Slashdot Mirror
NSA + VMware = Crackproof Computing?
n8willis writes: "ZDnet is reporting on a VMware and NSA collaboration called "NetTop." The idea to run multiple virtual computers on one box, to eliminate the need for government workers to have separate PCs--and indeed separate networks--for classified and unclassified data. The challenge is making the virtual barriers as secure as the physically separate networks. NSA and VMware say they've done it. What do you think?" Will copying between virtual machines be impossible? I wonder when (or if) NSA changes will make their way into the various distributions' boxed releases.
I'm very pleased the way technology from some of the NSA's earlier projects has filtered out to us in some form or another. I hope that other projects do the same! What I don't understand though, is how can they really prevent copying from one OS to another? It's all in memory. Can't they just copy it from there? Or is the entire virtual os encrypted or something? That seems horribly slow. :)
Ben
Ben Schumin :-)
As I understand it now, the present system where multiple machines are used in government institutions has a black machine that contains secret data, and a white machine that contains only sensitive data. Much harder to type something into the wrong machine when the color of it is immediately apparent to you, I would think.
--
Therefore, this would only help a PC user that is always working under his highest security.
----------------------
--
You think being a MIB is all voodoo mind control? You should see the paperwork!
A man who wants nothing is invincible
Um, I've been working with classified materials on computers for the past 12 years, and in all that time I've not once seen color-coded machines.
:-)
We do have stickers on each machine, color-coded as well as with much verbiage, telling what level of material can be accessed on each machine. Hell, we've got classification stickers on Xerox machines!
Illegitimi non carborundum
You mean you've gotten DMS working? hehe
We're still getting contradictory instructions ever couple days on how to interact with "normal" email addresses, and new registry patches get pushed out seemingly daily.
Thank goodness I'm leaving next week.
Illegitimi non carborundum
As I remember it Mutlics went to insane lengths to get their rating -- first it was Mr. Secure Guy cannot set the system time because that would leak bits. Then it was weird stuff with trying to hide the paging behavior of Mr. Secure Guy from less secure people, since you could communicate bits down by paging in and out large amounts of memory and having someone at a less secure level monitor system resources. I can't remember how they camoflagued the paging behavior of the higher security levels, but it wasn't simple.
By giving it direct access only to the virtualized MMU?
Ignoring tricks/bugs that cause the machine to violate the partitioning, there are always other ways to get around VMware in theory. Data could be passed in display adapter memory, in "garbage" registers or memory, or you can even pass data between VMware/etc processes on a totally secure machine by having them affect task switch time (admittedly, this is a very low-bandwidth channel, but it does work).
Why wouldn't they virtualize the resource measurement/allocation. Make it so that hardware resource measurement (disk I/O, processor, net I/O, etc.) is completely isolated between virtual machines.
Well, let's analyze this then:
If you have some element with HCL as a constituent unit and then you remove the HCL, what happens? The two become chemically different. If two things are chemically different, then they are not the same.
-----
"People who bite the hand that feeds them usually lick the boot that kicks them"
Higher Logics: where programming meets science.
Sorry, wrong thread...
How? How about the fact that the unclassified VM has access to the virtualized MMU, not the real one?
Comment removed based on user account deletion
Like it's going to prevent security clearance worker from snip-snip, paste-paste.
Sounds like S/390. :)
-_Quinn
Reality Maintenance Group, Silver City Construction Co., Ltd.
I agree... there's still a single machine running a single operating system underneath it all... Crackers would just have to start getting familiar with the way VMWare handles processes. Or, if they're just after the data, just crack the host OS and grab data from there...
---- It puts the lotion on its skin or else it gets the hose again. It does this whenever it's told.
Why can't we do the same thing with User Mode Linux?
Crap! I don't want VMWare to set up barriers around my virtual machines; I'd like very much for them to interoperate smoothly!
It's still the same machine.. plus, don't even start thinking about (sniffable?) network connections, keyboards, etc.
IMO for complete security you want the physical boxes to be secure too...
Moz.
see a Text Widget
Then, you are left with penetrating the host filesystem and changing the vmware software. But of course, this isn't the point. You secure the host system from outside attack and then basically the only way the hackers can get in is through the guest operating systems. And these cannot talk to other guest systems.
Oceania has always been at war with Eastasia.
A bunch of computers connnecting to the central computer to get their data/CPU power, vaguely similar. The critical thing is that they have good physical security of the lines that go to the server net, lest they get tapped into. Another idea might be to make dumb terminals with encrypted communications and connect those to the server. The day of huge centralized computers set up in such a manner was near ending I thought, but it may see a small revival in cases such as this. It may be possible to upgrade the ROM in a dumb terminal to handle an encrypted protocol, but it may be easier to design from the ground up I bet.
