Friday, May 16, 2008

A major security hole was discovered in the pseudo-random number generator (PRNG) of the Debian version of OpenSSL. OpenSSL is one of the most used cryptographic software, that allows the creation of secure network connections with the protocols called SSL and TLS. It is included in many popular computer programs, like the Mozilla Firefox web browser and the Apache web server. Debian is one of the most used GNU/Linux distributions, on which are based other distributions, like Ubuntu and Knoppix. The problem affects all the Debian-based distributions that were used to create cryptographic keys since the September 17, 2006. The bug was discovered by Luciano Bello, an argentine Debian package maintainer, and was announced on May 13, 2008.

This vulnerability was caused by the removal of two lines of code from the original version of the OpenSSL library. These lines were used to gather some entropy data by the library, needed to seed the PRNG used to create private keys, on which the secure connections are based. Without this entropy, the only dynamic data used was the PID of the software. Under Linux the PID can be a number between 1 and 32,768, that is a too small range of values if used to seed the PRNG and will cause the generation of predictable numbers. Therefore any key generated can be predictable, with only 32,767 possible keys for a given architecture and key length, and the secrecy of the network connections created with those keys is fully compromised.

These lines were removed as “suggested” by two audit tools (Valgrind and Purify) used to find vulnerabilities in the software distributed by Debian. These tools warned the Debian maintainers that some data was used before its initialization, that normally can lead to a security bug, but this time it was not the case, as the OpenSSL developers wrote on March 13, 2003. Anyway this change was erroneously applied on September 17, 2006, when the OpenSSL Debian version 0.9.8c-1 was released to the public.

Even though the Debian maintainer responsible for this software released a patch to fix this bug on May 8, 2008, the impact may be severe. In fact OpenSSL is commonly used in software to protect the passwords, to offer privacy and security. Any private key created with this version of OpenSSL is weak and must be replaced, included the session keys that are created and used only temporary. This means that any data encrypted with these keys can be decrypted without a big deal, even if these keys are used (but not created) with a version of the library not affected, like the ones included in other operating systems.

For example any web server running under any operating system may use a weak key created on a vulnerable Debian-based system. Any encrypted connection (HTTPS) to this web server established by any browser can be decrypted. This may be a serious problem for sites that requires a secure connection, like banks or private web sites. Also, if some encrypted connection was recorded in the past, it can be decrypted in the same way.

Another serious problem is for the network security software, like OpenSSH and OpenVPN, that are used to encrypt the traffic to protect passwords and grant the access to an administrative console or a private network protected by firewalls. This may allows hackers to gain unwanted access to private computers, networks or data traveled over the network, even if a not affected version of OpenSSL was used.

The same behavior can be applied to any software or protocol that use SSL, like POP3S, SSMTP, FTPS, if used with a weak key. This is the case of Tor, software used to offer strong anonymity on the TCP/IP, where about 300 of 1,500-2,000 nodes used a weak key. With 15-20% of weak Tor nodes, there is a probability of 0.34-0.8% circa to build a circuit that has all tree nodes weak, resulting in a full loss of anonymity. Also the case of only one weak node begin used may facilitate some types of attack to the anonymity. The Tor hidden services, a sort of anonymous public servers, are affected too. However the issue was speedily addressed on May 14, 2008.

The same problem also interested anonymous remailers like Mixmaster and Mixminion, that use OpenSSL to create the remailer keys for the servers and the nym keys for the clients. Although currently there is no official announcement, at least two remailer changed their keys because were weak.

Saturday, December 2, 2006

As families fled their homes in the early morning hours on Thursday October 26, there was no warning. The Esperanza Fire southeast of Los Angeles and West of Palm Springs, California, had ballooned under the influence of Santa Ana winds to more than 19,000 acres as of the morning of October 27. No time to get the animals, no time for crates or even a leash. Sadly, owners left behind not only their horses, lamas, donkeys, chickens, rabbits, but also their dogs and cats.

Many of the families who did manage to evacuate their pets found themselves in the parking lot at the Fellowship in the Pass Church Red Cross Shelter where a MuttShack Animal Rescue team caught up with them.

Pam Anderson, Director of the emergency Red Cross shelter said that many people with animals had come and left.

The air was thick with smoke, and ash was raining down on the parking lot where dog owners, not able to take their dogs into the shelter were camping out in pup tents andin their cars.

