Friday, May 16, 2008

A major security hole was discovered in the pseudo-random number generator (PRNG) of the Debian version of OpenSSL. OpenSSL is one of the most used cryptographic software, that allows the creation of secure network connections with the protocols called SSL and TLS. It is included in many popular computer programs, like the Mozilla Firefox web browser and the Apache web server. Debian is one of the most used GNU/Linux distributions, on which are based other distributions, like Ubuntu and Knoppix. The problem affects all the Debian-based distributions that were used to create cryptographic keys since the September 17, 2006. The bug was discovered by Luciano Bello, an argentine Debian package maintainer, and was announced on May 13, 2008.

This vulnerability was caused by the removal of two lines of code from the original version of the OpenSSL library. These lines were used to gather some entropy data by the library, needed to seed the PRNG used to create private keys, on which the secure connections are based. Without this entropy, the only dynamic data used was the PID of the software. Under Linux the PID can be a number between 1 and 32,768, that is a too small range of values if used to seed the PRNG and will cause the generation of predictable numbers. Therefore any key generated can be predictable, with only 32,767 possible keys for a given architecture and key length, and the secrecy of the network connections created with those keys is fully compromised.

These lines were removed as “suggested” by two audit tools (Valgrind and Purify) used to find vulnerabilities in the software distributed by Debian. These tools warned the Debian maintainers that some data was used before its initialization, that normally can lead to a security bug, but this time it was not the case, as the OpenSSL developers wrote on March 13, 2003. Anyway this change was erroneously applied on September 17, 2006, when the OpenSSL Debian version 0.9.8c-1 was released to the public.

Even though the Debian maintainer responsible for this software released a patch to fix this bug on May 8, 2008, the impact may be severe. In fact OpenSSL is commonly used in software to protect the passwords, to offer privacy and security. Any private key created with this version of OpenSSL is weak and must be replaced, included the session keys that are created and used only temporary. This means that any data encrypted with these keys can be decrypted without a big deal, even if these keys are used (but not created) with a version of the library not affected, like the ones included in other operating systems.

For example any web server running under any operating system may use a weak key created on a vulnerable Debian-based system. Any encrypted connection (HTTPS) to this web server established by any browser can be decrypted. This may be a serious problem for sites that requires a secure connection, like banks or private web sites. Also, if some encrypted connection was recorded in the past, it can be decrypted in the same way.

Another serious problem is for the network security software, like OpenSSH and OpenVPN, that are used to encrypt the traffic to protect passwords and grant the access to an administrative console or a private network protected by firewalls. This may allows hackers to gain unwanted access to private computers, networks or data traveled over the network, even if a not affected version of OpenSSL was used.

The same behavior can be applied to any software or protocol that use SSL, like POP3S, SSMTP, FTPS, if used with a weak key. This is the case of Tor, software used to offer strong anonymity on the TCP/IP, where about 300 of 1,500-2,000 nodes used a weak key. With 15-20% of weak Tor nodes, there is a probability of 0.34-0.8% circa to build a circuit that has all tree nodes weak, resulting in a full loss of anonymity. Also the case of only one weak node begin used may facilitate some types of attack to the anonymity. The Tor hidden services, a sort of anonymous public servers, are affected too. However the issue was speedly addressed on May 14, 2008.

The same problem also interested anonymous remailers like Mixmaster and Mixminion, that use OpenSSL to create the remailer keys for the servers and the nym keys for the clients. Although currently there is no official announcement, at least two remailer changed their keys because were weak.

Tuesday, November 24, 2015

MV Suilven, a ferry in service in Fiji, capsized and sank in Suva Harbour today.

Around thirty people, all crewmembers, were on board. Local media report all were rescued. The 41-year-old vessel previously saw service in Scotland and New Zealand.

The ship capsized early this afternoon and sank within an hour. It had been converted from passenger to cargo use following its most recent sale, to Venu Shipping in 2012 or 2011. Local reports indicated police, the Navy, local tug boats, and volunteer rescuers all attended the accident.

The converted ferry reportedly began to list on entering the harbour. It was working a route carrying cargo between Suva and the Northern Division.

Built in Norway, in service from 1974, the ship served with Scottish ferry firm Caledonian MacBrayne until 1995, connecting the mainland town of Ullapool to Stornoway on the Isle of Lewis. It was ultimately replaced by a larger, faster vessel and was sold to Strait Shipping who used it until 2004 to ply New Zealand’s seas, connecting Wellington to Picton and to Nelson.

The name MV Suilven is in reference to the Suilven mountain in Scotland’s Sutherland region.

Wednesday, August 23, 2006

“18 hours of mass hysteria” (according to the Sunday Times of India) broke out last Friday in Mumbai as hundreds of residents flocked to Mahim Creek, one of the most polluted creeks in India that receives thousands of tonnes of raw sewage and industrial waste every day after reports that the salt water had suddenly turned “sweet”.

Television reports showed people drinking water on the spot with their hands, and others bathing, apparently to wash away their sins with the “holy” water.

At the height of the hysteria, bottled mineral water was selling for Rs 50 (RM4.50), with people buying the mineral water simply for the bottles, pouring away the mineral water and filling the bottles with water from the creek.