Don't call my crazy, that's what they called me back in the home!
Grab whatever's in there and you've got a copy of what the user sees. Reprocess it and you've got the content a screen at a time. Get a trojan house onto the less-secured sode of the machine and you've got a window onto the more-secured side.
Similar to how the US bugged Xerox machines (and yes they were Xerox-brand) in the Washington Soviet Embasssy - put a mirror inside and simply dupicate-duplicated everything.
Is there any technique (that just-folks know) to encrypt/otherwise secure what's in a videocard yet still have it perform properly?
I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.
He said Air _Farce_
A Farce is a charade, or pointless excercise in politics, or a drama played out in reality. For example, a high school student council.
I like it the way it was originally.
Vidi, Vici, Veni
Very important to the ZDnet article!!!!!!
--
Twivel
I'd love to help my kids' grade school setup dumb X terminals connected to a big box that runs a vmware intance of windoze for each student who's logged in for a class. The collection of aging *shit* machines their school has is pathetic. Problem is I guess it would take such a huge monster linux box to run 30-50 simultaneous copies of vmware/windoze it wouldn't be practical
I dunno, but if it is, someone'd better call RIAA and MPAA to let Ms. Rosen and Mr. Valenti know about it :)
Sounds like a reasonable idea, but wouldn't usermode linux for example be better? It would give much the same results but without the virtualisation overhead. Also, it would not be restricted to x86.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
As soon as a user has physical access to anything, they have the ability to do a lot more with it. If at any point the data travels through memory or wires unencrypted (highly possible) nothing prevents a recording device being attached at that point.... Furthermore, if special chips are added at points in order to encrypt the data as it goes over a wire (for instance, as data travels to the monitor, from the video card), nothing prevents that particular chip from being replaced... Even assuming that harddrive data is encrypted, drives can be removed and transplated into a computer with less scruples, which could be set to work at cracking the encryption. Short of OTPs, every cryptography method is theoretically brute-force crackable. (And if users get careless, which is entirely possible, crypto-breakers may have an even easier time of it.) There's no such thing as perfect security. Then again, there's No Such Agency to worry about... :)
/ k.d / earth trickle / Monkeys vs. Robots Films /
Large print giveth, and the small print taketh away
----
Or, Maybe the NSA is having a hard time keeping up with these new CPUs
Yeah, right. Nobody has more experience with using fast CPUs than NSA. Besides, we don't generate more internet traffic because our CPUs are faster. It's because of the cheaper bandwidth available.
Also note, this is for people who do work on both classified networks and non-classified networks. Do you know anybody who works on a classified network? It certainly isn't joe home user.
... gain root access ...
/proc/kcore > ~/my-copy-of-memory
cat
Passing information by system utilisation is not a new concept. For instance the various versions of STOP, from Wang Federal, implement a form of jitter on resource reporting and quanta so that the noise is greater than the signal. You can be reasonably certain that the NSA are familliar with these techniques and how to circumvent them.
Comment removed based on user account deletion
I used to work computer security for the Air Force. I think this sort of thing would never be allowed.
The amount of regulations that would have to be rewritten would be astounding. That (esp. versus the small cost {for the DOD loves to spend your tax money} of buying a seperate computer) would keep that from ever happening.
Plus you are talking about a new idea. The military thrives on the status quo. New ideas are implemented over many many years of missed deadlines (example {for mil guys} DMS).
You wouldn't believe the paranoia that sorrounds security around here. I can't stress enough, that would never ever happen.
--------
get jiggy w/ ayn rand!
That won't change anything. The same silly security breaches would still plague them. In my oppinion, the best way to insure these stupid security breaches don't occur is to use a nix, and only hire people who know or learn something about computers.
It's ridiculous to assume that an end user who can only use a simple (windows-like?) GUI will know anything about security.
That would be a good start.
Liberty.
... if they want it to be.
:-))
What you need is a filesystem which is accessable from either/any virtual machine. There are cryptographic techniques so that any subset M (or more) from N passwords will permit decoding the data (see Schneier Applied Cryptography for how). Our case is effectively M=1, N=2. However, you're then in a state of having an idiot putting things on the shared filesystem rather than where it should go. In which case you'd need to impose some handling restrictions to prevent misuse. Enforcing these restrictions would be not 100% possible I'd guess, but little to do with humans is.
The other idea would be that the shared are should only be accessible if you can prove that you have both keys. That limits the number of people who can access the shared area, and may impose a bottleneck.
