Author: Raju Alluri

libressl

04 Nov
Raju Alluri 0 Comment Other Opensource, Security, Technical

Libressl (http://www.libressl.org/) is a recent fork of OpenSSL. The goal of libressl is to provide a more secure alternative to openssl and the developers who forked the code feel that openssl is beyond repair at this point. Quoting from libressl website,

LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of modernizing the codebase, improving security, and applying best practice development processes.

The best documentation of libressl features (or default configurations) can be found in the release notes from 5.6 version of OpenBSD. Looking at the list, this is an impressive push towards securing the implementation by default. Without worrying too much about the backward compatibility, some of the lesser secure configurations and protocols are simply left out from the implementation.

By dropping support for a bunch of hardware engines and platforms, libressl probably has less things to worry about. For example, dropping support for big-endian i386 and amd64 systems liberates it a bit. With classic adopters of big-endian architectures evenutally becoming bi-endian, there is not much to lose here, in my opinion. However, reusing the standard C library routines like malloc() and snprintf() could take an interesting turn. Dropping kerberos support is interesting too – don’t we still have a lot of academic community working on it?

I like changes like dropping SSLv2 support and stopping the use of current time as random seed among a few others.

There are several discussions in the past on which of these opensource SSL implementations are better. Being a legacy implementation, OpenSSL at this time requires a considerable set of configurations to make it secure. From that view point, libressl might look better in terms of its out of the box readiness for a more secure implementation. However, in the world of automated deployments and continuous integrations, recipes exist to configure openssl to avoid less secure protocols and algorithms.

I am not sure at this point whether libressl will surpass openssl in future in terms of adoption, but sure I am glad to see a drive towards being “more secure by default.”

 

Swachh Bharat Campaign: My Thoughts

31 Oct
Raju Alluri 0 Comment Brain Dump, Interesting, Misc

Now that (apparently) the initial euphoria around the Swachh Bharat initiative has died down and people are settling back to their normal course of action, here are my thoughts on this great initiative.

The Swachh Bharat initiative is my long term wish for India come true. The moment I set my foot on western hemisphere almost a couple of decades ago, I realized how different surroundings can be made to look like. After relocating back to India a while ago, lack of cleanliness has been one of my big pain points that I have been trying fix across the board.

The Swachh Bharat initiative by our Prime Minister Shri Narendra Modi is right on spot and we all should thrive to see a clean and green India. However, just like many of the good initiatives, this one might make people get carried away in executing it the wrong way.

For an initiative to get popularity, we either need to document widespread participation or measurable results. Some popular initiatives get their popularity due to participation and others get popularity due to socializing of sustained results. Often, people take the first route and document the participation. Three hundred people posting their pictures on a social networking site for an event gets an event more popularity than documenting the fact that three thousand people actually participated in it.

People seem to be more inclined to post their participation in Swachh Bharat by clicking a few pictures while cleaning up a road or premises. I haven’t seen anyone posting a picture of a road or premises that stayed clean over a period of time.

In other words, instead of fixing the symptoms, we should fix the root cause and make sure that the symptoms don’t show up time and again. That is the best sustainable path to success.

For Swachh Bharat to become a lifestyle (not just an initiative), we need to focus on the following:

  • Reducing the opportunities to make any road or premises unclean. For example, Indian Railways came a long way in keeping many platforms and stations in clean state when compared to 15 years ago. The train tracks, compartments and some stations are not clean enough yet, but we have seen a good improvement recently. All they did is to force every vendor to keep a trash bin next to the stall and increased the number of general purpose trash bins. This led people to eventually get to the habit of using the trash bins than platforms to dump the waste. We need to take similar approach to ensure that people participate more in keeping things clean than making things clean.
  • Ensuring that people understand the importance of keeping things clean. We need to slowly, but surely, eradicate the “not my job” attitude when it comes to keeping public and common places clean. Some part of it comes from forced legislation (I like the positive impact of “No smoking in public places” rule) and rest of it should come from people’s belief and passion. This is where politicians and celebrities can help by taking the message to masses. I like a celebrity’s picture of cleaning a road, but that should somehow translate to a message that keep things clean first.
  • Clean up – This is how the initiative is currently being perceived in mass media. Even though it is a good start, it should slowly get to the back stage and give room to the other two focus points mentioned above. Clean ups should be regular, can even be voluntary by people who are no way in that role, but shouldn’t be just momentary.

In summary, I want to see Swachh Bharat to become a lifestyle than an being an initiative by our Prime Minister. We all should focus on keeping places clean than cleaning up places as an aftereffect. That way, we can head to seeing a sustainable Swachh Bharat.

