Musings on #Heartbleed

Several thoughts have been on my mind about #heartbleed. You may have heard similar thoughts about it, but I’d like to add my own.

Ah… nothing like checking the news in the morning, feels like… ah… a bug in OpenSSL, let’s check it out… OMFG… By 10:00 I was already applying patches to vulnerable (and exposed) servers all around, processes be damned!

Is Free Software security tarnished?

Absolutely not!

Let me start by the first thing you should take in mind: you’re better off than with proprietary software and this bug proves it, few could have said as well as Sam Tuke of FSF Europe did, there are also a few words from Simon Phipps and Eric Raymond.

In a gist, there are several instances of just as serious bugs, and many much more serious, on proprietary software. Even in the field of network security. And those are just the tip of the iceberg, those that were guessed and not found.

This bug had patches available within few hours of being published available to those affected.

Several documented flaw finding studies have been made, guess who turned out better in every single one of them in average? Yes, Free Software. Proprietary software has constantly been found to have, in average, more bugs, more security bugs, more delayed patch releases, etc..

Update (2014/04/13): Also, an even such as this one prompted an independent audit review from the OpenBSD people, here’s another bug in OpenSSL that has been fixed there, proving once again how Free Software works to make software more secure:

  1. you can do independent and public audit reviews
  2. you can push fixes for what you found publicly on the Internet
  3. anyone can take advantage of those changes thus maximizing the effect

Now imagine such a bug happened in Microsoft’s crypto…

  1. you can’t do independent audit reviews
  2. you can’t push fixes for what you found publicly on the Internet
  3. nobody but Microsoft can make a fixes Microsoft crypto library

Replace Microsoft by whomever you prefer above, they’re just an easy target. 😉

Exposure

Here’s the most detailed timeline of public information on the bug that I found.

Yes, the code was there for about two years, but the exposure was not that big. It was big, about a fifth of the “secure” web. Unfortunately, lots of very popular websites were exposed, so the general recommendation is: don’t assume they’re safe, change your passwords everywhere.

Why wasn’t it bigger? Because not everyone runs the latest releases, lots of GNU/Linux distributions have more conservative approaches to running recent software. Take in point Red Hat Enterprise Linux and it’s derivate distributions.

Only since the 6.5 release, released in late November last year, did updated Red Hat (and derivatives) installations become exposed. CentOS followed a about a couple of weeks later.

Ironically, this bug affected the most efficient system administrators who had kept their systems updated 🙂

But many run their services in, for instance, Red Hat Enterprise Linux 5 (and derivatives) which is completely unaffected by this bug. Same for other software.

Even those who run the major 6.5 release could be totally unaffected, if they used NSS instead of OpenSSL with Apache, for instance.

In short: it was big, but not catastrophically big.

Also affects proprietary software!

What? How could this be? Isn’t OpenSSL Free Software? Well, yes, yes it is, but it is licensed in such a way that permits proprietary derivative versions.

They should be safer, right? Hi Cisco and Juniper… I’m sure there are others. I wonder if they’ll be at least honest enough with us… I urge people to check their ultra-expensive and highly proprietary  Web Application Firewalls, Load Balancers, Proxies… etc…

All your keys are belong to US!

9 out of 10 SSL certificates are under indirect control of the US Government. Think Patriot, NDAA, National Security Letters, Secret Courts with Secret Interpretations, people and companies coerced under threat of being formally accused of treason if they don’t cooperate or if they talk about it.

Even if #heartbleed can really lead vulnerable  software to leak the private keys, you should renew your certificates under a non-american CA.

Really, don’t make it easy for them, they don’t deserve that, your customers don’t deserve that, your friends and family don’t deserve that.

Change management be damned!

If you ever have an axe to grind about ISO 20000, ITIL or similar brain dead efficiency killers, specially when implemented by complete and utter idiots, now you can have some revenge.

It is a bug of such seriousness that I recommend to screw the change management processes. Update now if you are affected or change your career because you either are managed by complete and utter idiots or you don’t take it seriously enough.

Places that have enough good sense will allow you to run the Emergency Change process by your ECAB after the fact for such serious situations.

Take advantage of that, this is such a case.

Conspiracy theories

Unlike some suggested, it appears to be an honest mistake that neither the developer nor his reviewers did spot, and they felt quite embarrassed:

The author of the bug, Robin Seggelmann,[78] stated that he “missed validating a variable containing a length” and denied any intention to submit a flawed implementation.[79]

Theo de Raadt, OpenBSD’s founder, said «OpenSSL is not developed by a responsible team», but I doubt they’ll bother implementing a new SSL library. I wonder what they’ll do though… but are likely making an independent review.

