Is it Okay to Disable SELinux or AppArmor?

I am flabbergasted at what some so-called, self-anointed 'Linux Experts' offer in the way of sound technical advice.

Take Igor Ljubuncic (aka Dedoimedo) for example.  He seems to be a smart guy and many look to him for reviews of Linux Distributions.  But, I tend to disagree with him about as much as I agree.

His latest story, Linux Mint vs. Ubuntu Security, spurred me to write this post and as it is more than a bit problematic and misguided, I take exception here to disagree with his security recommendation.

As we, in the IT business, should know, security is a process, not a thing.  The effectiveness of one Distro's security implementation may or may not be as good as another's.  And, how each Distro's developers choose to configure security isn't necessarily guided by good decision making.  In fact, I have written, many cookie-cutter clones, or spins if you will, inherit the bad design decisions of their parent Distro, which is one of my pet peeves for why cloning is not necessarily good for Linux at large.

It was causing problems so we disabled it

A response to resolving Linux Security Modules (LSM) issues often heard is the advice given to disable the 'offending' module entirely, when such errors arise.

Igor writes:

Aha, I knew it. There you go. Linux Mint does not ship with AppArmor or any profiles. Well, interesting, not. The thing is, security tools like Apparmor or SELinux are much like HIPS software in Windows. In other words, not necessary. Moreover, they usually cause more harm than good by blocking legitimate software from running. What we like to call the false positive, or fail publicly (FP).

Here, Igor takes it upon himself, despite the considerable design efforts put forth by Canonical Ltd. to provide enhanced LSM sandboxing technology, to marginalize the importance of such technology.  I find that rather irresponsible, given today's situation, what with world-wide rampant security exploitation and surveillance on the Internet growing by leaps and bounds.

No, I am afraid Igor is giving bad advice and has no business telling readers to disable a service provided by software vendors, backed by good justification and years of experience.  

Igor goes on to say:

Indeed, if I look at the history of my involuntary use of Apparmor and SELinux in various distros, I have seen the former kick in only once, and the latter about three dozen times, and each example was a case of a legitimate program being mislabeled. In theory, yes, they might prevent exploits, but you're not running a commercial Web server, so relax.

So, on the one hand, he's admitting that LSMs do indeed prevent exploits, yet on the other he's suggesting (paraphrasing) there was a bug in mislabeling a legitimate application.

So, why, then, did Canonical choose to include LSM AppArmor with Ubuntu and Fedora choose to include LSM SELinux for their several Desktop spins?  

Evidence like Stuxnet, Identity Theft, Ransomware, Malware, Bots, Keyloggers ought to be good clues as to the gravity of the situation.  This clearly isn't sensational.  It is real and happening to the unwary every day.  Igor, strangely, minimizes the seriousness of the situation.

What should be done in the case of a reproducible LSM sandbox error?

If you are experiencing a reproducible error (verses a 'one-time' intermittent error)  using a signed application in your Distro's software repository, do open a software support call ticket on their website so that the vendor can take immediate corrective action.

Don't disable your LSM sandbox.  Go directly to your software vendor for support.  Your issues will be resolved expediently with revisions to your security software. 

-- Dietrich

Related articles

• Configuring and Managing selinux in Red Hat Linux
• Introduction to AppArmor
• An introduction to security models in Linux

Read More

RetroShare: True Internet Privacy Requires a Change of Habits.

by Dietrich Schmitz

I've been thinking about making changes to how I currently use the Internet.

One thing is for sure, it's hard to break old habits.

Of course, it's convenient to use Gmail.  And that it is unencrypted along with everything else including Drive is beside the point.

This convenience must be dealt with.  If your privacy is going to be protected, Americans, your only recourse is to employ encryption--unbreakable encryption.

And, I've been looking at RetroShare.

I think that RetroShare is perhaps the best example of what privacy-enabled software should offer.

But making a commitment to force oneself to adopt the needed technology is key.  It's not that hard to put into play.  I have RetroShare on my Netbook.  Let's see what it took to set it up.

Environment

First, I will say this is a discussion regarding the use of your 'home' PC.  I use PC to generically refer to your computing device.  It's an old term, and, I'm getting old.  Had an IBM PC in '83.  But I digress.  So, okay.  You are home and wondering how you can boost your privacy?.  Let's take a look at your Wireless Router.  Mine is a Cisco Linksys E3000, which I reflashed with DD-WRT, but yours may be any kind which supports uPnP.