Shellshock bug and the risks

26 Sep
Raju Alluri 0 Comment Cloud, Security, Technical, Unix/Linux

Bash, the quarter century old shell utility on almost all popular unix based systems, is found to be vulnerable. The exploit works by injecting specially crafted values into an environment variable and using it to invoke a shell command. Once the exploit gets to that level, there is hardly any limit on what can be executed as part of the shell command.

The problem gets worse for the fact that many of the day to day usages of the network facing services have potential to use bash internally. For example, CGI scripts on web servers, convenience utilities offered by network routers and any other limited command execution tools might be the key vulnerability public and guest access private networks. Mitre warns that sshd with ForceCommand is a potential attack vector.

The bug is being termed as Shellshock bug or bash bug. RedHat’s security blog article is one of the earliest articles that discussed the Shellshock bug in detail. Robert Graham of Errata Security is the best known tracker of the issue and has ongoing observations and comments on his blog/twitter account.

Here is how you can check if the current bash is vulnerable on your system. If it prints vulnerable on the first line, then patch your bash package.

$ env x='() { :;}; echo vulnerable' bash -c "echo test completed"
 vulnerable
 test completed

For web servers, here is the test suggested:

$ curl -i -X HEAD "http://sometestdomainhere.com/" -A '() { :;}; echo "Warning: Server Vulnerable"'

The output looks somewhat like the following listing. If it contains “Warning” text, then it is highly likely that the web server’s bash is (and cgi’s based on bash are) vulnerable. This test doesn’t assure that the system is not vulnerable. You may still have other CGIs run with bash that are vulnerable.

HTTP/1.1 200 OK
Date: Fri, 26 Sep 2014 02:51:52 GMT
Server: Apache
X-Powered-By: PHP/5.4.32
X-Pingback: http://sometestdomainhere.com/xmlrpc.php
Link: <http://sometestdomainhere.com/?p=14>; rel=shortlink
Content-Type: text/html; charset=UTF-8

Since the Shellshock bug existed for quite a while, all versions of bash that are currently out there in active usage are likely to be vulnerable. Patching some of these devices might be trivial, but there still might be several other devices that are hard to patch.

  • Servers that run services like web/ftp might be vulnerable if the CGI scripts end up using bash. Invoking bash from PHP code is considered not vulnerable, unless there are ways to circumvent input parameter validations of the PHP code. The RedHat article mentioned above has links to instructions on how to fix this on RedHat variants of linux. For Ubuntu, this is a good thread to follow.
  • Desktops that use network facing services like DHCP over wireless and sshd are vulnerable as long as these services internally use bash commands or bash as the shell for the session. There are still discussions on whether Mac OS X DHCP is vulnerable or not, because Apple modified its DHCP and claims that the DHCP utilities don’t use bash internally. Mac OS X branched version 3 of bash and does its own updates to the shell. There are instructions on how to patch OS X, tailored more for unix admins (and requires xcode) than normal users.
  • There are some suggestions on renaming bash to a different name, but that might break more things than fixing them. Use this technique with utmost caution.
  •  Beyond Desktops and Servers, devices like internet routers may have vulnerabilities due to utilities and services they offer. For these devices, waiting for vendor released patches is the best option, but explore the possibility of turning off these convenience utilities.

Errata Security also has notes on wormable nature of the Shellshock bug. So patch your bash package as early as you can.

Upcoming AWS / EC2 instance reboot

25 Sep
Raju Alluri 0 Comment Cloud, Security, Technical, Unix/Linux

If you are using AWS and EC2 instances, a reboot of most those instances is on the horizon. Amazon’s AWS informed of this reboot that is scheduled between 02:00 GMT on September 26th and 23:59 GMT on September 30th.

Read more about this reboot on Gigaom and Rightscale. Technical Forums on AWS and other sites are already buzzing with lot of traffic, discussing the potential impact and how to ensure that the services are not impacted.

Given the urgency and magnitude of the instances that are impacted, it looks like the patch is going potentially going to address a security vulnerability. The actual details of the patch and the issues that are fixed by it will be known around October 01st.

Summarizing various discussions on related forums, here is a quick summary of what to watch out for during this AWS / EC2 instance reboot

  • The reboot is not limited to any single availability zone. It spawns across all the availability zones
  • Good news is that the EC2 instances on all availability zones are not rebooted at the same time. So if your instances spawn across multiple availability zones, you are on a relatively safer side.
  • The reboot does not impact instances of the type T1, T2, M2, R3, and HS1. However, if the patch fixes issues on these instance types too, then you might be on your own. We will know more around October 1st.

Here are a few quick checks for those who are getting impacted.