I'm sure anything's possible, it's just a simple matter of coding! (tongue in cheek, there
Phil
-- Real Men Don't Use Porn. -- Morality In Media Billboards
Also FatPhil on SoylentNews, id 863
sheesh, it's like that douglas addams book Mostly Harmless where, in order to get around all the inconveniences of tight security, people carry around small credit cards with their mothers maiden name, fingerprints, retinal prints, dna pattern, etc etc holographically encoded.
i could live a little longer in this prison
And what's worse, since he was using cut-paste, he lossed the code once he closed the window, clearly not a very lucid move, and now we can not change the launch code without the old one. Isn't that a bummer?
Honeypot or a way of getting into everybodies machines ? The NSA ( or its military branches ) is not stupid. If they can convince somebody to run their version of some software, what makes you think it is crackproof from them ( NSA )?
Even assuming that you have one physical machine running n independent virtual machines which are absolutely and utterly independent of each other (note that I don't think this is actually possible, I'm saying just assume that it is), there remains the problem of getting information in and out of the box. As it stands, you've got seperate ethernet cables, routers, the whole nine yards for the outside internet and the classified intranets. With VMWare, would you be running that over one physical network? I suppose you could try to tunnel the secure box's connections over the unsecure ethernet, but that just seems to me like you're asking for trouble.
Basically, it boils down to, with two networks and an air gap, you know you're secure as much as is humanly possible. The moment you start running all your data over one pipe, you open yourself up to all sorts of trouble, with intercepted connections, eavesdropping, and all that. I can't ever see this sort of thing being approved by the people in charge of security, no matter how much the cost-cutters beg.
For people in the other branches of the US military it has always been known as the Air Farce. Its been called part of the Disney Company also because they have a Mickey Mouse ( Goofy )way of doing things.
VMware's software is just another implementation of IBM's original "VM/370" resource manager OS from the 1970's. Back in the 1970's, we ran intelligence systems under IBM's VM/370 Virtual Machine architecture for the same resaons. Worked great security-wise, as long as you didn't then connect your mainframe to the outside world... IBM recently demoed (Slashdotted too as I recall?) 45,000 seperate copies of Linux running in seperate virtual machines on one mainframe using their VM OS.
"I figure you're here 'cause you need some whacko who's willing to stick his finger in the fan. So who are we helping?
Correct me if I am wrong, but it seems that multiple virtual machines still share the same hardware (hence, memory space, harddrives) and same host OS. Seems to me that an exploit could still target the host which would allow access to the memory spaces on both virtual machines... then your back to square one...
DOS is dead, and no one cares...
DOS is dead, and no one cares...
If there's a Bourne Shell, I'll see you there
I agree. As long as there is connected hardware, somebody will figure out how to get at it. And even if the VM's are completely isolated and unbreakable (doubtful), aren't they talking down the same NIC? C'mon, NSA can't believe that nobody will ever crack that, can they? I thought these were the people of Faraday cages, white-noise on the windows, etc. Now they're going to throw their most secret data onto one big happy ethernet with Sue's email from her Mom? Sounds like a honeypot to me.
Doesn't that mean that each individual client has a key to the one single file that is the single point of failure? So, getting a backup of even just a client would be a start to reversing the encryption
I'm sure I'm over simplifying this, but its a job requirement in the real world...
---"What did I say that sounded like 'Tell me about your day?'"---
I know the NSA looks to be doing good work with Linux but I just can't trust an agency thats so damn big brotherish to the point we dont know anything realy about them.
I work for a national laboratory where we have two separate networks: one for unclassified, one for classified. We use an air gap to separate the two networks. The classified one has no connection to the outside world, and the only way to get information to the classified net is through tape and sneakernet, and the only people who have access to do this are subject to polygraphs. In fact, for those of us who have classified and unclassified computers in our office, the network cables must be separated by 6 inches (15cm), and this is actually audited by computer security folks. There are so many rules in place, we even have classified keyboards -- you cannot hook a keyboard up to an unclassified computer that has been contaminated by being connected to a classified one. The hardest part about this is that you cannot have classified and unclassified data on the same hard drive. The point is, there are so many rules in place designed to prevent this, no other government agencies but the NSA would ever consider this. We would rather pay twice for two separate sets of computers and networks.
From what I read, there are different physical networks for different security clearences. As a result, a computer in the classified class can't access info in lower clearance levels, so the worker need a different computer for each clearance level. How does that make sence? So here I am writing a top secret document that references a few sensitive documents and a top-secret document. To properly reference the document in this system, I would have to physically switch to a different computer.
:)
They're security just seems flawed, and this soultion isn't a fix. I'm sure they have reasons for doing so (probally classified reasons), but what about useing different NICs for the different networks (hey, a Quad ethernet adapter or two and you would be set.) of just get one and use IP Aliasing? Why use seperate networks at all? Different servers for each level of access, with strick control over who can access the info from where, and strong encryption, and you have a perhaps better soultion.
If anyone can figure out their securiy model and reasons behind it, please enlighten the rest of us.
