It is also acceptable to mount volumes RO, make an image and work from that. As long as you can answer the question, "was it possible for data to have been written to the drive during your analysis", you can answer "no it was not possible". Still we use a drive imaging kit that can't physically write to any devices examined =)
Is this the same Slashdot that had such an outpouring of understanding and sympathy for the bullied after Littleton school shootings? Bullying is still bullying. I am not a huge fan of government schools, but the environment in which young adults and teachers operate in does not exist in a bubble outside of society. They must follow rules and learn to be decent human beings in this environment. Castigating, abusing and virtually bullying a teacher is simply not something you would ever get away with outside of high school. If I made videos of my boss or made fun of my clients I would not have a job. Society as a whole should reject this bullying at all levels. Its just wrong and should be stamped out. I refuse to accept it as an understood and accepted fact of life for any human being. Its just not right.
Thats actually a pretty good question. I like that about as much as I like reversing a linked list in place with only one extra pointer.
Thats a good question because you still have to iterate over the list. A very simple solution is not pretty but its definitely easy to see its correct. Its also an interesting test because you have to be careful of boundary conditions.
15 month olds teach you plenty. Having a teenager, I think, brings your perspective full circle, but as a young parent I can see that much of your childhood comes into a different perspective quite quickly as you raise a child (of any age).
I have often heard conservatives say, "you can't just stand in the middle of the road, you will get ran over". So make the middle of the road bigger!;)
Thinking that you can just categorize people into two neat buckets is just silly. It distorts the point this article was trying to make and also takes the points the article was making and distills it to an elementary level to support a particular view point. Thats no good.
They have two free products. VMware Player can play any VM out there. VMWare Server is their hosted product. VMWare server is completely free, no strings attached and it works great.
It is actually worse. Undo data is at least hidden and not a more expected feature of Office. Graph data is not even something that "Remove Hidden Data" would get rid of.
I use Bellsouth (now ATT). I had some serious issues sending faxes as well. One of the key ways to resolving this problem was to set the error correction levels on my Fax to the highest and to set the fax machine rate to the slowest possible speed. Doing this I was able to send and receive faxes with no trouble. The same worked for Comcast as well. This was also with Vonage. I used it with Comcast and VoIP some time ago, though. Perhaps things have changed in the last year or so.
You are marginalizing the argument here. Most hardware does not provide an interface that disables a device permanently. It is not really all that questionable in that in a proper design the hardware is going to validate incoming requests to interact with it to an extent. Just like software, the hardware should verify that it is not being asked to do something that is beyond the reasonable range of things the hardware can do. And since a failure to provide these relatively simple and basic checks can easily result in the quick destruction of a device it makes sense to implement these basic data validation checks at a hardware level. If the user is just bent on something like using a flash drive for some disk heavy activity so be it. However, if the software is asking the device to do something that has no legitimate use for the hardware or is patently invalid for that device (display frequency out of range for a monitor, for example) then it should catch that.
Really, I completely doubt they would cover anything up. I still regard OpenBSD as having some of the best integrity in the security in the business. I happily recommend my clients use OpenSSL for almost all of their crypto related needs. My point is their classification system sucks if they try and pass a severe reliability/DoS issue off as a stability/reliability issue. They are trying to preserve their little marketing slogan of one/zero remote buffer overflows. In security you ALWAYS err on the side of caution. You have to assume that your adversaries will have more time or resources than you. Just because YOU can't figure out why a remote kernel panic is a buffer overflow waiting to happen doesn't mean your attacker won't spend the time to figure it out. I remember when many security professionals dismissed the whole double free issue as a purely theoretical attack. Until the Zlib POC many people were quite smug that double frees weren't security issues. From this perspective a remote kernel panic is an absolutely critical issue. I daresay an absolutely critical security issue.
I still regard the OpenBSD project very highly and I still think they are operating with the integrity required of a project that places security above all else. I just think that they should be open and honestly about the seriousness of a malicious attacker being able to panic your systems. You are playing with terms like exploitability here, but I am not sure you understand what it means to some environments. In some environments there is absolutely no difference from a reliability issue and a remotely exploitable buffer overflow resulting in malicious code execution. Why? Because in some situations up time is absolutely critical. It isn't common, but it is more common than you might imagine. The point being for a security project this is a BIG deal. For your average Fortune 500 that produces software you can play some fun games with what this really means, but at the end of the day it reflects poorly upon the security of your software. It reflects poorly upon your organizations ATTITUDE towards security if you won't acknowledge the issue as one relevant to security. Simply put, err on the side of caution. No reason to jump the gun.. but take these kind of reports a little more seriously on the back-end. Thats all.
Sorry to say it but if a malicious attacker can influence your system remotely and cause it to go down it is a SECURITY issue. You can argue the general case all you want. Sure in a great majority of cases a downed system is not a security problem. What about for that one system where up time is critical? Where even a minute of down time can cause major problems. Come on. If an attacker can remotely influence system stability it is clearly an undesired behavior. In the risk assessment business that is a big risk. An attacker could keep a system down for quite while if you didn't know what was going on and that could give them many opportunities, including social engineering attackers. Security is more than just technology. Its about people and process AND technology. Until people like you realize that these kind of things will be swept under the rug. If this happened to MS it would be a huge security problem.