Prophecy come true!

Poul Henning-Kamp’s hilarious ending keynote of FOSDEM 2014 pretending to be an NSA agent speaking of Operation Orchestra, calling it a crown jewel:

  • Crown jewel: OpenSSL
  • Go-to library for crypto services
  • API is a nightmare
  • Documentation is deficient and misleading
  • Defaults are deceptive

We need to ask him where he has found spice… he certainly seemed like he had blue eyes and #Heartbleed was truly a Crow Jewel for…

…The NSA

No such agency had such a duty to find a serious bug like this one and responsibly proceed to get it fixed ASAP as it was affecting its nation like the National Security Agency had.

There are innuendos that the NSA knew about heartbleed for a long time. They certainly have the expertise and the budget to have found it, but they did deny any knowledge or exploit for years, in fact that they didn’t know about it before April.

Of course, no one can trust the NSA anymore because they have been proven invested into breaking security for everyone, so they could be lying in order to cover their asses after such a monumental fail in protecting their own country’s security.

Or they could have just been doing it for less than two years, like one year and 364 days, not yet years (plural), right?

One never can tell, and that’s symptomatic of a very botched organization.

Is Microsoft involved?

I don’t know. It’s certainly fishy that:

  • The publication date coincides with the death of Windows XP. It could be called a distraction manouver, so that people get scared of moving away from Windows XP into a GNU/Linux… it certainly has been effective at crying wolf in big media outlets
  • Codenomicon is run by a Microsoftie, well, ex Chief Security Officer of Microsoft, but those kinds of people tend to leave the companies with strong lobbying and partnership relations in their next ventures with the big mothership
  • It is documented that Microsoft has been a faithful collaborator of the NSA for many years, even to the point of maybe having a dedicated backdoor

Maybe it’s just coincidence. Maybe

OpenSSL is grossly unappreciated

They few OpenSSL developers are highly dedicated people that don’t exactly live well off of it. In fact, the importance of OpenSSL is disproportionately unappreciated, specially in a financially rewarding form.

Fortunately, the devlopers do it more out of other rewarding factors, like responsibility and pride.

Conclusions

  • It’s one of the most serious security bugs in the history of the Internet
  • Use any of the available mitigations if you’re affected (upgrade, recompile disabling the feature, downgrade, change software)
  • More people (specially corporate companies making money with OpenSSL) should donate mone to the OpenSSL Software Foundation
  • I don’t remember writing such a long post, it’s probably very flawed, I accept patches, comment below 😉

Yes! I’ve got my 46.03 € of #Windows #Refund and so can you, at least with #Samsung

If you’ve been following me on this blog or other social networks you know I bought a Samsung NP900X3C. It’s a very nice laptop but I’m forced for some obscure cof OEM cof reason to buy a Microsoft WIndows 7 Home Premium OEM license.

Receipt and refund in cash

When I bought it at Media Markt I immediately mentioned I wanted to get a refund on the Windows that was installed. Media Markt said I’d have to go to Samsung or Microsoft, that they wouldn’t do that. Please remember this part…

Since It was the exhibition model they had there, I had no chance to explicitly reject the Windows license, so I went ahead and installed my favorite GNU/Linux distribution for personal use, Fedora, at release 20.

While it installed, I opened a case with Samsung by “email” and they replied to me soon enough by real email.

Samsung said that

  1. I wasn’t to turn the laptop on or accept the license [check, Media Markt did, I didn’t]
  2. that I should take it to the store [Media Markt, which had preemptively rejected any process]
  3. the store would use the official Samsung Service Center [which in Lisboa is just a few doors up in my street] to erase the disk and then
  4. return it to the store in order to fulfill the refund

Well, if steps one and two were broken already and since the store is a few doors upwards, why not just go there directly?

That’s what I did, but I was left hanging without any further details for up to three weeks and I was getting very pissed off. At least give me a piece of paper saying you won’t do it, damn it! 🙂

So I went there today and said I wasn’t going to leave the store without one of three things:

  1. my satisfaction, aka, the Windows Refund, or…
  2. a note explaining why they can’t do it yet, or…
  3. a note explaining why they won’t do it.