I'm going to go back in my box and will think within the limits of my box: MS Sucks Linux Good I read too much Slashdot.
I think this one phrase from the "Makes sense" section pretty much sums up the problem.
I hope the NSA takes their time in evaluating VMWare's stuff. Right now, they have a working system. Is it really worth it to throw this system out in favor of an unproven technology.
I am not saying VMWare is unproven technology, but merely this new use for the product. Again, from the article, "the current VMware technology is not up to a level of assurance necessary for this."
Of course an obvious point is that there is no such thing as "Crackproof Computing." No matter how good this product becomes, there will always be a chance that there are remaining security holes. It may be a while before this risk is at an acceptable level for the NSA.
I think we started at one extreme (completely centralized mainframes) and swung to the other extreme (completely indepented pcs), and now we settling in a happy medium. People do not want to go back to having dumb terminals or thin clients, there are still to many things which can't be done well over the wire.
Witness the failure of Suns java station and Larry Ellison's net pc concept.
There is a place for both distributed and centralized setups, but for the majority of people having a compromise works well.
The advantage of this approach comes from the precision with which machine architectures are specified, and the very limited number of communication paths available between machines.
IBM also did some work with VM/370 where they completely virtualized the clocks on the system. While they did this project to allow benchmarking hardware that had not yet been built, the same facility can be used to greatly reduce the bandwidth of covert channels between virtual machines.
If the VMWare system has these features, it may well be a B level system, and be approved for the kind of multi-level security application described.
Ken
Heh, except of course you can't run *any* operating system. They've taken a few shortcuts that mean you can't boot unsupported OS's in many cases. (For example OS/2).
I work in a particular five-sided building in Arlington, VA. Part of my job involves tracking down classified information that has been leaked onto uncleared computers and networks and 'sanitizing' them (degaussers are my friend). If I could have one wish in this world, it would be to rip every 3.5" floppy drive out of every computer rated 'Secret' and above.
Computers are very good at blindly following instructions. Humans, however, tend to suffer from problems such as laziness, ignorance, contempt, or outright disregard for the rules (and in the worst cases, greed...). No one has ever heard of a computer that decided to disregard its programming. Every case I have worked began with human error.
By their very nature, computers can't break the rules, but humans definately do.
As for the hard drive issue, I see two solutions:
1. Have a single drive for the entire machine, and the classified Virtual Machines (VMs) would operate with an encrypted file and swap space. Modify the OS so that unencrypted info can exist only in volitile RAM (I believe OpenBSD already does this).
2. Run at least two hard drives, one for the host OS and unclassified VMs, the other encrypted for the classified VMs. This would be easier to conform with existing regulations on classified handling and storage.
What about cut and paste? Screen grabs?
I really don't think this would work. Even if VMWare runs a multiple emulation layer straight from the hardware, this would still require strong crypto to protect data saved to disk.
Then again, multiple virtual machines and strong crypto would not protect against the type of small keyboard sniffers that the FBI (and other intelligence agencies) supposedly already have -- the kind that connects directly on your keyboard and stores everything that is typed.
Finally, I am almost certain that someone could come up with a virus that would infect one VMWare layer (think Win9x here) and would do the same password-gathering. With the right drivers, one can even imagine a virus/trojan horse mounting other filesystems and discreetly searching for interesting files and data.
In short, I really don't think this has any chance to work. Memo to NSA: use OpenBSD or your own (reinforced) version of Linux with ultra-strong crypto -- you'll run less risks this way.
After all, what's the point of emulating (slowly) multiple operating systems, when it's probably much faster to port all the tools users need to one "set" of platforms (Unix?).
Just my $0.02. I am not sure this rant makes sense.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
Ok, so I wont say it :)
Seriously, though, there are some problems with this kind of technology:
1) you may have several "secure" virtual machines, but what if the OTHER non-secure VMs are comprimised, and are set to crack/infiltrate your secure VMs? You'd have crackers beating down your door, and they wouldn't even necessarily have to be pounding on some port...
2) unless you are doing SMP and have OTHER processors to split amongst these tasks, wouldn't several VMs on one machine slow the piss out of it, even with all the speed advances in processors, etc
3) unless the "task-switching" mechanism is built into the hardware, and the data for it are taken from some type of rom, you're risking the chance of one process getting under that very task-switching mechanism, like we used to do with tunneling interrupts, to get in UNDER the interrupt and get our routine called before/instead of the one that was intended. Afterward, the switching would be compromised, yeilding the possibility of nabbing "secure" data, or maybe giving a bogus VM false secure status, or how about even giving certain VMs a higher execution priority: you have a remote connection to a machine running your VM in addition to 7 others. You all are allotted an equal slice of time, but since you've "(task)switch-tunneled, you give your machine %75 percent of the allotted time, and leave the other poor bastards to fight over the remaining %25 percent. Apply that to a shared-resource business idea... Hmmm... wonder if that would help my frag count...