  • Check your mailbox for a notice from AWS and it is likely to give more details about the reboots, impact and schedules
  • Ensure that the key services on your instances are configured for auto restart when the system boots up. It looks silly, but I have seen code that takes good care of newly spawned instances but doesn’t address reboots that well.
  • Ensure that your network paths (non-Elastic IPs, Route 53 entries, S3 buckets) survive reboot of the instances.
  • For those whose instances are NOT rebooted by AWS, watch out for the issues fixed by AWS during this reboot and evaluate their impact on your instances. Take corrective measures as soon as possible.

For those who can afford to be heroic enough – why wait till AWS reboots your instances? Reboot these on your own in each availability zone and test the resilience.

బాపు

01 Sep
Raju Alluri 2 Comments Telugu

బాపు: చిన్నప్పుడు ఆయన గీతలు ఆయన్ను మొదటిసారి పరిచయం చేసాయి. క్లుప్తంగా విషయాన్ని చెప్పడమనేదానికి ఆయన గీతలు నిలువెత్తు ఉదాహరణలు. మనం ఈనాడు గొప్పగా చెప్పుకునే minimalist design ను ఆయన ఎప్పుడో గీసి చూపించారు. సంస్కృతావిష్కృతులైన ప్రబంధనాయికలకు బాపు బొమ్మలు సరియైన తెలుగుసేతలు.
ఆయన సినిమాలు రేడియోలో వినడం చిన్ననాటి మరపురాని అనుభూతుల్లో ఒకటి. ముత్యాలముగ్గు, మంత్రిగారి వియ్యంకుడు, భక్త కన్నప్ప, పెళ్ళి పుస్తకం, వంశ వృక్షం, రాజాధిరాజు, మనవూరి పాండవులు లాంటి సినిమాలు వినోదాన్నివ్వటంతోపాటు మానవ, సామాజిక సంబంధాలను తార్కిక, మానవీయ దృక్కోణాలలో ఎలా చూడాలో చూపించాయి. ఆయన తీసిన సంపూర్ణ రామాయణం ఒక మహాకావ్యాన్ని మూడు గంటల్లోకి సంక్షిప్తం చేసిన దృశ్య కావ్యం.
బంగారానికి తావి అబ్బటమనేదానికి బాపూరమణలు ఒక మంచి ఉదాహరణ. సాక్షి వ్యాసాలనుంచి కోతికొమ్మచ్చి వరకూ వాళ్ళు అల్లిన పడుగుపేకలు తెలుగు పాఠకులకి వాళ్ళిచ్చిన పట్టువస్త్రాలు.
బాపు ఇక లేరనగానే మొదట స్ఫురించింది ఈయన రమణగారి దగ్గరకు వెళ్ళారని. విశ్వనాథవారి విష్ణుశర్మ ఇంగ్లీషు చదువు నవలలోలా ఈయన వెళ్ళి ఆయనను తీసుకొని వస్తే ఎంత బాగుణ్ణు?

Photo Caption Competition

20 Aug
Raju Alluri 0 Comment Misc

I am running a photo caption competition for a select group. Here is the photo:

Photo for Caption Contest

This photo is a selected entry for TCPC‘s Chayakriti-2013. I clicked this picture in 2012.

Here are some suggestions:

  • Give both a photo caption and a writeup/description about the picture.
  • Limit the photo caption to less than 10 English words
  • Limit the writeup/description to 100 English words

Email Transit Security Needs Better Adoption

05 Aug
Raju Alluri 0 Comment Security, Technical

Email transit security is not a new concept, but it deserves more attention in terms of adoption and practice.

Email has become the key component for information access – every online service identifies you through your email id. All online transactions (not just financial transactions) have one or more transactional email sent to you. Examples of transactional emails are – file share notifications, password reset mails, shipment notifications and account information change notifications. Despite not having direct financial information, all these mails have potential to compromise the security of an individual or company’s information.

We all take ample care while accessing our emails over a secure connection using tools like Thunderbird, Outlook or web based secure access. These secure connections ensure that  email is accessed securely from a mail server to a client device like desktop or phone. However, what is the assurance that the mail actually traveled from the sender to the mail server in a secure way?

Securing email during transit is not a new concept. There are enough protocols and processes in place for ensuring email security during transit. However, email security during transit isn’t adopted by all major service providers and organizational senders. This poses risk to the information carried over by emails to individuals and organizations.

Google’s safer email campaign and email transparency report focus on documenting metrics and best practices related to email transit security.  A couple of pictures on this page describe how TLS helps ensure security of email in transit.

Adoption of TLS for email transit security is not a unilateral fix by one or more ISPs. When email is hopping between two ISPs, it requires both the ISPs to agree upon the use of TLS for transmitting the email. So none of the ISPs or individual organizations can claim that they send/receive all their emails over a secure channel. At the time of writing this article, only 74% of mails from Google are accepted by recipients over secure connection. That number is much better, when compared to the 54% mails received by google from other ISPs over secure connection.

