Category Archives: Tech

Technology in general

Apple & Security; the Java debacle

Posted on by

While I have become more of a fan of Apple’s products in recent years, I have never been a fan of their security disclosure policy.  Apple has traditionally been very secretive, sometimes out of necessity.  Back when Steve Jobs retook the company, Apple was near death.  The company had run into a brick wall with it’s legacy operating system.  The latest version, OS8 had been so long in development that it was now technologically far behind it’s competitors.  When Jobs shook things up with OS X (10) he had a reason to be secretive.  Apple had been successful with their new products, but was still fragile.  If any of their competitors could peek inside what was going on, they might be able to stop Apple’s progress before the company could become healthy again.

Today, Jobs legacy is an Apple with a $98B war chest made largely on the success of the iPod, iPhone and iPad.  These are all benefactors of the technology Jobs brought over from NEXT that helped to form what we now know as OS X.  The problem is with all that success, Apple’s share of the desktop PC market has grown.  Apple is now big enough that’s it’s clearly visible on the radar of a lot of people including potential attackers.

To Apple’s credit, OS X was designed with security in mind from day one.  Most of the vulnerabilities that have effected the OS over the years have required a social engineering element to get users to unwittingly install malware.  For a long time, Apple’s policy, (of withholding details about security flaws until a patch is available) worked for them.  However, a recent vulnerability in Java managed to scratch a large unsightly gash in that previously pristine, brushed aluminum finish.

The component that most recently exposed this weakness in Apple’s approach is ironically a third party product, Oracle’s Java platform.  It’s a little more complicated in Apple’s case because the company repackages and builds their own custom version of Java. Because of this, it always takes longer to get Java on Macs because the software has to be separately modified, tested and blessed by Apple.  The people behind the Flashback trojan saw this opportunity and modified their malware to take advantage of the Java vulnerability.  In the 2 months it took for Apple to produce their version and publicly acknowledge the flaw over 600,000 Apple computers were infected.  The fact that most Apple customers think they’re immune to viruses didn’t help the problem either.

This should be a wake-up call to Tim Cook and the OS X security team.  Apple may not agree with full disclosure, but they can’t continue to put their collective heads in the sand and think nothing will happen.  Had even limited disclosure been made to Apple customers earlier, it would have been possible to mitigate much of the threat posed by this vulnerability.  Instead, Apple customers were exposed to this vulnerability for 2 months.

TenFourFox taps disused resources of your aging PowerPC

Posted on by

Many of us geeks, especially those of us in the IT world replace our hardware almost as often as fashionistas change wardrobes. For some reason, I have a thing for old hardware. While I certainly don’t use it on a daily basis, I have a hard time parting with my favorite gear. I see it as something akin to automotive enthusiasts that like to keep that prized vintage car in their garage. They won’t drive it to work every day, but that doesn’t mean they don’t love taking it for a spin on the weekends.

I have a similar relationship with some of my favorite machines. I still use a 15″ PowerBook G4 at home on a fairly regular basis. (in fact I’m typing this post on it right now) At it’s heart is a 1.67Ghz PowerPC G4 processor. (the last model and fastest PPC Apple ever delivered in a laptop) By today’s standards, this single-core machine barely stays ahead of most netbooks. It’s battery is dead, and it gets fairly hot when you push it, but I find it to be perfectly adequate for most things.

Apple’s support of the PPC architecture ended 2 OS revisions ago (Leopard or 10.5) and even the Mozilla foundation dropped support from their Firefox browser after the 3.6.x series. (and even that will stop receiving updates soon…) Needless to say I was pleasantly surprised to find a project known as TenFourFox not only recompiling the latest Firefox from source, but actually making PPC specific improvements as well! TenFourFox is basically Firefox, but separately optimized for PowerPC G3, two flavors of G4 and the G5 CPU. That would be enough in itself, but the developers didn’t stop there. They’ve swapped out the old just-in-time JavaScript compiler with their recently completed nanojit for PPC which beats even Apple’s native Safari browser. (which until recently was the only browser with anything close to decent performance) This is all possible because there are still people in the Open Source community interested in this platform who know how to leverage resources like AltiVec. Kudos to the TenFourFox team for keeping this aging platform relevant!

Computer security and the human factor

Posted on by

One of the most important things to remember about security is that it is a process, not a product.  All too often, people think of security as a specific problem with a specific solution.  Unfortunately for us, security (in almost any context) is a moving target.  What was a strong password yesterday is weak today.  There are good reasons to require users to change their passwords, but it’s only part of the solution.  Forcing user’s to change their password too often invariably results in weaker passwords that are easier to remember.

To understand why this is a problem we first need to define what a strong password is and what makes one weak.  Numeric passwords are the worst as there are only 10^N possibilities where N is the number of characters.  Using letters is a little better as that’s 26^N for english.  Using both upper and lower case gives you 52^N, while a full alphanumeric set gives you 62^N.  Use of a full alphanumeric characterset on passwords 8-characters and higher was considered strong enough until recently.  After all, 218 trillion possibilities seems pretty large doesn’t it?  Considering some of today’s high-end graphics cards can perform over 2 trillion floating point operations per-second, breaking even a completely random 8-character alphanumeric password is trivial.  Adding the full set of special characters   on most english keyboards yields an additional 30 characters for 92^N or 5 quadrillion possibilities for an 8-character password.

You’re probably noticing a problem; we’re out of usable characters.  From this point on, the only way to increase password security is to make them longer and longer.  Obviously we can only keep up with this for so long before technology overtakes our ability to remember a secure password.  Clearly simple password-based security is insufficient for protecting anything of real value.  What’s needed is a multifactor system that uses 2 or more separate components to authenticate a user’s credentials.

A multifactor authentication system could be as simple as the combination of a password and a physical token such as a smartcard.  To authenticate, the user must insert the smartcard and type his or her password.  Either factor by itself will be rejected.  The beauty of this system is that any data protected in this way is inaccessible without each piece of the authentication puzzle.

A system is only as secure as its weakest link.  In many cases we humans are unfortunately that link.  We have limited memory and are vulnerable to social engineering attacks that get us to reveal sensitive information to complete strangers.  A strong password is useless if a user gives that password away or writes it down.  Adding a unique physical component to the equation raises the level of difficulty for an attacker significantly.