If they INSIST on being able to access their highly sensitive systems from an unsecured box, wouldn't they be better off using either A) an encrypted X-session or B) an encrypted Citrix / Terminal Server session?
Think about it...a virtual machine is still going to have access to RAM, ports, etc. Not to mention they're probably going to have each virtual machine running on private IP space over the same wire...that can be sniffed as well.
A central server that each person accesses through an encrypted link allows for secure network traffic, a central repository of the data in question, and allows for ACL's restricting which computers can even access it.
Sometimes the most elegeant solution isn't the most complex one.
Sure there are still risks associated, like hardware keystroke loggers, shoulder surfing, and shit like that, but that's a risk regardless, and I hope the DoD has measures in place to reduce physical security risks.
This message brought to you by the Council of People Who Are Sick of Seeing More People.
I find humor in the fact that many so-called "technology" companies these days are touting old technology as the wave of the future. Perhaps computing in general is coming full circle... it started with large, "virtual computer" type systems that are gloriously known as "mainframes"... then, computing progressed to the PC with each his own, and now, somehow, combining computing back into a centralized mainframe layout is somehow revolutionary?
I think I'll invent "floppy" disks, and tout them as the future because one could fold up his data and carry it in his pocket.
Skiers and Riders -- http://www.snowjournal.com
A lot of these guys run dual platforms.
(i.e. a Windows P.C. and a Solaris Sparcstation).
It would be very interesting if VMWare could emulate other platforms such as running IRIX or HPUX on intel based hardware.
Regardless, I'll definitely be keeping my eye on this company!
It's actually pretty easy to virtualize the peripherals, probably even easier than virtualizing the bios. It's running under linux, so all you have to do is set up each job as a different user, and place them in groups so that they can access only their specific hardware, thus Joe Datagrabber's boss can have /dev/ttyS0 set up to only allow access from the virtual windows box. Standard stuff here, and any job trying to access a part they're not supposed to will get an access denied message.
Marxism is the opiate of dumbasses
Once upon a time, the U.S. government write a set of specifications for multi-level secure computers, called the orange book. This worked pretty well for mainframes: Multics was rated B2, and was on the 'net as dockmaster.mil.
It was a bit clunky, but had been continuously updated over time, so I still have a machine running Trusted Solaris 7 in my basement.
It's arguably the same task to do this sort of thing with a virtual machine monitor as it is with a security monitor: both create trusted computing bases, which enforce the security rules.
It would look almost exactly like an unmodified system, with optional colored bars on the windows indicating the security level and subject matter that was displayed there.
The rules the TCB would enforce are things like "thou shalt not copy from higher security down to lower security", so the TCB gets asked if it should allow a top-secret cut buffer to be pasted into an merely restricted document.
The Trusted Computing Base (the VMM) gets to say no, and so refuses to allow mapping of that page. The X server gets a -1 return code and errno=NOWAYJOSE, so it then pops up a "sorry, that was a security breach" message... which is exactly what my TS system does when I klutz and try to copy stuff from my confidential files into my unclassified email!
davecb@spamcop.net
It doesn't. You'd need an x86 emulator too.
I submitted the same story a couple hours before your time and it was also rejected. I wonder why? Perhaps they had to get NSA approval to post the story.....
To just give everyone two computers? Computers aren't that expensive. Most people I know who do classified work on their computer have a jaz drive that they can boot off of. They pull the network cable, and the hard drive (which is usually on a removable mount) stick the jaz drive in and boot off of it. Seems to work reasonably well after all how often do you have to do classified and unclassified stuff at the same time? The only way you can be 100% sure this won't be cracked is to in fact get two computers.
Windows and linux can't talk to each other? Where have I been?
Well, "main process runs on server. To reduce load on server, GUI runs on client" would be
better. And it's the X terminal.
And here in Korea, with Windows platform, there are already that kind of products.
The idea is not new. And for PC server hardware, I don't think it gives good performance.
5th floor in this building, there is a network lab. And they use their Dell server that way.
Performance? Is not as good as stand-alone PC.
Even for doing paper work.
Server should be very very very powerful because the numbers of users could be high.
Basically, ANY time you share a resource, you can monitor how others use it. The CPU is such a resource.
You could've hired me.
Won't the guest's disk image still have to be accessible from the host's file system? If this is the case, wouldn't it be as simple as saying cp secure.img unsecure.location?
The only solution I could see would be encrypting the guest image, but this is still insecure.
now...they go along with this..the disk slices for each of the virtual machines are sitting on the platform, i'm assuming that at least. Is there not a chance of someone/thing copying those slices off, and loading them up in vmware on a seperate machine and then have access directly to the very "sensitive" material that they're trying to project? The thought really isnt much different than say, the cia director who kept classified info on a non classified computer, this just isnt copying the individual files, this is copying the whole disk slice.
