4 ms·

Great in depth post. One question: What's your opinion on Qubes , or it's windows brethren Bromium[2] and blueridge Appguard[1] ? Not against TAO , like you s

by petra 11y ago

Great in depth post. One question: What's your opinion on Qubes , or it's windows brethren Bromium[2] and blueridge Appguard[1] ? Not against TAO , like you said it won't work, but maybe it's the best a regular person or small company can do ? [1]http://www.blueridge.com/index.php/products/appguard/consumer http://www.blueridge.com/index.php/products/appguard/consume... [2]http://www.bromium.com/ http://www.bromium.com/

nickpsecurity 11y ago
Those kind of tricks are basically risk mitigation against untargeted attacks or attacks targeted against components that can be damage limited. They're fine for that. They fall short when attackers start aiming for the hypervisor, firmware, etc or can do damage within the compromised VM/partition (app-layer attack). Security against those attackers has to somehow isolate the effects of their data or code from those things. In other words, you need it at every layer with each component assured and the integration done safely. None of those meet that. Only one's that come close are commercial and might not even serve a small business. :( My old strategy was several cheap computers hooked up with a KVM switch and a guard to assess data moving between them. Basic airgapping w/ trusted transfer. The simplest scenario splits confidential and untrusted (esp Internet). Wasn't that hard to use: just inconvenient on occasion. Setting up guard and software properly is tricky to say the least. A specialist is necessary although an OpenBSD or Linux box well-configured can work out for common attackers. On Windows, I used AV for reaction, Defensewall/AppGuard/SandboxIE (varied) for prevention, did backups/restores with a boot CD, write-protect BIOS if available, regular patching, and Linux Live CD (kept up to date) for stuff like banking. Regular restores from backups, too, with patches applied to clean copies. I used RAMdrives for temporary storage so it autodeleted upon shutdown. I used write-protect HD's to prevent corruption of OS partition but not available now that I know of. Physical wire, not wireless, for Internet disconnected in old school fashion when not in use to deny bot bandwidth if nothing else. :) Non-traditional router made from non x86 or ARM box running a Linux or BSD firewall distro. Sparcstations with OpenBSD were popular among paranoids. Can't remember mine as it was one time. Just a few things I remember. Had I stayed on Windows, I was going to next explore using Windows Embedded to strip out more attack surface. A friend named tommy, smart but not IT guy, systematically backed up, deleted, tested, and restored on failure his Windows XP box in iterations until he found how little code & data it needed to still function. He got a WinXP system with Office, Firefox, AV, etc down to 650MB total backed up on a CD. Unreal. I figured, as I had stripped 'NIX's, I could apply that strategy to Windows with more ease if I let Embedded's tools safely do first stage for me. Good head start cuz I don't have years of obsession for one hardening. ;) Also, on lighter side, I put some people with extremely minimal needs on hardened Mac's with PPC processors. I knew malware authors would exclusively target Intel's upon the transition with replacement hardware cheap on eBay. Strategy still works for those using it. One of my air-gapped backups is a PPC laptop I got for $80. What do RaspPi and accessories cost again to deliver what? ;) Otherwise, hardened Mac's on Intel might be a safe strategy for average business due to rare targeting. Even Krebs endorsed that strategy at one point. Still with backups to read-only media and such. So, there's that.
- petra 11y ago
  Thank you. That protection for windows scheme sounds secure, but far too complicated . >>They fall short when attackers start aiming for the hypervisor, firmware, etc or can do damage within the compromised VM/partition (app-layer attack) First, i think Qubes added some isolation for USB and graphics , and in general protections against firmware attacks(if you enable VT-d in bios) . Also , How much of a problem is that if you don't care about protection from state level attackers only commercial attacks, and use app layers wisely(banking has it's own layer, for ex.) ? Because i don't understand how targeted vs un-targeted applies to state vs commercial.
  - nickpsecurity 11y ago
    "That protection for windows scheme sounds secure, but far too complicated ." We used to train laypeople to do it and even use NoScript with pre-defined profiles. Hard parts could be automated, even sold commercially. "First, i think Qubes added some isolation for USB and graphics , and in general protections against firmware attacks(if you enable VT-d in bios) ." Probably. That could contain some issues. I remember when I first evaluated it that she didn't know user-mode drivers had benefit, thought Mac OS X was an example of a microkernel, hadn't considered a trusted path, and disagreed with me about Xen being likely insecure. Now, it has a UI/graphics subsystem or something plus she was criticizing Xen on mailing list for insecurity. Lol... For these reasons, I avoided it for strong attackers as I'm not sure they're qualified on defense as much as offense. A common problem. Still probably good for containing ordinary malware, though. I plan to re-assess it for that in the near future as I heard usability is good. "Also , How much of a problem is that if you don't care about protection from state level attackers only commercial attacks" The problem is that they're the same: nation states just have more 0-days and toolkits affecting more places. All of them hit OS's and app level. So, a kernel-level 0-day is a problem there whether it's nation state or not. More are hitting firmware and routers. Hard to say what the difference is in risk level today or near future. For most, their security comes from the fact that nobody is targeting them specifically. If you're not being targeted, just using obscure stuff that has basic protection or QA can stop the wide nets. If your targeted, you want less code in trusted computing base (eg privileged) and good architecture. Currently, the only OSS project implementing a sound architecture, trusted path, microkernels, etc is GenodeOS. They got started in CompSci research leveraging proven techniques and components in defense. Their architecture itself needs more peer review as novel stuff often has trouble. Regardless, they're at alpha-stage for desktop usage and improving steadily. People just protecting their businesses should just use a hardened Mac, BSD, or Linux setup with regular backups. Optionally, if they can use it, NoScript or an ad blocker. Add HTTPSeverywhere. That will stop vast majority of attacks that would take over their system while being pretty easy to use. At least until this gets popular or a black hat group has a beef with one. ;)

