Cloudweavers » symposium

Security @ DEFCON 17

pascal.charest — Mon, 17 Aug 2009 17:16:44 +0000

Survived! Well my laptop did – I’m exhausted and work was waiting for me in Montreal, but – let be honest, I can’t really complain.

For those who don’t know, the DEFCON is one of the leading hacker conference with over 8k attendees getting together in Las Vegas to share knowledge on hacking, cracking, social engineering, lock picking and similar discipline. Peoples come from all social group – 14y old video gamer to senior security specialist for the gov, going through consultant, programmer, developer and hobbyist. Fun crowd.

While my trip was flanked by 2 series of 4 vacation days (before and after), I was @DEFCON as the owner of Les Laboratoires Phoenix – my free software consulting firm – and as such, I was confronted to this dichotomy:

* I need Internet access to answer clients requests
* Connecting to Internet at DEFCON is professional suicide if your not up to it

Let me explain this second point a bit: first, the Wall of Sheep, an inline filter tracking unencrypted connections and broadcasting users credentials (including a partially obscured password) on a big screen in the lounge. Generally, the flow is quasi non-stop.

If you think that it’s not that bad, the password being garbled… think again : Wall of Death. It’s an inline switch, freely available, where the 7 ports broadcast a mirror of everything the firewall see (which is.. everything). Live, un-garbled, un-modified feed of everything in the pipe. In other words, if you are on the Wall of Sheep, then someone from the Wall of Death got your credential.

And then, this is only using the standard infrastructure. I am not mentioning peer attack, wireless impersonation and so on.

So, how to survive in such hostile environment ? Here’s a few rules (which should also be taken as golden rules if you work from your client’s office).

1) ‘netstat -lntp‘ ; this command (an output of incoming listing ports on your system) should return nothing. There is no need to have any listening services if you are ‘mobile’.

2) iptables -L -n -v ; this command give you your firewall rules. INPUT should be restricted to established and related connection with a default policy of DROP. OUTPUT, when in a ‘not-so-friendly’ environment, should defaulted to DROP with allowed outgoing on secure protocol only (http:443, ssh:22, …). If you need to connect to an un-encrypted destination, at least forward through a ssh-tunnel/proxy.

3) never auto-connect to unencrypted network. This is exactly what causes the wall of sheep to be full of iPhone user’s credentials. This cute little device can auto-connect to the unprotected network (such as DEFCON) and start sending security credential (un-encrypted) to twitter, facebook, myspace…

4) Do not take anything for granted. PREPARATION is the key. Before the trip, start collecting all your ssh-key fingerprint on your system, this can become really handy if someone tries some ‘not-so-great’ men-in-the-middle attack against you.

Well, thinking about it, number 4 is the best advice. DO NOT TAKE ANYTHING FOR GRANTED. In the last 2 years, there have been 2 attack against the SSL infrastructure disclosed at DEFCON. Btw, this is for GNU/Linux system. If you are using a Microsoft operating system at the DEFCON, you better… well… just don’t use it.

CloudComputing @ LibrePlanet – Mako Hill talk

pascal.charest — Sat, 21 Mar 2009 16:16:20 +0000

Mako Hill on cloud computing @ LibrePlanet

Keyword: Affero GPL, autonomo.us, cloud computing, software services.

Interesting talk covering a very very wide array of topic, from “free software usage in provider infrastructure” to “usage freedom of networked services” going through “ownership problems of user data on networks”.

It brings out quite a few important points about network services closed infrastructure (even if it use free software and are open about it). This is very important because it underline differences between Laconica and Twitter, between Amazon and more open infrastructure…

I’ll need quite some time to digest this talk and think about the implication about cloud computing. While I’ve been working in this domain for couples years, pushing free software mentality to services (not only the software) is quite interesting and important for the future of cloud computing.

LibrePlanet

pascal.charest — Sat, 21 Mar 2009 15:31:43 +0000

@ LibrePlanet ;

Je suis présentement @ Cambridge, à quelques minutes de Boston, pour la rencontre annuelle (LibrePlanet) de la Free Software Foundation (dont je suis un donateur et membre). Je suis ici avec ma copine (Catherine) et avec Yannick Gingras. Shame on Francois for not coming!

Sans faire une session de live blogging vraiment poussée, je devrais faire quelques posts en rafalle dans les prochaines heures…

Pour l’instant, on écoute une présentation de Jeremy Allison – du project Samba (et de Google) au sujet de Microsoft Windows et de leur ouverture/fermeture dans le domain du free software et des brevets. C’est très général, mais un bon talk pour lancer une conférence en résumant les issues (et opposant) du mouvement.