Why don't they just take a step backward and get a mainframe?
Moving at the speed of government.
The point is that you have 3 systems running:
Host
/ \
inter- intra-
net VM net VM
If you compromise the internet VM (which we assume can happen -- this is why they are currently different machines, physically) this doesn't necessarily give you any means to access the meta level Host computer.
If that were possible, then yes, the attacker could compromise the supposedly secure intra-net VM (NB: copying its state would only give you a snapshot -- it would be much better just to relay all of its communication traffic to the internet).
So now we need to prove that it is impossible to get access to the meta level from the internet. This comes immediately from the virtualisation requirements -- each hosted OS has no way of realising it isn't running on the base hardware.
Even if we are not able to prove this, the fact that the internet connected machine is virtual gives us the abilty to snapshot its state at a fully booted uncompromised point in time; In order to make cracking it hard, we can just kill the entire machine every 5 minutes and reinstate the snapshotted version. Any attacker now has to crack not only the inter-net VM, but also the Host machine in 5 minutes.
However, this all assumes a trusted user. If the user has the ability to do screen captures from the intra-net VM, they could then conveniently send these via the inter-net VM.
yeah... I mean, the article seems to talk about desk space and clutter.. why not just use rackmount systems and a KVM switch?
The only thing I can think is that cabling would be nasty, but who cares?
But then...maybe that's the real plan here.
The Sig below has been sacked and I am currently accepting applications for a new one. - GeneralEmergency
"A microprocessor... is a terrible thing to waste." --
"A microprocessor... is a terrible thing to waste." --
GeneralEmergency
If cocaine and crack weren't two different things, then yes.
-----
"People who bite the hand that feeds them usually lick the boot that kicks them"
Higher Logics: where programming meets science.
Or some type of boot sector virus. Lock the host copy of Linux into it's own VM (plex86, anyone?)and then you've got all the cards. Granted, somthing like this is definitely not your average 600 line assembler program.
cat
I remember how the shit hit the fan when everyone thought the NSA had a backdoor built into Windows, but nobody finds anything alarming here. Do we really believe the NSA are acting like white hats and acting to make Linux and BSD more secure by contributing NSA code?
The only people I trust less with my computer than Microsoft is the U.S. Govenment.
Windows has been known to crash on VMware running on Linux, but I can assure you VMware does not exit - it just displays the BSOD in the same way a non-virtual PC would.
In some ways, Windows on VMware is actually more stable than Windows on real hardware, largely because VMware emulates hardware that has well proven drivers.
I've always wondered whether a machine running VMWare would make a good firewall. You could run are really stripped down virtual machine that controls access to the outside ethernet inteface and mediates access to the host OS.
The difference between Canada and the USA is that in Canada healthcare is a right and gun ownership is a privilege.
Or, Maybe the NSA is having a hard time keeping up with these new CPUs and they can't process all the information about us that they want to. So really this is just a big ploy for us to install VMWare and /really/ have things slow to a creep... And hell, what's better than one instance of VMWare running... two or three!!! hell yeah!!
-Andy
One friend of mine replaced 21 machines running web apps on NT with three of the same machines running multiple instances of NT under Linux.
The NT systems typically crashed every 5 hours. The first band-aid solution was to make one machine reboot all the others every 4 hours. Under VMWare, the NT apps still crashed, but they could be restarted from a memory image file in about 15 seconds instead of 5+ minutes.
If for some bizarre reason I ever needed an NT sysadmin, I'd hire the guy who was carrying a VMWare disk in his briefcase.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
...WHAT hardware is running VMWare. It is DOG slow. Now, if only Win4Lin could do DirectX :)
>:^D
1. Become root (choose your favourite exploit).
2. insmod fuck-vmware.o
3. Proceed to read and/or write all the address space your heart desires.
The entire idea is ridiculous. Nothing can be as secure as having separate networks, except not having secrets.
If the history of computer security has taught us anything, it has taught us that there is no software that is crackproof.
"Microsoft has made computing accessible to a population who would otherwise not be able to use computers" - B. Kernigha
I know, I've worked on a software hotline, and as long as those customers can get $3 crack on the street corner, they'll be messing with the software.
First, there were centralized mainframes and user terminals for people to run apps and data through.
Then there were PC's where everyone had their own "little mainframe."
Now I'm seeing a trend back towards centralized computers. It started with client/server, and now this from the boys and girls at the NSA.
Can you say "pendulum swings?"
They can do whatever the hell they want. Mostly because no one can stop them... but to you and me, "because its a matter of national security."
