GMail can be key to your digital life

Matt Honan (Wired) has this heart wrenching story of his digital life being erased. The door to this tragedy was his gmail account.
http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/

You have heard this story from many channels (twitter, facebook, email forwards etc). So I won't repeat it.

But I do recommend enabling two factor authentication on your gmail account.  It is additional inconvenience that is necessary to safeguard your gmail account and potentially your intertwined digital life.

If you have a smartphone such as iphone or android, do not forget to review the section on Google Authenticator.


Perform the following steps:
1) Log into your gmail account.
2) Go to settings via
https://support.google.com/accounts/bin/answer.py?hl=en&answer=180744&topic=1056283&rd=1
3) Now start the two step process by giving a phone number (such as mobile).
4) Get the code via sms or voice.  Activate your account.
5) Two step authentication is enabled for your gmail account.  You may want to set "trust the computer" you are using.

Now for each additional device such as iphone or android or ipad you use to get email addresses, you can generate application specific passwords.
https://accounts.google.com/IssuedAuthSubTokens#accesscodes

This is one time setup for each device.  Hopefully, you should change this quarterly.

Google Authenticator (Smartphone Users)

Instead of using a call from Google each time you login from an unknown location or device, you can use the "Google Authenticator" mobile app available in the iphone app store and Android Market.

1) Download "Google Authenticator" from your app store.
2) Log into gmail account.
3) https://accounts.google.com/b/0/SmsAuthConfig
4) Start the Authenticator App.
5) Press the + button.  Then press the "Scan the barcode" button.
6) Scan the barcode on the computer using your phone.
7) Once the barcode is scanned, you will get a code displayed on the app.
8) Enter the code into the computer screen in the text box.
9) Click Verify.

Open Source and Security Response

We live in a very interesting world. I term it interesting and not dangerous because I see a lot more good in this world than the bad. So unlike the media who love to portray the bad primarily, I would like to talk about  the good in the world.  A good in the world for the last few years has been Open Source.

Open Source has given many benefits to this world including:

• Free alternatives to paid Operating Systems.
• Free open alternatives to the Apple iPhone/iOS ecosystem.
• Apache Software Foundation, JBoss community, Linux Foundation and other communities that have shipped and are shipping great free open source projects including Apache Httpd Web Server, JBoss Application Server, Linux Distributions etc.
• Free alternatives to Microsoft Office Ecosystem.

Now let us look at Web Browsers. They have been our gateways to the Internet content. Of course, you need a ISP or a Wifi connection to get to the internet. But the browsers have been the main avenue to access the rich content that is on the internet. Browsers such as Mozilla Firefox, Google Chrome and Opera have been very beneficial to the world. All 3 of them take security of their users very seriously.

I was reading about Google Chrome getting hacked in less than 5 minutes (http://it.slashdot.org/story/12/03/07/2352220/chrome-hacked-in-5-minutes-at-pwn2own).  Ok, it was not magic.  Definitely those guys had knowledge of some zero-day vulnerabilities, that they had not disclosed before, but used it to get to 60K. (Please read up on zero day at http://en.wikipedia.org/wiki/Zero-day_attack).

Now let us talk about the value of Security Response to open source projects. Almost all major OSS foundations (Apache, JBoss, Linux etc) are backed by a proactive security response team who stay on top of vulnerabilities in their projects.

As the number of open source projects is on the rise, it is critical that you adopt a open source project that has an excellent security response team as well as provides newer versions of the project with the fixes. Also the ball is in your park to stay on top of newer releases.  If you are unable to manage the patches or get on newer versions of projects, then I suggest strongly that you adopt commercial versions of open source software such as the JBoss Platforms (EAP, SOA-P, EPP etc),  Hadoop (Cloudera/MapR/HortonWorks) etc because these are backed by a security response team, who will provide the necessary patches. Trust me, all software at all times will have at least one vulnerability. Software does not get created by magic but by humans who are prone to mistakes.

For this reason, I feel that the security response is a critical aspect for Open Source Choice and Adoption. Please visit Red Hat's Security Response for additional information:  http://www.redhat.com/security 
as well as understanding the role of open source and security.

We are currently at http://anil-identity.blogspot.com/2012/03/open-source-and-security-response.html

When SSL Certificate is the culprit

you may have heard of practitioners preaching SSL to mitigate man-in-the-middle attacks. For more information on MITM, read here.

SSL Certificates are issued by a Certificate Authority (CA). There are a large number of CAs around the world and most of the prominent browsers trust a set of CAs by default.

The latest news about a hacker getting SSL certificates issued under the Google name from a Dutch CA, is very alarming.

If the browser trusts a particular CA and that CA has issued a fradulent certificate, then it is very difficult for the browser to figure out the fraud unless they follow OCSP or remove that CA.

Update from Mozilla Firefox:
http://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/

Mitigation in Mozilla Firefox:

http://support.mozilla.com/en-US/kb/deleting-diginotar-ca-cert

Mozilla will be releasing an update to Firefox to further protect you
from this. Until the update is released you can manually delete this
certificate with these steps:

At the top of the Firefox window, click on the Edit menu and select Preferences.

