3 ms·

I can't stand this "throw up our hands" reaction to nation-state adversaries. None of these APTs have unlimited budgets; sufficient hardening and defense-in-de

I can't stand this "throw up our hands" reaction to nation-state adversaries. None of these APTs have unlimited budgets; sufficient hardening and defense-in-depth will encourage the planner to use different targets to satisfy the tasker's intent. Every security improvement helps. We can't just say "run SELinux in a VM and use Tails with JavaScript disabled or accept the Mossad completely owning your life." There has to be a realistic middle ground.

nickpsecurity 10y ago
It's not a throw up your hands reaction. The Linux stacks, from kernel to key apps, have had boatloads of vulnerabilities since they accept insecure code written in languages easy to screw up by people who arent security engineers. Such a stack has no business being used in anything designed to resist well-funded or determined attackers. Federal government's own criteria rates Linux at EAL4: "can protect against causual or inadvertant attempts to breach security." Whereas, even trying to stop nation-states requires very-rigorous developmenf plus review of vastly simpler systems. Systems done like that resisted NSA penetration during evaluation. So, the trick for FOSS is to do their stacks like that. They refuse. Genode is at least architecturally doing it right. Muen and seL4 are separation kernels that might be turned into the foundation. The pieces are there and could be turned into a usable system with a tiny amount of effort compared to what's going into Linux right now. It can even run Linux apps user-mode. Commercial implementations already exist for these (eg Turaya Desktop, Dell SCC) while FOSS just ignores it like most high-security techniques. Google Nizza Secure Systems architecture pdf for an example from CompSci. Genode evolved from it but basis could be done in other projects.
- linkregister 10y ago
  I am blown away at the amount of terms you mentioned that I never heard of, despite working in vulnerability research/development for years. I've got a lot of Googling to do. It sounds like you are an expert at secure operating systems. I want to emphasize that computer network security is more than a secure operating system. It is defense in depth: the combination of well-designed networks that are hard to traverse, isolated endpoints for internet-facing products, management interfaces that are also properly isolated, monitoring that alerts with a low false positive and negative rate, sufficient logging and analysis that surfaces anomalies while keeping noise down, etc. These are hard and should be scaled to the appropriate threat level to prevent impact to usability. It is possible to keep a computer network secure from APT even with a vulnerable operating system. The APT has to deal with everything mentioned above even if it has spent millions on vulnerability research on a vulnerability-ridden operating system.
  - nickpsecurity 10y ago
    "It is possible to keep a computer network secure from APT even with a vulnerable operating system. The APT has to deal with everything mentioned above even if it has spent millions on vulnerability research on a vulnerability-ridden operating system." All the big companies seem to be failing at that given the TB of data exported. It's pretty hard. Whereas, systems immune to code injection or catching leaks by default might have reduced it considerably. That's why INFOSEC's inventors focused on designing those. "I am blown away at the amount of terms you mentioned that I never heard of, despite working in vulnerability research/development for years. I've got a lot of Googling to do. It sounds like you are an expert at secure operating systems." The reason is that INFOSEC the profession acts in almost a pop culture way where what's popular from certain parties goes. Very fad-driven. It was originally created by engineers and computer scientists that did things in a rigorous way with excellent results in pentesting. The strongest form we called high-assurance security or real security if you ask me. They solved tons of problems early on. Later people ignored them entirely starting around the 90's onward. Keep reinventing their lessons but most steadfastly refuse to read & follow their work. In any case, send me an email if you want a curated list showing where it came from, what was achieved, with what methods, and so on. I'll send as much or at little as you can take. Meanwhile, here's my own framework I posted for free after high-assurance market went nowhere outside defense. It embeds some of what I learned from them. http://pastebin.com/y3PufJ0V http://pastebin.com/y3PufJ0V For interim, I'll give you just a few on the main model that achieved real security: designing system around a limited, strong component where all trust is placed called a TCB. First is paper on first systems certified for security claims based on high-assurance methods invented in 1970's. Both are still available commercially. Second is example of secure VMM (for OpenVMS) done by legendary engineer & INFOSEC co-founder Paul Karger. Pay attention to "Layered Design" & "Assurance" sections then wonder why mainstream INFOSEC is barely securing VMM's today despite techniques (eg leak mitigation) being ancient. Third is architecture that evolved from them in academia that I link since the paper explains the concept really well. Fourth is the only FOSS implementation of that architecture using best-of-breed components like seL4 or Nitpicker. Fifth is Nitpicker just so you see how our sub-field of INFOSEC turns hard problems like trusting X/KDE/Gnome apps into simpler ones. Sixth is a secure, browsing architecture that shows both a way to do it better & how systematically people in high-assurance solve these problems. http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf https://os.inf.tu-dresden.de/papers_ps/nizza.pdf https://os.inf.tu-dresden.de/papers_ps/nizza.pdf https://genode.org/ https://genode.org/ https://os.inf.tu-dresden.de/papers_ps/feske-nitpicker.pdf https://os.inf.tu-dresden.de/papers_ps/feske-nitpicker.pdf https://www.usenix.org/legacy/event/osdi10/tech/full_papers/Tang.pdf https://www.usenix.org/legacy/event/osdi10/tech/full_papers/...

