US Emergency Alert System private SSH key mistakenly distributed(arstechnica.com) |
US Emergency Alert System private SSH key mistakenly distributed(arstechnica.com) |
Oh for fuck's sake. I hope Ars screwed up that email address. Sometimes I feel like regulatory capture has totally screwed our national defense.
I'm from Maryland. I know a lot of defense/NSA people. Some are fantastic. Others... let's just say not everybody is the best and brightest.
" Congratulations gentleman - you're everything we've
come to expect from years of Government training."
-- Zed, in "Men in Black"
Shorter lived keys and more frequent updates, provided you also have a secure way of authenticating the updates (hard) is often preferred.
Adding auxiliary data (comparable to X509 certificate usage restrictions only for code-signing or signing for emails) would allow you to have a (central hardened) machine hand out certificates to your "semi trusted" administrators that only allow login from a specific IP-address, to a specific target-system, up to a certain date or even time. Putting this functionality in a script (to acquire the certificate and login to a system) such a wrapper could most likely be used as a drop-in replacement for the normal ssh-client.
If your restriction is to use only the default openssh already deployed to the target machines, one quick solution to hide the critical private key from the developer/admin/service machines would be to place it on a (hopefully somewhat hardened) machine running the ssh-agent, and access the agent by creative use of tunelling. In essence then the hardened machine would act as a kind of "smartcard" for all your admins.
Then you go fix your legacy firmware.
Private keys without a passphrase are probably even riskier than passwords
Private keys with a passphrase had better have a hard passphrase or they'll just be bruteforced offline
A quick sum of all the incidents in there adds up to 22 million health care records lost so far. It's hard to imagine the government could do much worse.
In case you don't feel like importing the CSV file somewhere, https://docs.google.com/spreadsheet/ccc?key=0AkJeZCqH2PsHdDZ...
(Not modified except for column width and a final tally)
http://www.healthit.gov/providers-professionals/health-infor...
As a "broadcast-emitting-messages-company" admin: would I really upgrade a system, which functionalities include complete take-over of my broadcast equipment, that is vulnerable to someone mistaking the private and public ssh keys of his "taking-over-any-equipment" equipment ?
I'd rather un-subscribe from that "service" in the limit of legality until that point of failure is fixed.
Every EAS receiver is typically monitoring other stations in the area for EAS relay. We actually have a tuner tuned to another station in the market and if we hear an EAS alert go across the air on their station we simply relay it. Due to the FM capture effect, it's _very_ easy to attack this channel; especially because there's _zero_ authentication on these incoming "relay" messages.
Even worse, some types of messages are setup for "national relay." This system was tested recently to ensure that a message could be relayed like this from one end of the country to the other -- and yes, it can. So, if you construct the right type of message, you can have it broadcast over _every_ station in america.
Relayed across radio stations, TV ticker, and your weather radio.
Here is a bit of the specification: https://en.wikipedia.org/wiki/Specific_Area_Message_Encoding...
Its worse than that, unfortunately. About a decade before SAME started showing up on public for profit broadcasters, they had it on NOAA weather radio (you know, 162.4 MHz and several other channels in that area). So this has been around since the late 80s or so.
Well my bright idea was to latch on to the then popular craze in electronics magazines of make a project using a (then new) PIC, convince a magazine to run the article, sell my pre-programmed PICs to people, and retire to a private island (LOL... but I probably could have made my programmer pay for itself, at least). So I had a PC/AT class machine with a soundblaster 16 generating SAME codes using, if I recall, a BASIC program. The plan was a simple zero crossing detector and what amounts to a software "bit banged" UART and some UI code to drive a LCD module. Back when the PIC16 family was "new" this ended up not fitting, or at least my UI would have been ridiculously crude with little translation and filtering features so I dropped the whole thing. I could fit a really good UI in there or the decoder but not both and I didn't think a multi-chip solution fit the "standards" of the time. Now a days this would be a one chip PIC probably on an arduino shield with real analog input instead of zero crossing detector and all that, and enough space for a monster UI probably. The "target market" at the time was ham radio equipped storm chaser type guys who wanted a SAME radio for "them" rather than for fixed locations. Very travel and location oriented. Now a days of course they just use a smartphone and an app like proweatheralert or just the weather.gov webpage. I don't know if there's a startup lesson buried in here other than its possible to come up with an idea that greatly exceeds the technological limits of the day, not just at the super high end like big data, but also at the super low end.