Let's have a look at the router.  Bring up yours (my ip is 192.168.1.1) and login with your admin login id and password:

Enable uPnP support on your Wireless Router

The location of this information will vary according to your manufacturer's design.  Straight away, I am strongly recommending you use uPnP.  Why?  Because it will automatically make all of the port forwarding decisions for you.  Otherwise, you do have the choice to manually select an inbound TCP and UDP port and define the forwarding ip address of your PC on your home LAN.  But, I won't show how.  Just use uPnP if you have it.  Most routers support it.

RetroShare Software Installation

Okay with that out of the way, I am now taking you to the RetroShare website's download page.  On my PC, I am running Netrunner 13.06 Enigma, an Ubuntu derivative with KDE Plasma Workspace.  I'll just call it KDE.  I hope +Aaron Seigo and +Martin Gräßlin won't mind.  Anyhow, that means I can follow the directions pertaining to Ubuntu:

RetroShare installation instructions for Ubuntu

Sweet.  This should be easy.  And, it was.  I won't show you how to do the install steps.

So, great.  We've got RetroShare installed, you've input your name, email address, and created the needed GnuPG key and should arrive at this screen:

RetroShare main screen

There it is.  The main screen of RetroShare.  On the bottom of the window, note NAT and DHT.  If you are using uPnP on your router, both will be initially red and NAT will turn yellow and eventually green.  Both will become green all on their own without any further action on your part.  This is why I suggest uPnP.  It's the most painless way to get up and running.

If, however, your router doesn't support uPnP, you'll need to do some extra legwork on both the router side and on RetroShare in settings.  Let's take a brief look at settings:

RetroShare>Options (Gear)>Server screen

Click the gear on the left of your RetroShare, then Server and you'll see the above.  If you need to manually configure port forwarding on your router, you'll need to switch your settings to "Manually port forwarded" here.  This is the hardest part of setup on RetroShare.  But we are striving for maximal privacy here, are we not?  Yes.  I hope you will prevail and conquer this.  Be proud you did it.

And so we have presumably done the router configuration, installed RetroShare and can see we are on-line by the number of users across the peer-to-peer server-less system.

Connecting With Your Friends

Fantastic if you've gotten this far.  But, we are not doing much until we establish one or more Friends connections with people we know.  That sentence is subtle but the distinction here is important.

This isn't like a Bittorrent or Tor P2P system.  No, it is quite different and very restrictive.  It is a 'Friend-to-Friend' (F2F) 2048-bit RSA encrypted key system tunneled over Secure Sockets Layer (SSL) where all data moving along the Distributed Hash Table node list is multi-plex encrypted.

What that means is that all of the data is gibberish to anyone other than you and your designated 'Friends' with whom you have explicitly taken the crucial step to share your F2F public key.

Isn't that what you really want?  Yes, it is.  And one of the many benefits you will find in using RetroShare is that the exclusivity of F2F means that nothing will be on your private channel but what you choose, including email.  Yes, email will only go to and come from your Friends.  That means, NO SPAM.  Guaranteed.  Assured.  Isn't that great?

Alright, so sharing your public F2F key is something which you will want to exercise care doing.

Technically, you can go straight into email and send from RetroShare a Friend request to one of your gmail Friends.  But, if you take the 'ultra-paranoid' point of view (cough NSA PRISM), that email can be read by any third-party concern.  And, a rogue 'imposter' could conceivably assume the identity of one your supposed dear Friends.  That wouldn't be good.

What to do?  I think the simplest way to share privately your F2F key is to coordinate with them 'by phone call' a session for sharing, using either cryptocat.org or cryptobin.org.

It just so happens that I've tested both and they work quite well and are relatively easy to use and will become 'routine' after using once or twice.

The first thing you need to do is get a copy of your F2F key.  Where is it?  It is in Options>Profile>Certificate.  Don't be intimidated by what you see.  It's how encryption works.  You need to copy the certificate to the clipboard with the copy to clipboard button, or, right-click, select All, then right-click, copy to accomplish same.

There.  You've got a copy of the key.  Our goal here is to contact your Friend, have them do all of the preceding steps so they have RetroShare installed and ready to exchange F2F keys.  Here's the screen for the certificate:

RetroShare F2F Certificate screen

You'll notice, I intentionally erased a bit of the image to defeat anyone from copying my current F2F key.

