Wednesday, 16 December 2009

Security Digest #4

This month's Digest is just a little earlier (and just a little shorter) than usual, because of the holidays...


Get The Best Security You Can Afford

Eric Lippert's blog, Fabulous Adventures In Coding, is often among other things a great source of insight into the way the C# compiler works. That's the chief reason why it's a personal favourite of mine. But as its title suggests, Eric's interests and expertise extend into other areas.

On his last summer holiday, for example, Eric used an incident at an airport to digress into analytic queueing theory. And just this week, he's taken an unexpected diversion into some very basic principles of security systems. Click through to see how RSA cryptosystems can be misapplied, providing an illusion of security - with no substance. And he ends with so many excellent bullet points, that you will cower in fear.


The CAT.NET 2.0 Configuration Analysis Engine

Last month I looked at the InfoSec Assessment & Protection (A&P) Suite, which had just been released. Maqbool Malik has provided a fully detailed guide to the Configuration Analysis Engine of its Code Analysis Tool, CAT.NET v2.0:


And from Channel 9, there's this video of Maqbool Malik and Anil Revuru (RV), from Microsoft Information Security, talking about the new release of this tool:



On Security Error Prevention in Development

Preventing Security Development Errors: Lessons Learned at Windows Live by Using ASP.NET MVC is a Microsoft paper discussing Security By Default, one of the core SDL principles. Also, a very instructive account of how the Windows Live Team adopted the ASP.NET MVC framework when developing the services that are included in Windows Live, and how their approach helped to prevent developers from making security errors:



BlueHat v9 Brings the Looking Glass to You

Finally this year, the session and interview videos from BlueHat are now available on the TechNet page:


SMS and other attack vectors on pocket-sized devices were a prominent area of comment this year, somewhat predictably; and equally so, The Cloud, and Software + Services (S+S).


That's all from The Padlock for 2009. Have a Security Strategy, and a Happy new Year!

Monday, 7 December 2009

The Dogma Song

I've Been In The Loft

Rewiring the bedroom lighting, and fetching down the Christmas decorations. I found this: a mildly amusing, language-game lyric, written in 1979 - aye, three decades ago! On an electric typewriter! - written, as I was saying, at the time when my good friend Tom Fox, philosophy scholar of this parish and a great fan of the writings of Thomas Aquinas, was leaving these shores to further his studies in Rome.

Utrum Omnes Lex Humanitus Posita A Lege Naturali Derivetur
A young Italian student, he
Was being where he shouldn't be;
And while he being was, you see,
A prefect leaped down from a tree -
Up which, he'd every right to be.

Said him to he, "And what gives you
The right to don't as Romans do?
For up there, down here, I did view
Your trespassing, and heedless to
Such penalties as might accrue."

But Foxy, with a wily look,
Knew he could counter this rebuke;
And from his ample cassock, took
All fifteen volumes of the book
From which this poem's title's took.

"You say that I'm at fault, because,
Down here, with you up there, I was.
Your reasoning is full of flaws!
Which says, among your Roman laws,
Where I can't plant my fox's paws?"

The stage was set; in sequence, they
Produced their books, and had their say,
With eloquent verbosity.
So it continued, night and day,
They'd curse and argue, fight and pray,
And neither man has given way.
That's why, until this very day,
You'll find them on the Cassian Way,
Or any map of Italy.

Copyright © 1979 by John M. Kerr.

This is my original text, including the mega-pretentious title, which I still like. Later, the "poem" became a "story", got itself some choruses, renamed Dogma, and sung to a tortured rearrangement of Benny Hill's Ernie (The Fastest Milkman In The West). Tortured but humorous, as the odd number of lines forces each verse to end with an anticlimactic fade...

Why no, actually. No, in fact I have no plans to record it for YouTube. Seriously. Shut up.

Tuesday, 1 December 2009

On Quines

Writes Code Which, When Run, ...

This is mind blowing. Yusuke Endoh has written a very interesting computer program. In fact, he has written a whole series of them: eleven in all.

What's interesting about these programs is that, first of all, each of them is written in a different computer language. That fact alone qualifies him as a clever chap. Then there's the range of languages he used: some are fairly common (Ruby, Python, Perl, C, Java), others somewhat more exotic (Lua, OCaml, Haskell), still others downright esoteric (brainfuck, Whitespace, Unlambda). Clearly, he's actually a very clever chap.