Anyway the point is you'd have to ban virtually any post 1980's era stuff, including at least some pre-PC era home computers. A PC XT with an original soundblaster should be sufficient to encode SAME tones, its not like I was stressing out my old spare 286 while encoding test tones for my PIC based decoder.
The general development plan of a SAME encoder is about the same as a morse code sender. If you can figure out one, you can figure out the other. So you make a tone generating function. (and for SAME you need two tones, no big deal). Then you send the proper length of each aka a 1 bit transmitter. Then a function to send a whole byte at a time (big endian or little endian?) aka a 8 bit/1 byte transmitter. Then a function that eats a string and calls the byte sender for each byte of the string and optimistically stops when it hits the end of the variable length string. Then a function that eats some vaguely "human compatible" API and squirts out a line of SAME which is fed to the function above. And a zillion subroutines/function calls later, you get an audio SAME message. Making something that sends morse code is developed about the same way.
Its noob-compatible. No need for recursion, scalability is irrelevant, etc. As I recall the ancient PIC16 series didn't do recursion very well at the assembly language level.
1) .gov aka "G-job" means you can't talk about it, maybe even to your boss. Maybe you're making the left support bracket for the Manhattan project, no one in 100 miles knows what you're actually building. Maybe no one knows everything about the whole program. So you're kinda on your own in the machine shop, kinda.
2) Wanna build a model steam engine at work? Tell them the crankshaft is a classified part for some contract you can't talk about and they're not cleared to even see the blueprint.
3) But screwing around for fun doesn't have to be made to the tolerances for real a-bomb parts... So "close enough for govt work"
The other story I heard from oldtimers who were there, was there was an intense push in the early 40s to shovel as much out the door as possible. An automobile plant used to selling to rich dudes wouldn't dare ship a car with cosmetic issues, but tank crews don't care if there's a little weld splatter on the outside or runs in the paint, as long as it actually works in combat. And this created attitude issues when they converted back to making fancy cars for rich dudes after the war. "So there's a giant dent in the hood, the GIs don't care... Uh, yeah but we're not building jeeps anymore..."
If you do a google ngram search on the phrase, you'll see a blip during WWII and then nothing until 1970. I'm guessing the use from 1970 onwards probably carried the negative connotation we're all familiar with.
Euphemism for "standing around outside - a lot"Turns out the encoder was really easy to make using 1980s era stuff, but the tech required to pull off the decoder product greatly exceeded the technological/economic limitations of the time, so that's why the project failed. Oh well.
The point was a raid to eliminate fancy Java and GUIs and modern computers won't stop forbidden SAME encoders from being written, they'd actually have to raid and confiscate museum pieces.
It would be like trying to forbid DES-56 by getting rid of everything DES-56 capable. That's a lot more than year 2012 quad core pentiums, that includes my 25 year old HP-48 calculator...
Another interesting note is that I'm sure the security theater guys would like to calm people by claiming it takes millions of dollars and dozens of people and years of effort and top of the line modern high tech stuff to make a SAME encoder, but I did it alone as a poor yet smart kid using junkpile stuff decades ago in a ridiculously short amount of time. The only reason this doesn't get hacked on a regular basis, is despite the paranoid delusion that they're all out to get us, they actually are not, because they would have gotten us a zillion times over already, if "they" actually wanted to, which they obviously do not desire to do. Some lower forms of humanity profit off convincing people to be hostile toward each other, nothing new there.