In many places down time = lost dollars. You are arguing a general case and forgetting about the specific cases where these kind of problems actually matter. Its still a vulnerability. What if an attacker only needed the power out. We rate these things as security issues for all of the problems we can't imagine, not the general scenarios we can think up. Its all about mitigating risk. If a remote attacker can panic my kernels that is a BIG deal. End of story.
VMware most definitely does. Its not as hard as you might think, but it definitely requires some trickery under the hood. I was stating it as a fact. If you think about it, since you are essentially providing the entire motherboard to the guest operating system (virtual machine) as an idealized device you wrote in software. You have a minimal amount of overhead managing all of the memory for virtual machines in one place. And since under the hood the memory is from the same physical devices its not to hard to find all of the pages that are the same in a guest and do some behind the scenes magic to make pages that are the same in two separate guests go to the same physical page of memory.
I would say that every single one of those points in the article are being addressed in the enterprise VM arena. In the end due to the raw extra control you get over virtual machines it very much is the future. There is very little memory overhead. Once virtual infrastructure becomes fully developed and the scene plays out completely I think it will actually make the things in the article easier, not harder. You have to pace yourself in how and where you use virtualization in your organization, but the benefits are huge for the right environments.
As far as current day performance goes: disk access is essentially close to if not at native speeds and CPU speed is generally 70-80% of what the native processor can do. Most instructions aren't touched by a virtual machine monitor at all. Memory is more or less untouched and you actually get memory savings. Say you have 4 VMs of Windows 2003 running. All of the pages of memory that are the same (say, core kernel pages and the like) get mapped to the same physical page. The guest operating systems never know. You can effectively scoop up a lot of extra memory if you have a lot of systems running the same software. All of those common libraries and Windows/Linux processes are only paid for once in memory. The technology is simply awesome. In a few years with more and more powerful multicore systems virtualization will make more and more sense, even on performance critical systems.
Slashdot Mirror
It is also acceptable to mount volumes RO, make an image and work from that. As long as you can answer the question, "was it possible for data to have been written to the drive during your analysis", you can answer "no it was not possible". Still we use a drive imaging kit that can't physically write to any devices examined =)
Is this the same Slashdot that had such an outpouring of understanding and sympathy for the bullied after Littleton school shootings? Bullying is still bullying. I am not a huge fan of government schools, but the environment in which young adults and teachers operate in does not exist in a bubble outside of society. They must follow rules and learn to be decent human beings in this environment. Castigating, abusing and virtually bullying a teacher is simply not something you would ever get away with outside of high school. If I made videos of my boss or made fun of my clients I would not have a job. Society as a whole should reject this bullying at all levels. Its just wrong and should be stamped out. I refuse to accept it as an understood and accepted fact of life for any human being. Its just not right.
You never, ever, have to say "correct me if I am wrong" on Slashdot. Someone will gleefully correct you if you are wrong.
Now you never know.. with one low UID user just having bought it at auction :)
I think you forgot exploding steam pipes. Though your last risk while driving deserves some moderation points :)
Even if you do speak it.. it takes a lot more effort to say the same thing some source code does.
That crashing sound you hear? That was my humor detection unit.. ;-)
Thats actually a pretty good question. I like that about as much as I like reversing a linked list in place with only one extra pointer.
Thats a good question because you still have to iterate over the list. A very simple solution is not pretty but its definitely easy to see its correct. Its also an interesting test because you have to be careful of boundary conditions.
Jeremy
Heeh.. yeah, well most people say it properly. However.. it is a deeply seated fear here in the south that you will get ran over ;)
15 month olds teach you plenty. Having a teenager, I think, brings your perspective full circle, but as a young parent I can see that much of your childhood comes into a different perspective quite quickly as you raise a child (of any age).
I have often heard conservatives say, "you can't just stand in the middle of the road, you will get ran over". So make the middle of the road bigger! ;)
I wasn't aware I had a party affiliation...
Thinking that you can just categorize people into two neat buckets is just silly. It distorts the point this article was trying to make and also takes the points the article was making and distills it to an elementary level to support a particular view point. Thats no good.
Sweeping generalizations are fun. Can I play too?
They have two free products. VMware Player can play any VM out there. VMWare Server is their hosted product. VMWare server is completely free, no strings attached and it works great.
It is actually worse. Undo data is at least hidden and not a more expected feature of Office. Graph data is not even something that "Remove Hidden Data" would get rid of.
I Just bought a $309 dollar dell (got a discount) and its very quiet. My laptop with its fan going makes more noise.
I use Bellsouth (now ATT). I had some serious issues sending faxes as well. One of the key ways to resolving this problem was to set the error correction levels on my Fax to the highest and to set the fax machine rate to the slowest possible speed. Doing this I was able to send and receive faxes with no trouble. The same worked for Comcast as well. This was also with Vonage. I used it with Comcast and VoIP some time ago, though. Perhaps things have changed in the last year or so.
