Monthly Archives: April 2018

Windows 10 Lean – Microsoft’s essential step (back) to the future?

29 April 2018

The report “Windows 10 Lean: Latest build offers first glimpse of Microsoft’s new cut-down OS” (1) published by Liam Tung on 24 April 2018 at ZDNet made me really curios.

Why is the industry in desperate need of a cut-down Windows OS? To answer this question we need to dig into the history of computing.

Tandberg TDV 1200 Terminal. Picture Credits (2)

Tandberg TDV 1200 (2)

In the nineteen sixties and seventies IT business was largely based on host-based computing. Usually the end-user devices were character based terminals with very restricted functionality. Business reports or letters were a real challenge on a Tandberg terminal with IBM ISPF. Individual changes to the user interface were usually limited to the change of the highlight colors and the function key assignment.

Apollo Domain DN330 Workstation

Apollo Domain DN330 (3)

The introduction of server-based computing in the nineteen seventies was a significant benefit for the end users. Graphics-based workstations, often diskless, opened up new fields of application, e.g. desktop publishing, CAD or CAPE. Here, too, the users had only limited options to customize the user interface or to install applications.

With the introduction of Windows NT AS 3.1 in 1993 everything changed. For the first time an operating system had an easy to use graphical user interface, was easy to operate through this GUI , and had easy to use inbuilt peer-to-peer networking capabilities. This was the Wild West for the users.

Unfortunately, very often the Wild West ended up in chaos. With Windows 2000 everything was under control again. Server-based computing was the standard again, peer-to-peer networking capabilities were hardly used.

SAAS, e.g. O365, OneDrive, Sharepoint Online, Box for Business or Google’s G Suite, takes us eventually back to host-based computing: The cloud is the new host.

Once the industry has adopted SAAS every interaction with the cloud is based on the HTTPS protocol. SMB and all the client-server and peer-to-peer networking capabilities of Windows are no longer needed. Even for printing the IPP protocol can substitute SMB.

Thus it is time to eliminate these networking capabilities from the OS. And with this, we eliminate all this EternalBlue, EternalRomance, WannaCry and NotPetya stuff because lateral movement depends heavily on the Windows Peer-to-Peer networking capabilities.

Chrome OS is Google’s answer to this trend. Will Microsoft follow with Windows 10 Lean?

From Liam Tung’s report we learn:

“Windows 10 Lean was revealed on Twitter by Windows enthusiast Lucan, who noted the heavily cut-down OS has no wallpaper and is missing apps like Registry Editor and Microsoft Management Console, as well as drivers for CD and DVD drives.”

From my point of view that’s not enough to deal with the IT security challenges the industry faces today.

Have a great week.

  1. Tung L. Windows 10 Lean: Latest build offers first glimpse of Microsoft’s new cut-down OS [Internet]. ZDNet. 2018 [cited 2018 Apr 24]. Available from: https://www.zdnet.com/article/windows-10-lean-latest-build-offers-first-glimpse-of-microsofts-new-cut-down-os/

  2. Picture credits: Telemuseet, Wikipedia, https://digitaltmuseum.no/011025208286/datautstyr

  3. Picture credits: Jim Rees, Wikipedia, https://commons.wikimedia.org/wiki/File:Dn330.jpg

US Gas Pipelines Hit by Cyber-Attack

15 April 2018

The report “US Gas Pipelines Hit by Cyber-Attack” (1), published on April 13, 2018 in Infosecurity Magazine, sounds more dramatic than it actually is. The attackers compromised a system for “electronic data interchange” (EDI) to some of the largest US energy providers. No impact on critical infrastructures, at least until now.

Bloomberg Technology (2) reports that at least four US pipeline companies were affected by the attack.

What surprised me was that Jim Guinn, managing director and global cyber security leader for energy, utilities, chemicals and mining at Accenture Plc, said (2):

 

“There is absolutely nothing of intrinsic value for someone to infiltrate the EDI other than to navigate a network to do something more malicious. All bad actors are looking for a way to get into the museum to go steal the Van Gogh painting.”

I cannot support this. The EDI system contains the access details to the systems used in the customer networks for data exchange. These details are the free admission ticket to the customer networks for the cyber-criminals.

Thus, it is very important that at least the access data to customer systems are changed directly after an attack is detected. In addition, the customers should check their networks for suspicious data transfers and indicators for lateral movement.

Have a good weekend.

1. Muncaster P. US Gas Pipelines Targeted in Cyber-Attack [Internet]. Infosecurity Magazine. 2018 [cited 2018 Apr 13]. Available from: https://www.infosecurity-magazine.com:443/news/us-gas-pipelines-hit-by-cyberattack/

2. Malik NS, Collins R, Vamburkar M. Cyberattack Pings Data Systems of At Least Four Gas Networks. Bloomberg.com [Internet]. 2018 Apr 3 [cited 2018 Apr 15]; Available from: https://www.bloomberg.com/news/articles/2018-04-03/day-after-cyber-attack-a-third-gas-pipeline-data-system-shuts

RYZENFALL, MASTERKEY, FALLOUT, CHIMERA – Don’t Panic!

3 April 2018

CTS-Labs publication (1) of new branded security flaws in AMD’s latest Ryzen and EPYC processors attracted much media attention.

Much Ado About Nothing

Much Ado About Nothing. Made with WortArt.com.

Two facts on RYZENFALL, MASTERKEY, FALLOUT and CHIMERA:

  • In all cases the attacker requires administrative access to exploit the processor flaws.
  • For exploitation of MASTERKEY the attacker needs to re-flash the bios.

For a good overview see post ‘AMD Flaws’ (2) in the Trail of Bits blog.

To put it succinctly:: An attacker managed to fully compromise a system based on an AMD Ryzen or EPYC processor and to stay undetected. Then he starts exploiting Masterkey, flashes the BIOS and reboots the system. As a result he gets directly detected.

That makes no sense. Once I fully compromised a system I have plenty opportunities to run a deep dive into the victim’s network and, to stay undetected. The risk of getting detected when exploiting e.g. MASTERKEY is just too high.

The world of threat actors can be divided in two classes: Non-Nation State Actors and Nation State Actors. In particular MASTERKEY fits perfectly in the cyber weapon arsenal of the latter because only they have the resources to compromise the processors where it is most convenient, in the supply chain.

I don’t like branded vulnerabilities because they keep us from dealing with really important security issues.

Have a great week!

  1. CTS-Labs. Severe Security Advisory on AMD Processors [Internet]. AMDFLAWS. 2018 [cited 2018 Apr 3]. Available from: https://safefirmware.com/amdflaws_whitepaper.pdf

  2. Guido D. “AMD Flaws” Technical Summary [Internet]. Trail of Bits Blog. 2018 [cited 2018 Apr 3]. Available from: https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/