But when you look at his set of eleven little programs, each in its own different language, and when you realise exactly what they do, then you are forced to conclude that Yusuke Endoh is in fact a very, very clever chap. Because what every program in this set does, when you run it, is to print out the source code of the "next" program in the set.

Imagine these eleven programs arranged in a circle. Each one, when run, prints a copy of the source code of the next one.

I suppose you could look at it another way: he actually only had to write one of these programs. Then he could run that to obtain the second, then run the second to obtain the third, and so on. But wait a minute, doesn't that mean that when he runs the eleventh program, its output will be just the source code for the very first one?

Yes, that's right. There was actually no need for him to write anything at all. These are eleven self-generating sources. What a lazy guy!

Picture: MC Mechanic by Shane Willis.

Here's the link to his blog article. In the (English!) comments you'll see that he actually wrote, in the sense of "putting effort into the crafting of", two of the sources, the diametrically opposed Ruby and the Haskell; then effectively infilled to complete a cycle:


A computer program which prints out a source code copy of itself is called a Quine, after America's most influential Harvard philosopher and logician, Willard Van Orman Quine. So, this is a kind of generalisation of a Quine program.

Here's another description of Yusuke-san's achievement, for those like me whose knowledge of languages does not extend to Japanese. Note the comment from Professor Quine's son Douglas, at the foot of the article:


The association with Quine comes from his famous self-contradictory predicate, yields a falsehood when appended to its own quotation, which he used to investigate the linguistic anomalies underlying Russell's Paradox. Here of course we are concerned not so much with the paradox, as with the self-referential nature of the sentential fragment, which mirrors the self-replicating behaviour of the code.

Historical Note

I was lucky enough to enjoy brief correspondence with Professor Quine in the 80s, and also more recently with his son Dr Douglas Quine, who recommended to me Quiddities: An Intermittently Philosophical Dictionary as a sampler of his father's humour, insight and intellect.

And that's a great read; but my favourite Quine works are still The Ways Of Paradox and other essays, in which I was first exposed to the genius of Alfred Tarski, and the Lambda Calculus, at a dangerously young age; and Methods Of Logic, which first convinced me computers could solve problems using predicate calculus (though it wasn't until several years later that I finally got my hands on a Prolog system).

Decades after you've absorbed whatever technical content you needed from their pages, you can still reread those books for their astute, elegant, lucid and entertaining prose style.

Tweets - November 2009



Monday, 30 November 2009

Meshuggah

Straws Pulled at Random



The instrumental runout on this song is mesmerising.

OK, sure, it's a song about death. The whole fathermuckin' genre's about death, it's right there in the title, this is Death Metal. But it's also some very inspired, minimalist composition. It stays with you and haunts, like a Shadowman game. If you only ever listen to one Meshuggah track - and let's be honest, you probably will! - then make it this one.

Sunday, 22 November 2009

Security Digest #3

Catching up with the latest developments in our favourite MSDN Security Blogs, the SDL and Security Tools.

Two headliners already escaped from this month's Digest and skipped the queue: Volume 7 of the Security Intelligence Report, and Agile SDL. Here's a bunch of smaller announcements and developments for those who just can't get enough of that ol' computer security goodness!


Pirates v Ninjas v Engineers

Threat Modeling is the first port of call in your journey to software security.

Amusement and light entertainment were to be had at the end of October, when the SDL's Adam Shostack declared in favour of Engineers, in their never ending struggle with the Ninjas of Threat Modeling.

What's Ninja Threat Modeling? It's lean, focused, easy to learn, and readily implemented. Cory Scott explains all, while contrasting his arguments with more traditional security development lifecycle approaches - and in particular, taking an occasional swipe or three at Microsoft's history of data-flow diagram & attack tree approaches, and multiple Visio-driven offerings - in this quite comprehensive article from the Matasano Security (developers of Playbook) website:


Adam's articulate and considered reply sets out to compare the two different security methodologies, concluding that the MS-SDL has matured sufficiently to be considered the optimum choice whenever security considerations can be built into a project from the outset. Ninja Threat Models might be of use when an already developed or deployed system needs to be hardened, and admittedly, they do sound more focused and agile than traditional SDL. However they are necessarily less rigorous and less complete. And anyway, the agility factor has now been addressed in other ways.



InfoSec Assessment & Protection

Todd Kutzke, Senior Director of Information Security (InfoSec) at Microsoft, writes here about the InfoSec Assessment & Protection (A&P) Suite that's just been released.