Boy, where the poor nice guys at the service center pissed, so there’s this crazy guy trying to get money back from a Windows refund, what a nutty guy, never heard of that before and now I’m stuck here well past closing ours, right? 🙂

Well, after a short talk on the phone with the owner, who was a bit defensive then, and waiting a bit more, I had a second talk with him and he was much, much friendlier now and willing to capture my satisfaction. Nice! I don’t know exactly what happened, but they decided to fast forward the process.

Apparently, Samsung Portugal sent the request to Samsung Korea and never had any reply, so they were going to refund my 46.03 € in advance.

Receipt

Yes!

I still had to explain the guys they had to take out the license from the charger because Samsung would need it to pay them back the money, but finally I could officially get rid of Windows and get back what I had paid for it.

Before: charger WITH Windows licenseAfter: charger WITHOUT Windows license

#lesigh… Random idiot speculates #systemd was compromised by Red Hat for the #NSA

Le sigh… it seems that in the discussion between SystemD or Upstart in Debian, a random idiot speculated that SystemD would have been adultered by Red Hat for the NSA.

Bravo, what a way to poison a sane discussion, troll.

Since it’s Free Software, how about you rebuild it from scratch and you check it out yourself whether it really and you better post some evidence, alright?

Speculating such garbage is not helpful.

#Fedora 20 boot on #Samsung NP900X3C: 6.716 s

Woah… from systemd-analyze plot > boot.svg

Startup finished in 1ms (firmware) + 7ms (loader) + 1.189s (kernel) + 2.203s (initrd) + 3.314s (userspace) = 6.716s

Fedora 20 (Heisenbug) roque (3.11.10-301.fc20.x86_64 #1 SMP Thu Dec 5 14:01:17 UTC 2013) x86_64

#MicrosoftTax Refund?? What? We’re not Microsoft!

So I went to the Samsung Service Center downstairs… it’s such a rare event that of course they were very surprised.

Since their boss wasn’t there, they took not of my Samsung contact and case number, photographed the evidences I showed them that the laptop is Windows-free:

  • sudo fdisk -l
  • mount
  • ls each of the filesystems
  • and they also filmed the boot process

Now I’m still waiting for the next steps… sigh

 

Samsung: We’ll refund your #MicrosoftTax

So I asked Samsung what the procedure would be in order to get a Microsoft Tax refund and they replied:

  1. once bought, don’t turn the laptop on
  2. don’t accept the license terms (which is kind of hard to do if you don’t turn it on, but I guess that’s just for the in case you turned it on… situation)
  3. go the nearest Samsung service center (that’s practically just downstairs, for me, yay!)

Since my laptop was the model on show it was a) already turned on and b) I never booted into Windows after bought and c) I completely erased Windows from my SSD.

I guess I’ll get my Microsoft Tax back. Yay! 🙂

Exmo. Sr. Rui Seabra,

Em resposta à sua consulta em que solicita informação sobre o portátil Samsung, agradecemos o email que nos endereçou, que será objecto da nossa melhor atenção. Informamos que é possível obter um reembolso da licença do Windows, desde que assim que adquirir o equipamento não ligue o portátil nem aceite os termos de licença. Por outras palavras, assim que adquire o equipamento deverá ser reencaminhado pela loja para o centro oficial da Samsung ou contactar a mesma para apagar todo o conteúdo do seu equipamento e que lhe seja devolvido o montante da chave OEM, caso contrário, não será possível. A assistência técnica autorizada pela Samsung é:

Assistencia 35, Lda Lisboa
Rua Jorge Barradas, Nº30 C
1500-371 Lisboa
telf: 214107369

Don’t want no Microsoft tax!

So you might know I bough a Samsung NP900X3C. Yes, it came with Windows. No I don’t use it. Yes I want my money back on that item.

I’ve just asked Samsung Portugal what the procedure is.

Boa noite,

Adquiri um portátil NP900X3C e não utilizo Windows. Desejo devolver a licença de Windows que fui forçado a adquirir na compra do portátil em causa, bem como de todos os softwares incluídos no sistema operativo a devolver.

Desde que o arranquei pela primeira vez que corre GNU/Linux, neste momento Fedora e encontro-me muito satisfeito com o suporte, mas não concordo com a licença do Windows nem posso ser, legalmente, forçado a aceitá-la para comprar um portátil.

Como devo proceder?

Obrigado em avanço,
Rui Seabra

Screenshot from 2013-12-15 01:45:13