Off we go with our Friend to cryptobin.org.  You'll see below, I have pasted in my F2F key, set the time to expire to 1 day and generated a password using the 'Generate' button.  If you leave the screen without recording the password, then your Friend won't be able to unlock the screen.  Ideally, if you have them on the phone, manually create a mutual strong password (no need to press Generate in that case).

If the user is not currently available, bookmark the url created by cryptobin and email it to your Friend.  Have them call you for the password.

Cryptobin.org screen where you can share your F2F key with your Friend securely.

And, they will do the same with you to exchange their F2F key.  Don't forget to press the 'Bin It!' button, which will encrypt your message and create the needed url for your Friend to access when they have time.

So where does the F2F key get added?  Click Add a new Friend, then select 'Enter the certificate manually' and press Next:

RetroShare Add a new Friend screen.  Select 'manual' and press Next

Now, you need to take the Friend's certificate which they sent to you using cryptobin and paste it into the second empty window and press Next:

Paste your Friend's certificate in second window

This is the Make Friend screen.  If I shared my F2F key with you, you'd be seeing my name as shown.  Only sign F2F keys for people you know personally.  This is important as GnuPG is based on the Web of Trust principle.  Here's a screenshot:

RetroShare Make a Friend screen

As you know this Friend personally, you should sign the key.  Click Finish and you are done!

Congratulations!  You are now connected to your Friend(s).

Now the fun begins with total privacy assured for Chat, email, file sharing, voice and video calling, Chat forums, and Channels.

As always, act responsibly, be a good Netizen, and obey all laws for your respective country.

I hope you will make a commitment and change your habits to reclaim your privacy.

Best of Luck and Be Safe.

-- Dietrich

Related articles

• RetroShare: For the Paranoid in You!
• Retroshare: A next generation secure communication and file sharing platform
• Maintaining Online Privacy and Preventing Identity Theft with New...
• Security & Privacy: Exploring the possibilities of secure decentralized instant messaging.

Read More

Zero Knowledge for Cloud Storage: A Proposed Internet Privacy Mandate

by Dietrich Schmitz

What do you know about the 'Zero Knowledge Privacy Standard'?

What?  Oh.  That's right.  Heh.  It doesn't exist.  Sorry.

So, then you probably have zero-knowledge about the Zero Knowledge Privacy Standard.  Sorry, I am getting clever.  But I hope to raise your awareness in this story about something which you will find very important. (Image credit: spideroak.com)

What is Zero Knowledge?

For starters, it isn't a standard.  Let's get that out of the way.  It's an emerging practice used by SaaS Cloud storage providers.  Essentially, getting storage for your files in the cloud has become common-place.  The problem is that those files are directly readable by any third-party governmental agency (cough Patriot Act, National Letters, NSA PRISM) requesting access.  That makes getting to your personal and private data like 'shooting fish in a barrel'.

Zero Knowledge works by having all of your files encrypted on your local device 'first', giving you and only you ownership of the private encryption key and puts the data in the cloud SaaS provider's storage without the accompanying private key.

Effectively, that gives the ISP Zero Knowledge of what you are storing.  They don't have the private key--you do.  And, that also gives them 'plausible deniability' in not being complicit for any form of illegal activity as they can reliably assert no knowledge of what is in your files.

Also, this takes the pressure off of the ISP in acting as 'police' for governmental and powerful commericial concerns (RIAA and MPAA) who want to enforce for what types of activities people can or cannot engage in when using cloud storage.

What is happening today is a total breach of your right to privacy.

The solution, Zero Knowledge, is technically feasible and I might add being offered by several ISPs, such as SpiderOak and Wuala.

We, the U.S. citizenry, continue to watch as our constitutional rights erode.  The only tool we have to fight back against the growing incursion into all corners of our personal life is encryption.

I submit that Zero Knowledge for Cloud Storage be strongly lobbied as a Federal mandated piece of legislation.  Contact your Senator, Congressman and let them know you want Zero Knowledge for Cloud Storage enacted.