Click on the Advanced panel
Select the Encryption tab
Click View Certificates
In the Certificate Manager window, select the Authorities tab
Scroll down to DigiNotar and select the DigiNotar Root CA
Click Delete or Distrust...
Click OK to confirm the deletion


Apparently DigiNotar Certificate shows up in Internet Explorer too.
Here is Microsoft Advisory.

Google Chrome is covered by its security features.

A Google spokesman provided CNET with this statement: "A Chrome security feature warned the user of the invalid certificate and blocked them from visiting the attacker's site. We're pleased that the security measures in Chrome protected the user and brought this attack to the public's attention. While we investigate, we plan to block any sites whose certificates were signed by DigiNotar."

(Thanks to CNET)

If your favorite bank has a website with the URL starting with https, try to demand Extended Validation Certificates. CAs go through extended audits before issuing EV Certs and the address bar displays a green bar in the browser.


References:
Diginotar and Hackers

Response: Glassfish versus JBoss Community Patches

Please refer to my earlier blog post:  Community JBoss AS versus JBoss EAP  (April 2010) for further information.

Ok, I had to respond to a blog post titled "Glassfish vs JBoss Community Patches" because there was liberal usage of the following words : security, pci and patches.

Chris Mahns is responding to Rich Sharples blog post but brought in the terms "security" and "pci". This has prompted me to respond.

Let me tell you a story.  A friend of mine runs a non-profit public forum using Joomla/PHP etc. One day, he gave me a call to tell me that his site has been serving malware and if I knew of any easy means of preventing that in the future.  I told him that I would look into it.  He came back to me in less than a week to tell me that attackers had utilized the fact that he had not updated the latest patches for Joomla. My friend had missed one patch and his users were all served malware. (It can happen to credible web sites such as the New York Times. Read Here).

Thinking further, I realized that it is getting extremely critical for general users to stay on top of the patch process because someone has to triage security vulnerabilities, coordinate across components, collate patches, write patch reports, maintain relationship with organizations such as Mitre/NIST (CVE and NVD) etc which the general public cannot really do.

I strongly stress (whenever asked) by users that they should adopt OSS that is delievered by JBoss or Apache or any organization with a strong strong "Security Response Team".  For JBoss (Red Hat), we utilize the Red Hat Security Response Team which does an amazing job of triaging, generating patches and erratas for customers. They have relationship with software foundations such as ASF and also with the reporting agencies (Mitre/NIST etc).

Now as an user, if you are interested in "Security" and "PCI" compliance, then YOU SHOULD NOT be using the community version of the JBoss Application Server but using a Enterprise Platform from Red Hat such as EAP or the SOA-P because the components are not only stable but tightly monitored by the security response team.  The team releases frequent patches based on the criticality.

I will tell you from experience that it is not easy to stay on top of security vulnerabilities and patches if there are multiple open source projects involved.  A typical middleware server such as JBoss Application Server contains a large number of OSS projects (developed on JBoss community and other places such as the Apache Software Foundation).

Coming back to community version of JBoss, when we identify vulnerabilities, we typically fix and release as part of the next iteration of the community AS.  I even have a wiki article on JBoss community about this.  Look at Security Vulnerabilities Notification to Community.

We CANNOT spend resources on patching JBoss AS 4.0.1 or releasing a patch for AS 3.2.3, whenever a vulnerability is identified in a component such as Tomcat. Please for heavens sake, you chose cutting edge innovation and wanted the latest and greatest.  If yes, then you should be moving forward with the latest community version of JBoss AS. Adopt JBoss AS6 CR release as they happen. Once AS6 comes out, get on it right away.

As users, you make conscious choices whether you want flexibility, cost savings, reliability and security. If you want to be on the latest and greatest,  cutting edge stuff then adopt the JBoss Application Server (Community Version).  If you are going to run banking software or financial software or defense establishment using JBoss middleware,  then PLEASE adopt EAP or other Red Hat middleware products. You save yourself and us a lot of trouble.

Please refer to my blog post where in I notify the community of vulnerabilities existing in JBoss community projects. It is not like we totally ignore the community (that has made us powerful).

Also refer to my 2008 blog post where I assert that we take security seriously at JBoss.

I spend a portion of my time talking to security evaluators who are currently evaluating JBoss EAP 5.1 for common criteria at EAL4+.  We certified JBoss EAP 4.3 at EAL2+.  The CCE is a very intense exercise that can be daunting at times because the evaluators look at the entire laundry and pinpoint which of them is dirty and needs to be washed.

To summarize, if you are worried about security, PCI compliance, FIPS, Common Criteria and any other security certification/jargon etc, then please adopt a middleware platform from JBoss. You should not be fiddling with a community middleware stack.

My development environment is on Fedora Linux.  When I need the latest patches, bug fixes, I update to the next version of Fedora rather than just cry over not having patches over an older version of Fedora.  This is a choice I made.  If I needed stability, I would probably develop on RHEL.

And I would like to wish my US colleagues/friends at Oracle /Glassfish, a very Happy Thanksgiving. "May the break and family time raise your morale". Lets say Amen to that.


=============