Protector of Capitalist views,
Protector of Capitalist views,
Meorah
First, being able to run files in separate memory spaces and as discrete units in no way confers the kind of security NSA must establish. I could see this running on very low security systems (unclassified and classified secret) with strong operational security. But no matter how strong VMWare's virtual machine technology is if data can be written to disk by the VMWare session it could be recovered by another VMWare session on the machine. Just the theoretical possibility of that occuring rules it out of being used for most classified data types.
Second, this 'Professor of Digital Forensics Investigation Fred Cohen' needs to go learn a little about NSA's requirements for C2 security classification. Microsoft MUST provide source code for review to achieve C2. Microsoft has achieved C2 for NT 3.5 and NT4. Therefore the NSA DOES know "what is going on inside NT".
Dan
Or someone with access to that hardware can accomplish copying through other means -- looped back serial ports, feeding video image to a machine with video capture card, making beeps and listening to them...
But if the "secure" box (virtual session) doesn't have access to executables or removable devices, how is the average user going to screw up the secure area?
I don't see how many executables (if it is possible, at least without a boot disk) to access the secure session from a non-secure one
The reason I bring this up is because VirtualPC includes an API that lets Windows "see" your Mac hard drives and vice-versa. The API exists both inside the VM and outside, but I think it's only capable of letting Windows mount Mac directories, not the other way around.
In either case, this API effectively can let multiple Windows VMs see each other, so VMWare would have to certify that such an API doesn't exist in their NSA-approved VM.
--
And the men who hold high places must be the ones who start
To mold a new reality... closer to the heart
The only way to make a computer secure, is to lock it in a vault with only an AC outlet. But I guess that didn't work in Mission Impossible, so I guess we are out of luck... :-)
I want my rights back. I was actually using them when our government stole them after 9/11.
My first job out of graduate school was at Trusted Information Systems (now swallowed by Network Associates) on the NSA-funded Trusted Mach project.
The idea was that you would run different OS sessions, each of which would provide a POSIX, or OS/2 (guess that dates the project), or whatever, "personality", at different sensitivity levels on top of the Mach microkernel. Data could be copied between sessions subject to security contraints. It was targeted (though never evaluated) to hit the B3 TCSEC critera. Interesting stuff, but it never really went anywhere.
This sounds very similar.
Tom Swiss | the infamous tms | http://www.infamous.net/
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
Remember DES? The NSA rolled out DES because it wanted everyone to use something it could crack.
Read the article and think. They have a linux distribution that they believe to be bullet proof. They are ging to use this to host other operating systems. A hardened linux box can cat as a security arbiter. That is all they are doing, they are building in a firewall in to every box they'll be using.
The effect of the second can be stunning. There admins will now be able to do anything they want to any Win XXX PCs on there network. Monitor it, patch it, replace the OS, lock out the user, sane and reliable network firewalling, anything they want.
They lose easily verifiable air gaps... which can be violated any time a security officer is not looking, and they gain the ability to truly manage there PC enviorment. Emagine IPSec wrappers for every one of your network transactions, even if the underlying (overriding) Win xxx does not support it. That is a huge win even on just sensitive networks.
In theory, yes this would be a single point of failure thing, but if you have a host system with a high level of security, such as the NSA's internally modified Linux system, this is a non-issue. You can also encrypt those host files, making it much harder to get at the info in there. The main goal of this seems to be to cut down on points of entry, because as the article says, some people have 5-6 systems on their desk in order to access items which have different classifications. With that many systems, monitoring network traffic for improper activities and troubleshooting seem to be a lot more dificult.
Marxism is the opiate of dumbasses
Do you mean Air Force or Air France?
If the later, I'm scared.
Perhaps my memory is foggy, but hasn't everything the NSA touched in the past two decades been exploitable due to them? PGP? OS? Take yer pick. Their job is to fuckup and subvert encryption. Why the hell are we trusting them with linux? I'd bet my 3-assed Monkey that they won't release the source of the tech.
It seems to me that this approach would still be very succeptible to various forms of covert timing channels. Since the different systems are running on the same hardware, you could still signal between them by having one system hog system resources or not as a way of signaling bits to the other system. There was some discussion of this approach to covert channels in this discussion here on slashdot.
There's no point in questioning authority if you aren't going to listen to the answers.
Is this like a single point of failure thing?
I saw at the VMware booth at linux world expo yesterday a demonstration of a product called VMware GSX, which is not out yet, but is going to be their "enterprise level" product. Rather than running a virtual OS on top of a real OS, it runs multiple VM's straight on the hardware level.
If the NSA thing is using this it would cut out a whole layer of security that they have to deal with.
"Last year, the company also released a version of its software that runs on Windows NT and 2000, enabling users to run Linux (or any other operating system) in a virtual machine on top of Windows. "
I can imagine a blue screen of death that would still have a VMWare window with Linux that is still running in it...