-- Dietrich

Related articles

• Six ways to protect yourself from the NSA and other eavesdroppers
• Google Drive Gets Failing Grade on Privacy Protection
• Reclaim Your Internet Privacy. Encrypt!
• Drink Your Ovaltine: Intro to Encryption 101

Read More

Microsoft Windows 8 Legacy: An Unacceptable Level of Risk

by Dietrich Schmitz

Microsoft Windows still dominates the U.S. business landscape.  No question there.

But on the consumer side of things, it's a different story.

Today, I discuss why it is vital for readers to understand the seriousness of the risk they assume by using Microsoft Windows.  In particular, I am referring to the 'Legacy' (x86) Windows 8 version and its predecessors. (Image credit: valuendo dot com)

If you are using Windows, please pay close attention as I show how you default to exposing yourself to a high level of risk, without even knowing it.

Legacy Windows NT Kernel

All of the bally-ho aside regarding the newest Windows 8 Modern UI, under the hood, Windows 8 still retains a WinNT kernel designed and written for Windows 2000.  That's right. Substantially, it inherits all rearward features necessarily to maintain compatibility with Enterprise and small business application needs.  And along with that inheritance comes a raft of security issues which continue to plague the operating system going forward.

Security Measures

Microsoft has seen fit to bolster their own application suite Office with their version of a protected mode sandbox.  I say 'their version' because it is mostly circumventable.  They also have 'feathered their own nest' by bolstering Internet Explorer, the default browser on Windows, with its own protected mode sandbox.  This is relying upon the same underlying technology to defeat security exploits.

The point to note here is that Microsoft has seen fit to provide security for their own suite of applications, but essentially leave third-party developers 'high and dry' to figure out how to secure their software solutions.

This is a big issue to my mind.  It should be the responsibility of the underlying operating system to provide default security measures, e.g., sandboxing to all third-party software.

Unlike Windows, Linux provides these security measures so that software vendors can focus on developing quality software.  Yet, to write for Windows, they necessarily need to become security experts.  That is just wrong.

It essentially places Microsoft's 'competition' at a distinct disadvantage as they need to allocate extra resources and 'know-how' to implement security sandboxing.  Google's Chrome for Windows does offer its own sandbox.

Despite of their best efforts, Google Engineers have documented and identified limitations on what their sandbox can do to protect you on Windows.  It is an admission to the underlying deficits in Windows' security design.  Regardless of what they do, their sandbox will still permit security exploits to escalate and gain Administrative rights to a Windows system.

When a security exploit succeeds in gaining Admin rights, it effectively can do anything it wants to a system.  The system is essentially 'owned' by the exploit and can embed itself in such a way as to 'hide' and fly 'below the radar' of Anti-Virus software going fully undetected as it executes its nefarious activities on your system.

Here is a formal statement from Google's own Engineers on the topic of security and their sandbox limitations on Windows:

Other caveats 

The operating system might have bugs. Of interest are bugs in the Windows API that allow the bypass of the regular security checks. If such a bug exists, malware will be able to bypass the sandbox restrictions and broker policy and possibly compromise the computer. Under Windows, there is no practical way to prevent code in the sandbox from calling a system service. 

In addition, third party software, particularly anti-malware solutions, can create new attack vectors. The most troublesome are applications that inject dlls in order to enable some (usually unwanted) capability. These dlls will also get injected in the sandbox process. In the best case they will malfunction, and in the worst case can create backdoors to other processes or to the file system itself, enabling specially crafted malware to escape the sandbox. 

I've highlighted in red the text which you should be concerned about--very concerned.

Security Ramifications

What does this mean?

Well, from the standpoint of what an operating system should do, once the exploit 'succeeds' in escalating to Administrative privileges, there are no other 'cross-checks' which will occur on Windows to policy check the SYSTEM calls made by the exploit.  It now has unfettered access and can do what it will with your system.

Unlike Windows, with Linux you have, for example, in the case of Fedora Linux, SELinux which if enabled will apply a policy to the Application in question to effectively 'police' all of its activities, including on the kernel (SYSTEM) level.  This is the needed cross-check which Windows x86 Legacy sorely lacks and is the ongoing source of attacks that will continue to provide a 'shooting fish in a barrel' environment.

In lieu of a solution, world-wide criminal activity that exploits Windows Legacy continues to grow unabated.

It is a most serious situation for both businesses and consumers.  Often the user visiting a compromised website won't even know their system has been compromised by a Drive By as it silently burrows into their system.