The Assessment Tools include a complete rewrite of the managed code, security source code scanning tool, Code Analysis Tool for .NET (CAT.NET); and the Web Application Configuration Analyzer (WACA), which scans the development environment for various best practices, including: .NET security configuration; IIS settings; SQL Server Security; and miscellaneous settings for permission in Windows.

"Protection Tools" here refers to the Web Protection Library (WPL). This incorporates a diverse set of elements, for example Anti-XSS V3.1 (the Microsoft Anti-Cross Site Scripting Library), and the Security Runtime Engine (SRE).



Finally for this month, Anil Revuru has written the following two useful and quite comprehensive guides, for configuring and running stuff:



Until next time, Keeeeep Dancing!
Eh, no I mean, Have a Security Strategy.

Saturday, 21 November 2009

Wee Mac


Wee Mac - Sep 16th 1993 - Nov 21st 2009

Mercury
the winged messenger

Linda and I married in June 1993. One particular day a few months later, I'm home from work briefcase in hand, and asking her what's for dinner. "There might be a clue in the living room," is the cryptic reply. Okay that's odd, I think, but we'll come back to it. "Any mail?" I ask.

She hesitates, then "There might be something in the living room."

Suddenly curious what I might find in that room, I'm slowly opening the door. She's come through from the kitchen behind me, peering over my shoulder. I'm getting a bit edgy.

A brightly multicoloured patchwork quilt lies on the floor at the foot of the sofa. Cautiously approaching it, I resolve a little matt black bundle in its middle. The bundle moves. It breathes. What is small, matt black, and breathing?

"It's a puppy!"

I'd mentioned before to Linda that I'd like a dog. In the past few months I'd complained - in fact, both of us had - whenever we saw someone walking their dog, how unfair it was that other people had dogs, aye and some had two or more. And we had none at all! Not even one!

So this is her surprise for me, a conspiracy hatched with her father, who's driven to collect the pup this day; and her mother, who's responsible for the swaddling. We name him "Mac". He sleeps through it all, blissfully unaware of daddy's arrival home.

Venus godess of love

Collies, and Border Collies in particular, are among the very cleverest of dogs. They spoil you absolutely for other breeds. After you've owned one, anything else is just a dog. Mac was easily trained, and learned many commands. Linda had plenty of experience of the breed - her previous dog, Sam, was legendary for his intelligence, both at home, and in Highland Shows where he'd often put the local working dogs to shame (winning so many awards, they changed the rules to exclude him).


Linda with Sam and Wee Mac - 1993

We used to joke that Mac was "a dog with a sense of humour," for example when you told him, "I'm gonna eat your dinner!" and he would growl, all the time wagging his tail.

Sometimes of course he'd be a little less clever than usual. Then I'd be forced to introduce him as "a genetic anomaly, the world's first border collie without a brain!" Wee Mac - as he'd come to be known, despite his absolutely average 20kg - didn't mind. Dog with a sense of humour, remember.

He was well loved. When Linda and I were both at work, he would spend days with my father, and my aunt. Mac was simply too clever to be left alone, and they doted on him too. Linda had already made an impression by training dad's previous dog Kerry, a Kerry Blue terrier of course, to walk on the lead, sit at the kerbside, and come back when recalled. This was a unique novelty; we'd never had such a clever dog before! But all that was as nothing to the range of tricks of which Mac became the master.

Whenever we went on holiday, well as Linda would say, "There's no show without Punch!" and so we had to ensure that our accommodation, cottage, caravan, or other, welcomed pets.

His first summer, we took him on his first of many trips to Embo, by Dornoch, Sutherland. Grannie's Heilan' Hame, to be exact. Once he discovered the beach there was nothing we could do to keep him away from it. We might think that we had him completely under control on an extending lead; next minute he was off, racing across the sand and rocks and into the brine, with his useless lead reel bouncing and clattering along behind him.

Mars bringer of war

Wee Mac's life was sadly blighted by being viciously attacked, while still only weeks old, by a neighbour's adult dog. The attack was a sustained one; I had of course put Mac on a lead, and was unable to let him go or pick him up to safety, so all I could do was pull him around in circles trying to get him away from his uncontrolled attacker, while the idiot owner stood back laughing. Mac had extensive surgery to repair his head and face, and was lost to us for a few days.

