. Leave it to Linux users to want to maintain support for the VAX. I haven’t seen DECnet mentioned for forever and then it shows up in a remote exploit announcement of all places.

Despite the BUG_ON and comment suggesting these lengths have been validated, I don’t think this is actually the case – it looks like these fields are validated for outbound data, but I see no validation for inbound data (unless I’m mistaken, which is entirely possible). If this is the case, this can allow remote attackers to cause controllable heap corruption. I’d appreciate it if someone who knows this protocol better than I do took a look at this and implemented appropriate error handling if it needs it.

This just goes to show that today if you spend enough time randomly source auditing, fuzz testing, and reverse engineering it could turn into an exploit in the strangest of places…and if you root a system still connected to a VAX you are bound to find something interesting.

DEC VAX SOFTWARE MAINTENANCE [for the F-100 Engine on the F-15/F-16]
Solicitation Number: FA8126-11-Q-0171
Agency: Department of the Air Force
Office: Air Force Materiel Command
Location: Tinker OC-ALC – (Central Contracting)
[…]
Added: Apr 07, 2011 4:16 pm

ChooseMyPlate.gov

The US government has announced it is replacing the infamous pyramid of food with a pie. Oh, wait, I mean a plate cut up into pieces that look like pie.

Eating healthy never looked so good.

However, I am a bit confused by the text they have below their new illustration.

Switch to fat-free or low-fat (1%) milk.

First, what? Switch from pie to milk? I just adopted the new pie diet and already they are asking me to switch?

Second, if I’m going to drink any milk at all, I’m going to drink healthy milk — whole raw milk — and not some rehydrated reconstituted dried lint from dirty socks blue-tinted water low-fat milk substitute. I’d drink camel milk long before I would agree to poison myself with the stuff left over when you remove the milk (fat) from milk.

Research clearly shows [http://www.ncbi.nlm.nih.gov/pubmed/18831752] that whole milk causes more lean body mass gains than non fat milk. Which proves fat doesn’t make you fat [http://stronglifts.com/the-4-most-popular-fat-myths-debunked/]. Excess calories do. As long as you have a caloric deficit, it doesn’t matter if you drink non fat or whole milk.

It doesn’t matter as long as you know the risks from the process used to make milk non fat and what you are missing.

Reuters Quotes Me on Michaels Breach

Reuters interviewed me and published a story called “Expert cites new hack tactic in Michaels data breach

Ottenheimer estimated that Michaels was likely facing tens of thousands or even hundreds of thousands of dollars in costs related to replacing the 7,200 PIN pads, including training employees to regularly check that the equipment has not been compromised.

I’m glad they included the security procedures comment, although I sound more conservative than I realised at the time. The cost breakdown of their upgrade is affected by many factors such as planned depreciation of existing equipment, logistics and shipping, installation and configuration of the hardware/software.

But PIN pad security and compliance is not just about the technology. Michaels management also will have to update and test their procedures and provide company-wide training to prevent or detect further compromise. That is why a new replacement estimate could easily reach into the hundreds of thousands, unless it already was in plan and budget, as I explained previously.