@ Linux Symposium – SynergyFS

pascal.charest — Fri, 25 Jul 2008 16:12:14 +0000

SynergyFS,
by Keun Soo Yim from Samsung @ Ottawa Linux Symposium

Ok, that was a flop :
– We get it – solid state drive (SSD) are faster, have a smaller energy footprint than hard disk drive (HDD). With a general engineering background most of the group knew already that there is no moving part… No need to show us a 10 minutes video of windows vista booting, of people sitting in a plane, of trying to break a laptop… This time would have been better spent giving out actual technical detail about the file-system.

– Question: “Can we see what SynergyFS look like, how it fare in benchmark”, answer: “not without signing NDA”.
– Question: “Is the source available for SynergyFS”, answer: “no, GPL really is a bad idea for a business, you could distribute our code afterward”.

… yeah, well… that was a waste of my time.

GNU/Linux symposium proceedings

pascal.charest — Thu, 24 Jul 2008 20:32:56 +0000

I’ve been informed that I forgot to post the link for the conference proceedings…

Here we go : Linux Symposium 2008 @ Ottawa, proceedings.

@ Linux Symposium – Green computing in clusters

pascal.charest — Thu, 24 Jul 2008 18:44:35 +0000

Applying green computing to clusters,
by Steven Alan DuChene from SGI @ Ottawa Linux Symposium

The presentation is a high level review of metrics that are wanted and/or required to have controlled clusters computing and the road-map to the creation of an “environmental aware” job scheduler / resources manager.

It feel funny to hear the same talk that has been around for home automation about a data center installation. Especially since it does seem like a cheat to apply it to high performance since semi-random load are still a big part of the charge of a data center… and in HPC setup, the race to idle is normally the easiest and lower power consumption path.

Also weird that there is no mention of the advantage of cloud computing & fast provisioning that virtualization can bring to a green data center.

@ Linux Symposium – Kernel documentation

pascal.charest — Thu, 24 Jul 2008 14:50:20 +0000

Where Linux Kernel Documentation Hides,
By Rob Landley @ Ottawa Linux Symposium

Nice presentation about the difficulties about dynamic documentations and the interaction with {Users, Developers, Google, Indexer}. The main problems being that documentation efforts doesn’t scale and that kernel developer are not really editors. Some past decisions make it possible to push patch that will break the “make html” process and thus documentation is one of the less stable part of the “current kernel”.

Very interesting talk. Kind of pitch the incessant fight between {developper, users} blogs, wiki, static web pages, dynamic web pages, kernel mailing list, git commit messages, man pages, info pages… and the effort to normalize everything.

@ Linux Symposium – Cloud Computing

pascal.charest — Wed, 23 Jul 2008 16:14:24 +0000

Cloud Computing: Coming out of the Fog
By Gerrit Huizenga, from IBM @ Ottawa Linux Symposium

Its very strange to hear a talk about cloud computing from an IBM employee since they have not yet shown any serious stats about their Blue Cloud system. Still, it’s a good review of the cloud computing field.

Despite the fact that the presentation is built upon the statement that cloud computing isn’t about servers provisioning, it clearly revolve around the two following points of views:

From outside of the cloud :

You want your applications (complex systems) to be deployed fast, with next to no configurations to be done. 3Tera system is shown as a “good” way of doing that – personally, having built something similar for a client, Amazon EC2 is also a good contender for the title. From my POV, this is really about provisioning and the capacity of building virtual appliance.

From inside of the cloud :

You want to have a fully (automatic, dynamically) managed data center. Technology is already there. This is ALL about server provisioning.

The presentation moved from this “reviewing definition” to “why it is presently not everywhere” and “how to build a general interface for cloud system”. Guess this speaker is reading the cloud computing mailing list at Google Group since those are hot subjects right now.

As a closure (this wasn’t mentioned in the presentation) : here is a quick stock index of related corporation.

@ Ottawa Linux Symposium – 2008 edition – 10:00

pascal.charest — Wed, 23 Jul 2008 15:00:08 +0000

I’ll be live blogging from the Linux Symposium @ Ottawa for the next 3 days. I will also be tweeting most of the interesting stuff through the twitter user “pacharest”.

Couple of feedback for the pseudo start of the symposium. It hasn’t started yet, but will soon.

1) Searching for the pre-registration desk yesterday, I had a nice chat with the one girl of the conference – in fact we spent part of the afternoon searching for that very desk… me to register, her to work…

I’m not expecting to see anymore of this gender for the next few days. The guys, though, are sweating “geekness” – you should see all the cool t-shirt !

2) No coffee in front of the main room. @ 500$ for the conference, I’d be expecting hot coffee, not cold water.

3) WIFI seem weird – got the access point, got the good password (can associate), but I do not get an IP. So much for Cisco sponsored gears … But what do I know, they might be blocking Mac OSX & Microsoft Windows…

4) This conference is so going to be fun … Now going on with “The Kernel: 10 Years in Review” from Matthew Wilcox.