As a direct result of this, and subsequent similar experiences with the same attacker, Mac was never socialised. Despite numerous visits to training and obedience classes, he never learned to approach another dog without attacking it. His insecurities could occasionally lead him to turn on people too, particularly when someone pulled at the side of his collar, which I'm certain reminded him of that terrifying first attack.

Jupiter bringer of jollity


That aside, Mac's development was unremarkable, and he liked almost any other type of animal - with a particular fondness for cats, oddly enough. He displayed almost parental affection for a friend's guinea pigs, when once they were left in our care for a few days.

Nothing, obviously, was better than being at the seaside. Mac would always chase the waves, trying to catch them in his mouth, and end up with a belly full of salt. He'd swim out to retrieve floating sticks and toys, occasionally substituting one if he lost it.

He'd cheerfully pick up a "stick" that could actually be anything up to a fallen tree trunk, between three and twelve feet long, and three inches thick; adjust his grip by increments until it balanced in his muzzle; then run to you, dropping it at your feet. Waiting for you to throw it.

Actually, he'd drop it just far enough from your feet to make you do the work.

He had a slight heart murmur, and spent much of his life on medication for that. Not so much as you'd notice though, his spirit was strong, and his personality could not be suppressed by a little water tablet, or ACE inhibitor.

Mac was always first beneath the tree every Christmas morning, looking for his treat & squeaky toy stocking, which he would invariably unwrap for himself. In fact, he didn't always wait for Christmas morning! And if he visited you any time around then, your tree would get the same treatment.

His obedience, cleverness, and sense of fun, endeared him to everyone who knew him.

Saturn bringer of old age

Time brought him cataracts, at an age and a condition where nothing could be done about it. And so time also brought him near total blindness - or at least presbyopia.

Old age brought him deafness too, which signalled an end to his ability to respond to commands, except for one: he would still recognise as a recall signal, an arm waved in a circle, sufficiently far away. On the positive side, he was no longer freaked out requiring tranquilizers on fireworks night.

Then came arthritis, and his medication had to be supplemented with painkillers, first anti-inflammatories, then opiates. He began to have trouble standing up and - particularly - sitting or lying down.

Uranus the magician

We extended the steps into our house, lengthening the slabs so that he could get in and out more easily. We'd earlier tried out a dog ramp, but once he'd decided he didn't trust that, then it was never going to get used - he went out of his way to avoid it. Personally I think its metallic construction reminded him of the decks and walkways on the bridges and ferries he'd encountered on holiday when younger, and he didn't like those. Particularly on one tragi-comic occasion - on a ferry to Orkney I think - when we'd just managed to get him to calm down in our arms, before a previously unnoticed ship's horn blasted his ears from a range of two feet.

Mac generally slept on a Snoozee Dog blanket in our room. But as he got older, his trips upstairs at night grew less frequent. That made it all the more special when after a good day's rest, he would suddenly find the stamina to follow us, looking for company. We would hear him, slowly shuffling upstairs two or three steps at a time, sometimes finishing with a burst of half a dozen in his race to the finishing tape.

These were good times, when we felt that we had our wee boy back with us, and they gave us hope that the various medications, and his diet, were helping to make his later life a bit better and more comfortable for him.

Neptune the mystic

Inevitably and inexorably, these magical interludes grew less frequent, and more troubled. Sometimes he would fall back downstairs, while most other times he could not summon the effort to make the attempt. His pains grew worse, and he began to go off his food.

follow me down
to the valley below
you know
moonlight is bleeding
from out of your soul

Eventually, Mac stopped eating almost entirely, and couldn't even be hand fed. When it seemed that his life contained nothing but pain, we prepared ourselves to face the inevitable.

my David don't you worry
this cold world is not for you
so rest your head upon me
I have strength to carry you

Today we both held him, kept him calm and reassured, while our vet administered the sleeping jab. It was a very peaceful end. Then we cried. He had gone so quickly.

come to us
Lazarus
it's time for you to go

Tonight, we toasted the immortal memory of our little absent friend. Wee Mac was 16. Or to put it another way, he was 113.

He's been with us for all of our married life. He's been with us, ever since Linda and I have had our home together. We have always been three. But now, our identities have changed, we're no longer mummy and daddy. Now there's a ghost in every room, in the garden, in the back of the car. I glance over by the sofa, and for one instant, think I see him there again.

It's just a pair of slippers.

Headings inspired by "The Planets" by Gustav Holst
Words from "Lazarus" by Porcupine Tree written by Steven Wilson