You are marginalizing the argument here. Most hardware does not provide an interface that disables a device permanently. It is not really all that questionable in that in a proper design the hardware is going to validate incoming requests to interact with it to an extent. Just like software, the hardware should verify that it is not being asked to do something that is beyond the reasonable range of things the hardware can do. And since a failure to provide these relatively simple and basic checks can easily result in the quick destruction of a device it makes sense to implement these basic data validation checks at a hardware level. If the user is just bent on something like using a flash drive for some disk heavy activity so be it. However, if the software is asking the device to do something that has no legitimate use for the hardware or is patently invalid for that device (display frequency out of range for a monitor, for example) then it should catch that.
Really, I completely doubt they would cover anything up. I still regard OpenBSD as having some of the best integrity in the security in the business. I happily recommend my clients use OpenSSL for almost all of their crypto related needs. My point is their classification system sucks if they try and pass a severe reliability/DoS issue off as a stability/reliability issue. They are trying to preserve their little marketing slogan of one/zero remote buffer overflows. In security you ALWAYS err on the side of caution. You have to assume that your adversaries will have more time or resources than you. Just because YOU can't figure out why a remote kernel panic is a buffer overflow waiting to happen doesn't mean your attacker won't spend the time to figure it out. I remember when many security professionals dismissed the whole double free issue as a purely theoretical attack. Until the Zlib POC many people were quite smug that double frees weren't security issues. From this perspective a remote kernel panic is an absolutely critical issue. I daresay an absolutely critical security issue.
I still regard the OpenBSD project very highly and I still think they are operating with the integrity required of a project that places security above all else. I just think that they should be open and honestly about the seriousness of a malicious attacker being able to panic your systems. You are playing with terms like exploitability here, but I am not sure you understand what it means to some environments. In some environments there is absolutely no difference from a reliability issue and a remotely exploitable buffer overflow resulting in malicious code execution. Why? Because in some situations up time is absolutely critical. It isn't common, but it is more common than you might imagine. The point being for a security project this is a BIG deal. For your average Fortune 500 that produces software you can play some fun games with what this really means, but at the end of the day it reflects poorly upon the security of your software. It reflects poorly upon your organizations ATTITUDE towards security if you won't acknowledge the issue as one relevant to security. Simply put, err on the side of caution. No reason to jump the gun.. but take these kind of reports a little more seriously on the back-end. Thats all.
Jeremy
Sorry to say it but if a malicious attacker can influence your system remotely and cause it to go down it is a SECURITY issue. You can argue the general case all you want. Sure in a great majority of cases a downed system is not a security problem. What about for that one system where up time is critical? Where even a minute of down time can cause major problems. Come on. If an attacker can remotely influence system stability it is clearly an undesired behavior. In the risk assessment business that is a big risk. An attacker could keep a system down for quite while if you didn't know what was going on and that could give them many opportunities, including social engineering attackers. Security is more than just technology. Its about people and process AND technology. Until people like you realize that these kind of things will be swept under the rug. If this happened to MS it would be a huge security problem.
Jeremy
In many places down time = lost dollars. You are arguing a general case and forgetting about the specific cases where these kind of problems actually matter. Its still a vulnerability. What if an attacker only needed the power out. We rate these things as security issues for all of the problems we can't imagine, not the general scenarios we can think up. Its all about mitigating risk. If a remote attacker can panic my kernels that is a BIG deal. End of story.
The whole remote kernel panics aren't "vulnerabilities" thing goes counter to how the entire software industry classifies security bugs.
VMware most definitely does. Its not as hard as you might think, but it definitely requires some trickery under the hood. I was stating it as a fact. If you think about it, since you are essentially providing the entire motherboard to the guest operating system (virtual machine) as an idealized device you wrote in software. You have a minimal amount of overhead managing all of the memory for virtual machines in one place. And since under the hood the memory is from the same physical devices its not to hard to find all of the pages that are the same in a guest and do some behind the scenes magic to make pages that are the same in two separate guests go to the same physical page of memory.
I would say that every single one of those points in the article are being addressed in the enterprise VM arena. In the end due to the raw extra control you get over virtual machines it very much is the future. There is very little memory overhead. Once virtual infrastructure becomes fully developed and the scene plays out completely I think it will actually make the things in the article easier, not harder. You have to pace yourself in how and where you use virtualization in your organization, but the benefits are huge for the right environments.
As far as current day performance goes: disk access is essentially close to if not at native speeds and CPU speed is generally 70-80% of what the native processor can do. Most instructions aren't touched by a virtual machine monitor at all. Memory is more or less untouched and you actually get memory savings. Say you have 4 VMs of Windows 2003 running. All of the pages of memory that are the same (say, core kernel pages and the like) get mapped to the same physical page. The guest operating systems never know. You can effectively scoop up a lot of extra memory if you have a lot of systems running the same software. All of those common libraries and Windows/Linux processes are only paid for once in memory. The technology is simply awesome. In a few years with more and more powerful multicore systems virtualization will make more and more sense, even on performance critical systems.
It has its problems, but I am a believer.