It’s been three months now, and the triage has moved beyond the panic phase. The powers that be have thrown resources to look at the state of OpenSSL and they have released a report and a roadmap of how to fix it. Google has decided it can’t be fixed.
In a rational world, OpenSSL should have been the most tightly controlled and monitored “Open Source” product there is, given that it is protecting the privacy of communications and essential to make sure you are connecting to the real secure web server.
The value to a hacker was not so much the possibility of finding a private encryption key as it is that OpenSSL is used on most non-Microsoft web servers and it invisibly leaked random chunks of memory.
This vulnerability was only found because two people – one at Google and another former Microsoft Internet Police Officer went looking for a problem.
The report is that OpenSSL has
– no code review process
– no coding standards
– no process to approve new features
– inaccurate or non-existent documentation
– secret undocumented APIs
– bug reports that nobody is investigating
Every few days, I have Fedora check for software updates. Yesterday, the web server updated 35 products with new versions. How do I know that the update to Python doesn’t have a new vulnerability put in by accident or on purpose? “Just trust me”
One of the first things that was done was a code audit – using software tools to automatically search for coding errors – it found other significant errors and vulnerabilities.
Another major freeware (but not open source) encryption product called TrueCrypt decided to kill itself when faced with the prospect of a second more rigorous code audit – and admitted to having unfixed security vulnerabilities. Snowden used TrueCrypt – so far, no law enforcement agency has succeeded in breaking into a TrueCrypt volume unless they are given the password
Locks on doors are designed to keep honest people out. If people want to break the law to get in, you can’t design a door strong enough to stop them. While you’re busy installing 4 inch thick armor on the door, they’re cutting a hole in your roof and coming in through the attic.
When war between governments officially moves onto the Internet, we’ll find out just how many Trojan horses full of enemy soldiers we invited behind our defenses because we believed in free stuff.
All good points. What is, or is NOT secure?
Who knows?
Trust nobody.
Good advice.
Thinking a little more about the vulnerabilities of Open SSL, which are so blatant and obvious, it should have been vigorously tested before it was deployed. So, that begs the question: Do we live in a rational world if OpenSSL should have been the most tightly controlled and monitored “Open Source” product there is, but it wasn’t? Just ‘mere coincidence’ I suppose, but then there is that Trojan Horsey thing, right?
ARS Technica has made it onto my reading list in Flipboard. It’s a bit too geeky for me, but …
Maybe a week ago, I saw an ad or story about new remote control LED light bulbs you control with your phone or tablet. The concept actually sounds useful for person like me. I want hallways lit up when I’m walking through them, but there isn’t always light switches on both ends. The ability to turn lights on or off or dim them while lying in my bed could be a useful thing. There are alternatives that do that, but this seem like a simpler solution. The LEDs will last basically the rest of my life.
Well today’s story is that these remote-control LED lightbulbs will very quickly give up the encryption key to your Wi-Fi to a hacker. The reality is that isn’t all that important in most situations, because a criminal is not going on loiter outside your window – but it could very well allow them access to the computers in the house. Your light bulbs may really be spying on you. Add in an inexpensive camera and the possibilities are limitless.
Those sneaky, geeky, Technocrats are just another arm of the Octopus Beast who wants to control the entire planet, and perhaps the solar system. The following link of the sinister, looking mission patch of the Office of National Intelligence is at Forbes’ on-line mag, and the headline for the story is “U.S. Spy Rocket Has Octopus-Themed ‘Nothing Is Beyond Our Reach’ Logo. Seriously.”
http://b-i.forbesimg.com/kashmirhill/files/2013/12/Satellite-logo-for-spying.jpg
, unless it is beaten down by a superior entity.
“who wants to control the entire planet, and perhaps the solar system.”
They are starting by wanting to control the whole planet’s temperature.
According to what I was hearing today, in the next few days the Midwest will see low temperatures in the 40s – in the middle of July
My next door neighbor is irritated that my lights are on so much. When I flew back to Chicago to move and deliberately left a light on so people could see the empty interior, he took his emergency access key and went in and turned the light off and lectured me about it when I got back.
Today, after I wrote the above, he sat around in the parking lot waiting for me to return from shopping. His face was all bruised and bloody. He had tripped in the dark and fell and slammed his head into an end table. I think he wants me to feel guilty.
So, does your next door neighbor feel the need to help you, or spy on you?
His wife died about six months ago. He has nothing to do all day long. As I’ve gotten to know him better, he’s creeping me out. The other day, he was in an unpleasant conversation with the woman who lives above me. He’s the guy (every condo association has one) who wants to live in his own house and never accepts the rules are different. You can’t hang out flags on the outside, you can’t just dump your dog outside and let it run around unsupervised in the Common area, and the landscaping is done by people we hired.
The other day, he pointed out that I should thank him for taking care of “my bushes” (the ones outside my window). On more than one occasion, he has washed my car. The other day, he suggested that I needed to buy a new car. My 2001 car has 45,000 miles on it, spent all except the year in Chicago inside a warm garage. It’s old, but it is registered, insured, and no exterior issues with appearance. It’s just old – and since we don’t use salt on the roads, it is not unusual to see cars from the 1970s still being driven around. The lever he keeps trying to use is “protecting the property value”. This complex is the least expensive one in South Charlotte and had been full of renters at one point, probably making it ineligible for conventional mortgages. Every conversation with him, he feels a need to point out I have problems (I’m fat? Really? Wow, knock me over with a feather). Every conversation, he seems to want to let me know he opposes gay marriage. About a month ago, he went back to Mississippi for a few days (without telling me in advance – in theory I was supposed to notice if he wasn’t around). When I called his phone to check why his car was here, but I hadn’t seem him in a few days, he told me he was in Mississippi. I realized that I felt much better knowing that.