Lack of a Repository System

Windows Legacy applications are not protected by a repository system.  The purpose of the Linux repository is to house all vetted software applications and binary drivers and provide a GnuPG keyring secured 'fingerprint' of their authenticity and to assure that they have not been tampered with.

One of the many long-standing issues with Microsoft Windows has been the lack of a repository-based system, which opens up the possibility for users to venture 'into the wild' of the Internet to find various software.  When a user accepts and downloads one of these applications from the Internet, they are making an implicit decision to 'trust' that application.

When a user downloads, for example, a game, which in this example happens to be laden with an exploit which will spawn when the application starts, unbeknownst to the user, it is referred to as a Trojan Horse application.  It runs under various pretexts, including offering a game, a utility of some kind, even rogue security software pretending to protect your system.  They all include  a 'payload' which deploys on your system.

The point of a repository and one of the key benefits of open source is that 'many eyes' vet and review software for approval to be included in the repository, deemed safe to use and devoid of any malware or virus code.  This has been one of the corner stones of using Linux open source software.

Pwn2Own/Pwnium 2013

This year's CanSecWest Pwn2Own challenge drew more 'shooting fish in a barrel' so-called security experts to yet another annual challenge to attempt to compromise a Windows Legacy based system running with various browsers.  The results are here. Suffice it to say, it wasn't difficult for the challengers to exploit Windows, even Chrome with its sandboxing technology was fully compromised.

In a separate hall of the same CanSecWest convention was held Pwnium 2013, sponsored by Google and with a configured stock Chromebook.  The goal was to have security experts attempt to exploit the Chromebook system running ChromeOS, a Linux kernel based operating system written by Google for the Chromebook.

In stark contrast to Pwn2Own, there was no successful attempt to fully compromise the operating system.

This is quite emblematic of just how safe Linux truly is while Microsoft Windows security continues to leak like a colander.

Today, if you are using a Linux Distro with a kernel equal to or newer than version 3.5, you can run Google's Chrome browser and be assured that it will run in its own sandbox provided by the underlying operating system, Linux.  Chrome in this context uses not SELinux, but seccomp-bpf to provide the sandbox to your browser session.

Rest assured your Internet activities will be safe with seccomp-bpf and if you want to confirm that it is running, type into your Chrome browser bar this url:

chrome://sandbox

You should see this information:

Free Software Foundation Campaign

The Free Software Foundation has taken recently to running a rather aggressive campaign.
Go to the website and judge for yourself.  I hope the information helps you to make an informed decision that includes switching away from Windows to Linux.

FSF's Upgrade from Windows 8 Campaign

Conclusion

I hope at this point that you have gotten a better sense for the level of concern I have for using Windows 8 Legacy.  The risk is simply unacceptable on so many levels.

Please give Linux a try today and discover a whole new world of truly secure, sharing and openness.

This is what humans do best.  So, do the right thing.

-- Dietrich

Related articles

• Should Microsoft Kill Windows 8 Immediately?
• Microsoft partners say Windows 8 caused 'millions of customers' to switch to Apple
• 3 Ways Microsoft Can Save Windows 8
• BlackHat EU'13: Are You Playing Sandbox Roulette?

Read More

Pwn2Own 2013 Begins Today: Release the Hounds!

By +Dietrich Schmitz

The annual CanSecWest Conference begins today.  As has been tradition each year, a Pwn2Own contest will commence and run through Friday, March 8, 2013.

Hackers come each year to claim cash and other prizes for providing a successful 'proof of concept' exploit (crack) which demonstrates the ability to gain administrative control (system root) , of a given configured device running one of several browsers: Google Chrome, Mozilla Firefox, Apple Safari.

Read More

ChromeOS in the House at CanSecWest Pwn2Own 2013

Let it not be said that Linus Torvalds has any difficulty getting his point across.  We have witnessed his sharp, caustic, sometimes quite harsh 'shock jock' exchanges with both awe and respect many times over.

Charlie wins Apple via pwn2own (Photo credit: ggee)

Very recently, a 'chit chat' was had regarding SecureBoot routines possibly becoming part of the Linux Mainline Kernel which was met with a strong rebuttal from Linus who made it clear in no uncertain terms--no secureboot signing code in the kernel will ever happen.   NEVER!

Recalling another incident, a few years back, and this one is a 'classic', Linus Torvalds wrote:

Read More