nickpsecurity 10y ago

It's not a throw up your hands reaction. The Linux stacks, from kernel to key apps, have had boatloads of vulnerabilities since they accept insecure code written in languages easy to screw up by people who arent security engineers. Such a stack has no business being used in anything designed to resist well-funded or determined attackers. Federal government's own criteria rates Linux at EAL4: "can protect against causual or inadvertant attempts to breach security." Whereas, even trying to stop nation-states requires very-rigorous developmenf plus review of vastly simpler systems. Systems done like that resisted NSA penetration during evaluation. So, the trick for FOSS is to do their stacks like that. They refuse. Genode is at least architecturally doing it right. Muen and seL4 are separation kernels that might be turned into the foundation. The pieces are there and could be turned into a usable system with a tiny amount of effort compared to what's going into Linux right now. It can even run Linux apps user-mode. Commercial implementations already exist for these (eg Turaya Desktop, Dell SCC) while FOSS just ignores it like most high-security techniques. Google Nizza Secure Systems architecture pdf for an example from CompSci. Genode evolved from it but basis could be done in other projects.

linkregister 10y ago
I am blown away at the amount of terms you mentioned that I never heard of, despite working in vulnerability research/development for years. I've got a lot of Googling to do. It sounds like you are an expert at secure operating systems. I want to emphasize that computer network security is more than a secure operating system. It is defense in depth: the combination of well-designed networks that are hard to traverse, isolated endpoints for internet-facing products, management interfaces that are also properly isolated, monitoring that alerts with a low false positive and negative rate, sufficient logging and analysis that surfaces anomalies while keeping noise down, etc. These are hard and should be scaled to the appropriate threat level to prevent impact to usability. It is possible to keep a computer network secure from APT even with a vulnerable operating system. The APT has to deal with everything mentioned above even if it has spent millions on vulnerability research on a vulnerability-ridden operating system.
- nickpsecurity 10y ago
  "It is possible to keep a computer network secure from APT even with a vulnerable operating system. The APT has to deal with everything mentioned above even if it has spent millions on vulnerability research on a vulnerability-ridden operating system." All the big companies seem to be failing at that given the TB of data exported. It's pretty hard. Whereas, systems immune to code injection or catching leaks by default might have reduced it considerably. That's why INFOSEC's inventors focused on designing those. "I am blown away at the amount of terms you mentioned that I never heard of, despite working in vulnerability research/development for years. I've got a lot of Googling to do. It sounds like you are an expert at secure operating systems." The reason is that INFOSEC the profession acts in almost a pop culture way where what's popular from certain parties goes. Very fad-driven. It was originally created by engineers and computer scientists that did things in a rigorous way with excellent results in pentesting. The strongest form we called high-assurance security or real security if you ask me. They solved tons of problems early on. Later people ignored them entirely starting around the 90's onward. Keep reinventing their lessons but most steadfastly refuse to read & follow their work. In any case, send me an email if you want a curated list showing where it came from, what was achieved, with what methods, and so on. I'll send as much or at little as you can take. Meanwhile, here's my own framework I posted for free after high-assurance market went nowhere outside defense. It embeds some of what I learned from them. http://pastebin.com/y3PufJ0V http://pastebin.com/y3PufJ0V For interim, I'll give you just a few on the main model that achieved real security: designing system around a limited, strong component where all trust is placed called a TCB. First is paper on first systems certified for security claims based on high-assurance methods invented in 1970's. Both are still available commercially. Second is example of secure VMM (for OpenVMS) done by legendary engineer & INFOSEC co-founder Paul Karger. Pay attention to "Layered Design" & "Assurance" sections then wonder why mainstream INFOSEC is barely securing VMM's today despite techniques (eg leak mitigation) being ancient. Third is architecture that evolved from them in academia that I link since the paper explains the concept really well. Fourth is the only FOSS implementation of that architecture using best-of-breed components like seL4 or Nitpicker. Fifth is Nitpicker just so you see how our sub-field of INFOSEC turns hard problems like trusting X/KDE/Gnome apps into simpler ones. Sixth is a secure, browsing architecture that shows both a way to do it better & how systematically people in high-assurance solve these problems. http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf https://os.inf.tu-dresden.de/papers_ps/nizza.pdf https://os.inf.tu-dresden.de/papers_ps/nizza.pdf https://genode.org/ https://genode.org/ https://os.inf.tu-dresden.de/papers_ps/feske-nitpicker.pdf https://os.inf.tu-dresden.de/papers_ps/feske-nitpicker.pdf https://www.usenix.org/legacy/event/osdi10/tech/full_papers/Tang.pdf https://www.usenix.org/legacy/event/osdi10/tech/full_papers/...