Those who could afford it checked themselves into pet friendly hotels in nearby towns.

Some were prepared. Jane Garner, a small dog breeder was able to get all her animals out, and had set up her puppy runs alongside her RV in the parking lot. Others were not doing too well, having left home without as much as a leash.

The same scenario played out at the Red Cross shelter at Hemet High School. Animals were being boarded in vans, trailers and cars and small travel crates.

When MuttShack Animal Rescue arrived, a small fracas had sent several dogs off in different directions, running out of the school parking lot down busy streets necessitating an instant rescue response.

The Incident Command for the Esperanza Animals, Ramona Humane Society in San Jacinto welcomed MuttShack‘s offer to help at the shelters.

Ramona Humane Society had recently published a notice in their Newsletter about the newly passed “PETS Act”and warned owners not wait until a major disaster such as an earthquake or fireto prepare. “Be proactive to ensure that your pet will be taken care of.”

MuttShack and PetSmart Charities set up ad hoc facilities for the animals at both shelters.

The Red Cross shelter, run by Madison Burtchaell of the Orange County Red Cross was very accommodating about allowing a small emergency pet shelter adjacent to the School.

Barbara A. Fought of PetSmart Charities, an organization that works with animal welfare organizations and provide assistance in disasters, provided crates and emergency supplies.

MuttShack and Red Cross volunteers, Martin St. John, Tom Hamilton, and Steve Meissner helped assemble the crates to secure a safe environment for evacuated pets.

It was a great relief for evacuees who had camped out in the parking lot to finally leave their vehicles and relax at the shelter, setting up their cots to grab some sorely needed rest.

Firefighters and residents reported loss of wildlife and animals. The Esperanza fire burned 34 homes, consumed 40,000 acres and cost five Firefighters their lives before it was contained four days later on October 30. Firefighting operations cost nearly $10 million.

MuttShack Animal Rescue is a 501(c) 3 non-profit organization active in disasters and dedicated to the rescue, rehabilitation and care of lost or discarded dogs, cats and other animals.

Tuesday, May 3, 2005

Swiss banking giant UBS today reported better than expected first-quarter results – but warned investors that full year results could be hit by weaker investment banking revenues.

First-quarter net profit stood at 2.625bn Swiss francs (US$2.19bn; €1.7bn) up 15% from last year’s 2.28bn Swiss francs. Assets under management grew to 2.36 trillion Swiss francs (US$1.97 trillion; €1.53 trillion); an increase of 21.2bn Swiss francs on last year.

Despite the solid performance, CFO Clive Standish told the media “Clearly we have seen a slowing of the markets over the quarter, particularly in March… There is a perceptible slowdown in markets as we speak.”Reacting to the pessimism, UBS shares dropped 1.5%.

Wednesday, August 30, 2006

Tuesday, Prime Minister Stephen Harper was filming a cameo appearance on the popular sitcom Corner Gas. Corner Gas is filmed about 40 km south of Regina in the tiny farming community of Rouleau.

Harper was filmed in a scene where he was surrounded by a large group of actors playing reporters and photographers. After completing the scene, he got back into his car and a motorcade left the town, which is called Dog River on the show.

“We can’t say much about cameo appearances, because they’re supposed to be a surprise for the viewers, but yes, there was press scrum,” Corner Gas executive producer Virginia Thompson said. “That’s all I can reveal.” “It works well for the show, actually … We were told by the Prime Minister’s Office that he had a sense of humour, but we thought we would wait and see and sure enough, yeah, he delivered.”

When Paul Martin was the leader of the government, he had a cameo on the show last season. Saskatchewan Premier Lorne Calvert has also made an appearance on the show last season.

“The prime minister was not paid for his appearance and had other reasons for coming to Saskatchewan beyond being part of the show”, said Thompson.

Reporters were kept back and not allowed to see how he performed in front of the cameras.

Harper waved goodbye to small town of Rouleau while travelling down Highway 39 away from the set after spending about 1 1/2 hours there. After, Harper planned to meet with members of his Saskatchewan caucus at a barbeque at Sherwood Forest Country Club Tuesday night. Harper is scheduled to tour the RCMP training academy in Regina today.

The episode featuring Harper will air sometime next spring.