by petra 11y ago

nickpsecurity 11y ago

Those kind of tricks are basically risk mitigation against untargeted attacks or attacks targeted against components that can be damage limited. They're fine for that. They fall short when attackers start aiming for the hypervisor, firmware, etc or can do damage within the compromised VM/partition (app-layer attack). Security against those attackers has to somehow isolate the effects of their data or code from those things. In other words, you need it at every layer with each component assured and the integration done safely. None of those meet that. Only one's that come close are commercial and might not even serve a small business. :( My old strategy was several cheap computers hooked up with a KVM switch and a guard to assess data moving between them. Basic airgapping w/ trusted transfer. The simplest scenario splits confidential and untrusted (esp Internet). Wasn't that hard to use: just inconvenient on occasion. Setting up guard and software properly is tricky to say the least. A specialist is necessary although an OpenBSD or Linux box well-configured can work out for common attackers. On Windows, I used AV for reaction, Defensewall/AppGuard/SandboxIE (varied) for prevention, did backups/restores with a boot CD, write-protect BIOS if available, regular patching, and Linux Live CD (kept up to date) for stuff like banking. Regular restores from backups, too, with patches applied to clean copies. I used RAMdrives for temporary storage so it autodeleted upon shutdown. I used write-protect HD's to prevent corruption of OS partition but not available now that I know of. Physical wire, not wireless, for Internet disconnected in old school fashion when not in use to deny bot bandwidth if nothing else. :) Non-traditional router made from non x86 or ARM box running a Linux or BSD firewall distro. Sparcstations with OpenBSD were popular among paranoids. Can't remember mine as it was one time. Just a few things I remember. Had I stayed on Windows, I was going to next explore using Windows Embedded to strip out more attack surface. A friend named tommy, smart but not IT guy, systematically backed up, deleted, tested, and restored on failure his Windows XP box in iterations until he found how little code & data it needed to still function. He got a WinXP system with Office, Firefox, AV, etc down to 650MB total backed up on a CD. Unreal. I figured, as I had stripped 'NIX's, I could apply that strategy to Windows with more ease if I let Embedded's tools safely do first stage for me. Good head start cuz I don't have years of obsession for one hardening. ;) Also, on lighter side, I put some people with extremely minimal needs on hardened Mac's with PPC processors. I knew malware authors would exclusively target Intel's upon the transition with replacement hardware cheap on eBay. Strategy still works for those using it. One of my air-gapped backups is a PPC laptop I got for $80. What do RaspPi and accessories cost again to deliver what? ;) Otherwise, hardened Mac's on Intel might be a safe strategy for average business due to rare targeting. Even Krebs endorsed that strategy at one point. Still with backups to read-only media and such. So, there's that.

petra 11y ago
Thank you. That protection for windows scheme sounds secure, but far too complicated . >>They fall short when attackers start aiming for the hypervisor, firmware, etc or can do damage within the compromised VM/partition (app-layer attack) First, i think Qubes added some isolation for USB and graphics , and in general protections against firmware attacks(if you enable VT-d in bios) . Also , How much of a problem is that if you don't care about protection from state level attackers only commercial attacks, and use app layers wisely(banking has it's own layer, for ex.) ? Because i don't understand how targeted vs un-targeted applies to state vs commercial.
- nickpsecurity 11y ago
  "That protection for windows scheme sounds secure, but far too complicated ." We used to train laypeople to do it and even use NoScript with pre-defined profiles. Hard parts could be automated, even sold commercially. "First, i think Qubes added some isolation for USB and graphics , and in general protections against firmware attacks(if you enable VT-d in bios) ." Probably. That could contain some issues. I remember when I first evaluated it that she didn't know user-mode drivers had benefit, thought Mac OS X was an example of a microkernel, hadn't considered a trusted path, and disagreed with me about Xen being likely insecure. Now, it has a UI/graphics subsystem or something plus she was criticizing Xen on mailing list for insecurity. Lol... For these reasons, I avoided it for strong attackers as I'm not sure they're qualified on defense as much as offense. A common problem. Still probably good for containing ordinary malware, though. I plan to re-assess it for that in the near future as I heard usability is good. "Also , How much of a problem is that if you don't care about protection from state level attackers only commercial attacks" The problem is that they're the same: nation states just have more 0-days and toolkits affecting more places. All of them hit OS's and app level. So, a kernel-level 0-day is a problem there whether it's nation state or not. More are hitting firmware and routers. Hard to say what the difference is in risk level today or near future. For most, their security comes from the fact that nobody is targeting them specifically. If you're not being targeted, just using obscure stuff that has basic protection or QA can stop the wide nets. If your targeted, you want less code in trusted computing base (eg privileged) and good architecture. Currently, the only OSS project implementing a sound architecture, trusted path, microkernels, etc is GenodeOS. They got started in CompSci research leveraging proven techniques and components in defense. Their architecture itself needs more peer review as novel stuff often has trouble. Regardless, they're at alpha-stage for desktop usage and improving steadily. People just protecting their businesses should just use a hardened Mac, BSD, or Linux setup with regular backups. Optionally, if they can use it, NoScript or an ad blocker. Add HTTPSeverywhere. That will stop vast majority of attacks that would take over their system while being pretty easy to use. At least until this gets popular or a black hat group has a beef with one. ;)