Archive for September, 2008

Little Brother by Cory Doctorow

September 30th, 2008

Everyone should go out now and download or buy a copy of Cory Doctorow’s Little Brother and give it to a teenager. I don’t know a lot of teenagers (the court mandates that :P ) but I am going to seed a few copies about.

It’s not the world’s greatest novel – not even close – but it is an important novel. It’s also a little heavy on the rhetoric and I don’t know a lot of teenagers who talk like the main character (more’s the pity).

Much like the Max Headroom’s tagline of “20 minutes into the future”, Little Brother is set in a RSN San Francisco. A San Francisco that has a little of the smell of Big Brother. The same smell a lot of Americans, British and Australians can sense as our civil liberties are slowly eroded in the name of “national security”.

The main character, Marcus, is a 17 year old high school student interested in computers, gadgets, role-playing and girls. Shortly after the opening of the book a major terrorist incident occurs: the bombing of the BART and the Bay Bridge. In the aftermath of the incident Marcus and three of his friends are detained and interrogated as suspected terrorists. After a week of detention all but one of them is freed but warned that the government is watching them and told to tell no one they were detained.

Marcus decides to take action and possibly revenge for his missing friend and that’s where the story starts getting interesting.

The main aspect of the book that appealed to me is the first rate introduction to the whys and hows of privacy and security. An introduction that even paranoids like me can appreciate. Doctorow explains PKI, RFID hacking and a bunch of other security mechanisms, counter-measures. Most importantly, Little Brother teaches the reader how to THINK about privacy and security.

This is the key thing missing from a lot of actual “grown-up” security books – thought leadership. A lot of these security books provide mechanisms and systems to measure risk and apply controls. Less often do they teach people how to think about threats, how to distil threats into risks and how to apply controls to mitigate those risks. Very rarely, if ever, do they teach you how to think like the attacker.

Little Brother is like a distilled HOWTO on being a sneaky bastard. It teaches you that paranoia, properly applied, is not only healthy but logical given the threats to our privacy and security.

Little Brother also demonstrates that sometimes attacking the control is almost as effective as attacking a target. Rendering the control inoperative not only lowers the protection of the target but can result in the target’s defenders being tied up trying to protect the control instead of the target.

Overall, an excellent book that offers some really useful insights for both adults and teenagers. Go give it to a teenager and hopefully they’ll trust someone over 25 long enough to read it.

You can download the book for free at:

http://craphound.com/littlebrother/download/

Or you can buy it via your book store or Amazon.

Papers selection/commitee – Linux.conf.au 09 – Hobart, Tasmania

September 14th, 2008

Warning: array_keys() [function.array-keys]: The first argument should be an array in /home/kartar/www/www/wp-content/plugins/simple-tags/inc/client.php on line 1310

Warning: shuffle() expects parameter 1 to be array, null given in /home/kartar/www/www/wp-content/plugins/simple-tags/inc/client.php on line 1311

Warning: Invalid argument supplied for foreach() in /home/kartar/www/www/wp-content/plugins/simple-tags/inc/client.php on line 1312

So went down to Hobart in Tasmania to do the papers face-to-face and final section for Linux.conf.au 2009.

I have to say that the submitted papers rock. We’ve got some excellent rock-star speakers who are going to blow peoples socks off. I won’t steal any of the LCA 09 team’s thunder by naming names but it’s pretty cool.

I’ve also been let into the keynote speaker secret and got to say those are pretty cool too.

We also got around to doing the schedule and I think that too is well put together and people are going to find it hard to select which sessions they are going to get to during some streams as there are so many great topics.

So stay tuned for further news on this… The LCA 09 team will be releasing stuff soon.

Google Chrome

September 13th, 2008

Warning: array_keys() [function.array-keys]: The first argument should be an array in /home/kartar/www/www/wp-content/plugins/simple-tags/inc/client.php on line 1310

Warning: shuffle() expects parameter 1 to be array, null given in /home/kartar/www/www/wp-content/plugins/simple-tags/inc/client.php on line 1311

Warning: Invalid argument supplied for foreach() in /home/kartar/www/www/wp-content/plugins/simple-tags/inc/client.php on line 1312

I downloaded Google’s new Chrome browser (http://www.google.com/chrome) this morning. I installed it and I played with it for about an hour. I read the release notes and watched several of Google’s videos. Overall, it looks cool, seemed to be snappy and quick to respond. I was particularly taken with the focus on tabs. I also thought the multi-process, multi-tab sandbox idea is a really interesting idea – initially from a useability perspective but potentially also from a security perspective. Though there isn’t anywhere near enough information yet to make a proper assessment. I did try to break some tabs and see how effective the sand-boxing was (it seems to hold up from a very brief look but it’ll take some code review from someone with more code-fu than me to determine actually how secure the concept is – see below).

A few things didn’t inspire me – the border decoration was a little … unintegrated. And I am always loath to pass judgement on an application that by its very nature needs to be examined in a cross-platform context and I would want to see running on all of Microsoft Windows, OSX, and Linux. This is particularly true of OSX where the graphical environment can make an enormous difference to how an application engages you.

But after my play I closed Chrome down with a big sigh to get on with my actual day job. Why the sigh? Did I think the new Chrome browser wasn’t very good? Nope. But my first thought was “I wonder how many people in my enterprise have downloaded and installed Chrome over the last few days”. This was quickly followed by me asking two questions:

1. What is the change in the enterprise’s risk profile of adding this new application?

2. What’s the operational impact of some, many or all of my users downloading and installing this application?

Obviously (and hopefully) it is only an incremental change in risk profile and not much at that. The browser will probably only be downloaded by power users and innovators in the enterprise, initially at least. On the threat landscape in most enterprises however browsers punch well above their weight in terms of attack surface, are a common source of malware infection and browser exploits are a popular target for hackers. Indeed a (the first?) Chrome vulnerability has already been discovered AND exploited (see http://www.readwriteweb.com/archives/security_flaw_in_google_chrome.php) literally hours after Chrome was released. So Chrome’s potential as a source of compromise and attacks needs to be carefully considered.

The answer to the second question is also ambiguous but finding out can add a lot of work for a security team. With any new application, but especially ones like browsers that are such rich sources of malware attack, there is now a potential need to:

• Track bugs and vulnerabilities for the application;
• Add it to software profiles for vulnerability scanning;
• Investigate its behaviour for network behaviour and IDS/IPS;
• Profile it for our Security Event and Incident Management process; and
• Specifically for this application ascertain if its Incognito “stealth” browsing capability impacts our ability to investigate and gather evidence in incidents.

So most important to me right now is not whether Chrome will outshine Firefox or IE or whether it represents the future of the browser. But rather how much work is this new browser going to create for me… :)

P.S. If you’re interested in look at it you can find Chrome’s source code at http://code.google.com/chromium/. There are also build instructions (for which you will probably need to have some developer skills) for OSX and Linux.