There are several techniques employed by eavesdroppers to make meaningful information out of even non-confidential content.  Ensuring email transit security helps an organization in the long run. Even if security of mail content is not of prime concern for an organization today, it is highly recommended that the email is sent securely during transit. That way, the organization is not giving away information easily to the eavesdroppers.

To trust, or not to trust

20 Jul
Raju Alluri 0 Comment Security, Technical

Do you trust? That is a vague question. It is very difficult to reply to this question with a definitive answer.

Do you trust [something]? That is a better question. Most likely, one will be comfortable to give a specific answer.

Do you trust [someone]? Here comes the complexity. The process of determining to trust someone has sevaral factors to weigh in. Trusting a person almost always requires an action or objective to qualify with, so that the affirmation of trust can be deduced. Trusting a non-human also requires additional qualification, but with a non-human, the purpose is mostly inherent and intended.

When I read this article on New York Times about the evolution of trust, it raised a few questions about trust and how we model in in computing and compute driven social environments. The computability of (or quantifying) trust and deduction of trust is, in general, an ever evolving and complex problem.

For non-humans we encounter in digital world, the establishment of trust is thru hashes, digital certificates, digital signatures, etc. and are continuously solved by entities like EMC’s RSA. For example, we may readily trust a PGP signed email or a shopping site that is protected by an SSL Certificate.

Trusting humans we meet online is nothing new. Social networking sites took the concept of acquaintance to a new dimension. Social Networking is slowly morphing the concept of acquaintance to a basis of trust establishment. For example, how many Facebook applications did you install (and trust) recently? How many people (those you have never met in the real world) did you befriend online and as a result, trusted them with your contacts, some amount of personal details, pictures, etc.? More often than not, social networking thrives on establishing trust beyond the immediate circle of acquaintance. Alluring to trust a friend of a friend  is the concept on which social networking thrives.

Shopping sites like EBay and Amazon have rating systems both at the product level and at seller level. Most of these ratings are based on previous transactions and respective human responses. The ratings quantify the transaction and response information to form a basis for trust. Customers make shopping transactions that are heavily influenced by these seller and product ratings.

Those two needs of trusting humans, for digital information and shopping transactions, have certain level of intrusion into the personal space. But the intrusive nature of services like Airbnb into one’s personal space is more physical and prominent.  The concept of giving someone (you possibly don’t know) access to physical resources has a considerable mental barrier. Service providers in this space will continuously try to lower that barrier or find ways to pass that barrier with quantified computation of trust. New dimensions of trust establishment are likely to emerge for solving this need. This space is likely to go beyond simple rating systems by the service providers.

 

 

Chayakriti 2014

07 Jul
Raju Alluri 0 Comment Entertainment, Hyderabad, Photography

The annual photo exhibition of Twin Cities Photography Club (http://www.tcpc.co.in and https://facebook.com/groups/tcpc.hyd ) is currently being held at Muse Art Gallery, Marriott Hotel and Convention Center (some people remember this place as Viceroy Hotel.)

tcpc-chayakriti-2014

This exhibition displays 60+ selected works from members of Twin Cities Photography Club. The last date for the exhibition is 11th July (Friday.)  If you haven’t already, please visit the exhibition and enjoy the pictures.

Furthermore, if you are interested in photography, please join Twin Cities Photography Club at the link mentioned above and attend the regular meetups. The meetups are on specific topics and is a great opportunity to learn from and exchange ideas with other members.

Business unIntelligence

17 Jun
Raju Alluri 0 Comment Interesting, Misc

Dr. Barry Devlin ( @BarryDevlin ) presented a webinar this morning on ACM Learning Center ( @acmeducation ). This talk titled “The Marriage of BI and Big Data” is based on Barry’s book – Business unIntelligence: Insight and Innovation beyond Analytics and Big Data. Business unIntelligence discusses how the trends in Analytics and Big Data are changing the way People, Process and Information are to be looked at by businesses.

The moment I looked at Dr. Barry’s book, it reminded me of this talk by Reed Hastings. In that talk, Reed made a good point that the data will never impact creative. Businesses need to look at data in a contextual and meaningful way than using it for statistical substantiation when decisions related to creativity are involved.

Business unIntelligence presents ways to look at data differently while extracting meaningful information from Analytics (legacy) and Big Data (emerging) information stores. Concepts of m3 (Modern meaning model) to give meaning and context to data are good takeouts from this book. Giving the right context and appropriate meaning to data, in my opinion, is what Netflix did when it made the House of Cards series. Netflix made a series for a specific set of viewers than making a series for all age groups and viewer segments.

I recommend this book to anyone who is dealing with Business Intelligence and Big Data. Not just to users of these, but also to people who gather, maintain and operate on.