You can't handle the truth.
Gee, sounds like they want X-terminals with an encrypted data link...
Crack proof means one can't hide a stash of cocaine inside the computer right?
So let's say you want to steal some classified data... You break into the 'restricted' system one way or another and simply install a keystroke recorder, a screen grabber (VNC works nicely) or any of a million other programs that will not care which window you are tying the data into!
The only way to get this to work is to reverse the process... Get VMware running the 'restricted' stuff on the 'secured' computers, that way the secured computer has to be compromised to get the secured data rather than the inverse (easier, less secure) way to do it.
I've seen a lot of that done, and they actually keep the desk clutter down pretty well. They use those cables that have mouse, video, and keyboard attached to each other, running from the KVM under the monitor to the two towers on the floor. Works great, until the KVM switch freaks out, then you have a few Lt Cols pissed off. Just happened to me last night :(
In Permutation City, the main charecter has two virtual machines running, one on top of another, for security purposes in order to quarantine executable code in email. She also has a Email screening program with a neural net roughly comparable to a goldfishes brain, that tries to fool the email into thinking it is being seen by a human. The first prediction has come true, I wonder when the second will?
Numbers 31:17,18 Now kill all the boys. And kill every woman who has slept with a man,but save for yourselves every virg
AOL users are so fucked. AOL has become a distributed virus network, kinda like gnutella.
Anyhow, theoretically, instead of using a buffer overflow to gain root access, I could use it to modify memory on other virtual machines on the same network? So, if I were an authorized user on one machine, I could spawn a shell for myself, with or without root privlidge, on one of the other VM's. Bind that to a port, say 10000, and I have access to another vm, without having to login.
Dangerous. Dangerous.
Spring is here. Don't believe me, look outside!
The Clinton Administration already took care of it.
I watch Brit Hume on Fox News
I spent way too much time in the late 80s making things fit on System V/MLS, the AT&T System V Unix version that was certified as a B1 Orange Book System. The Red Book, which covers secure networking, was still pretty edgy research at the time, because authentication for machines you don
't directly control is a hard problem - doing it right requires crypto, and the NSA didn't want to let it out of the box at the time or let the military use civilian crypto, though there were a few IPSEC-predecessor networks that were certifiable.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
to that loaded question.
1)Could it be secure enough for their purposes? Possibly. Only THEY can decide this.
2) Is it as secure as separate workstations? Of course not. By definition it CAN'T be.
Note that systems like this will have some annoying limitations. For example, hardware graphics acceleration will not be used.
The way I understand it, it seems that VMware's plan is to not focus at all on software end of the security problem but put most of it's focus on the hardware end. You can read more at CNET.com's site
there they seem to say that the strength of VMware is that it emulates the underlying hardware. I suppose that given that you could have multiple operating systems which just reside on one computer and use the same computer but have nothing to do with one another. The way it sounds to me is that it's (possibly) an easier version of a dual or tri- boot. But if one were to try to do that within an operating system there seems like there would have to be a tremendous number of obstacles to overcome. Maybe it would just be better if they used a bootloader like the one that comes with Partition Magic or LILO. Encrypt each partition (or separate hard drive) or something so that they were each separate and you couldn't just boot into any partition. And run the system that way were each different partition is separate and encrypted.
I have gotten VMWare to crash. If it crashes there is some behaviour that the programmers were not aware of. These behaviours may well be secrity problems (buffer overuns frequently cause crashes, only choosing the right data to overun with will show a security problem).
I wouldn't be very thrilled with the idea of VMWare being part of a secure system (even if it is more the CMW part then the "secure from the outside" part) until it pretty much is impossable to crash.
I've found that life seems to parallel life, and a lot of times when I don't know the answer to something in the realm of computers, I look to other things in life as an equivalent. So in other words, the question becomes: can making a copy of something that we have created be made impossible?
I think that, when the question is asked that way, the answer is clearly no.
-Daniel.
--
Have fun: Join D.N.A. (National Dyslexics Association)
It's probably possible, at the very least in theory, to separate two virtual machines more or less completely. You can simulate the BIOS, the hardware clock, the PRAM, the ethernet card PRAM, and all those other sneaky places that most people don't think about as writable areas of their PC.
Peripherals are a different matter. They had better be sure that only the insecure side is capable of sync'ing to the Palm Pilot!
-- Brian
Otherwise one virtual OS may free a physical page and the other one might allocate it and get remnants of data...assuming of course the OSes share physical memory to some degree. -elan
It would seem that giving up physically secured machines in favor of a virtual security mechanism would exacerbate problems of classified data leaking out from alternate channels. I'd like to know how that is being addressed.
[ This space for rent ] - Your full service media whore