News reports of the Mahim Creek incident sparked further mass hysteria at Gujarat within hours, with residents there claiming that seawater at Teethal beach in Valsad had also turned sweet. About 400 people had gathered by the beach in the evening.

In the aftermath of the incident, local authorities stated that they were being were extra vigilant because of the possibility of a severe outbreak of water-borne diseases, such as gastroenteritis as a result of so many people drinking contaminated water. The Maharashtra Pollution Control Board had warned people not to drink the water, but despite this many people had collected it in bottles, even as plastic and rubbish had drifted by on the current. The Municipal Corporation of Greater Mumbai had ordered a bacteriological report into the “sweet” water, but suspected that “contamination in the water might have been reduced due to the waters from Mithi River flowing into the mouth of Mahim Bay“.

By Saturday morning, the hysteria had died down, as the taste of the water had returned to normal.

Sunday, June 19, 2005

The Indianapolis Formula One Grand Prix descended into farce when just six cars started the race on Sunday. The problem arose when Michelin discovered that its tires were incapable of more than ten laps at race pace.

The first indication of trouble was when the rear left tire of Ralf Schumacher’s Toyota racecar exploded during practice on Friday. Schumacher’s car collided with the track wall while travelling at 300 km/h (approx. 186 miles/h), leaving him shaken but generally unharmed. However, further investigations by Michelin revealed that another ten tires had suffered problems, with one also failing on track.

All the problems occurred on the rear left tire during the two long 90 degree corners leading onto the main straight. The nine degree banking and grooves cut into the surface of the track compounded problems.

It is believed that Michelin may not have properly accounted for the grooves cut into the Indianapolis track to improve grip for Indy cars after the track was resurfaced. Indy cars have smaller down-force generating wings so need more grip from their tires than Formula One cars.

Bridgestone, the other tire manufacturer currently in Formula One, did not have similar problems. It is possible that their US subsidiary, Firestone, who supplied tires for an Indy car race after the resurfacing, may have sent information back to their Formula One tires department in Japan. The three teams running Bridgestone tires – Ferrari, Jordan and Minardi – were therefore able to compete without any safety concerns.

Under FIA racing regulations, the only course of action was for the Michelin runners to withdraw from the race on safety grounds. Rules prevented alternative tires from being flown from France overnight, although Michelin were unsure whether these tires were also affected by the problem.

Drivers and teams had also suggested building a chicane to slow cars down between the corners, but Ferrari opposed the idea, and ultimately the FIA rejected the idea under regulations.

Actually the FIA rules states that the tyres manufacters should provide two sets of tyres for the race. One normal, optimized for performance, and one optimized for safety, to be used when the normal one set could not be used. In this case the safe set was not present.

The 123,000 fans watching from the stands were unaware of the farce unfolding below them until the parade lap before the race.

The fourteen Michelin runners peeled off into the pit lane rather than take up their starting positions on the grid. However, at least one driver, David Coulthard told his team that he was willing to race on the tires in question, had the decision been left up to him.

Fans jeered and booed as they realised what was happening, and a small number began throwing bottles and cans onto the track.

Rubens Barrichello, in a Ferrari, ran over one bottle of water at high speed which exploded in a spray of droplets.

Fans started stamping in the stands on the finish line straight, causing them to shake.

A British ITV filmcrew spoke to some fans. “I paid $85 for three-day ticket. I travelled nine hours from Baltimore to be here. Indy cars wouldn’t do this. NASCAR wouldn’t do this. I’ll never attend a race again – only watch on TV.”

Other fans had travelled from Mexico and Panama to watch the race, and said they wanted refunds.

A Police Captain also talked to ITV, saying he’d never seen fans as angry as this before. If trouble flared, they could call on 400-500 officers from local and state police, Indianapolis Police Department and the FBI under contingency plans.

The race was eventually won by Michael Schumacher from his Ferrari teammate Rubens Barrichello. Jordan’s Tiago Monteiro finished third. Despite what was clearly a one-manufacturer race for the win, both Ferrari drivers did indeed race one another hard, with them almost colliding following Schumacher’s exit from the pit lane after his second pitstop, with Barrichello having to take to the infield to avoid spinning off. Following the race, the two drivers did not speak.

Wednesday, April 26, 2006

Six workers in the post office in Hueytown, Alabama developed breathing problems and 23 were sent to the hospital after a chemical used in the manufacture of fishing lures leaked from a package.

The post office, located five miles west of downtown Birmingham, Alabama, was evacuated, and Hueytown firefighters in hazardous materials attire inspected the chemical. The chemical was found to have leaked from an inadequately designed package, evaporated quickly leaving a garlicky scent, and discolored the flooring tile in the post office. Workers complained of symptoms ranging from breathing difficulties to vomiting to burning in the throat.

The chemical was later identified as “J.J.’s Magic,” a yellow dye for soft plastic fishing lures which contains garlic oil as a fish attractant. The manufacturer confirmed that a two-ounce bottle of the product was sent to a customer in suburban Birmingham and speculated that the container may have cracked in transit.