So... #spectre and #meltdown.

Both are triggered by malicious code running on the same hardware as you.

Mitigation means don't put anything important on shared hardware (read: avoid VPSes) and run NoScript or the equivalent in your browser.

Weren't those security best practices already?

Yes, this is a nightmare for VPS providers and worrying for those who placed their trust in virtualization. But the tinfoil-hat brigade has been assuming such bugs existed for ages.

Am I missing anything?

@HerraBRE One OS instance per hardware has been a "security best practice"? No. I don't think it was. And ordinarily it shouldn't be.

@paco The security best practice I speak of is:

"Don't share hardware with untrusted strangers who can run arbitrary code and try to attack your hypervisor or local network."

Of course you should use all the compartmentalization tech that is appropriate for your use case. Even if they can be attacked, it raises the bar.

@HerraBRE Never share hardware with strangers? Seems too blunt.

At face value that would prevent using any cloud infrastructure at all wouldn't it? Seems like it might make SaaS services problematic too.

I don't think I've seen that sort of principle put forward as a best practice. I don't see how you could follow that principle in 2018.

@paco @HerraBRE hi. We keep all sensitive stuff on bare metal. In 2018, just like we did in 2017. And 2016. And before.

So, yeah.

@rysiek @HerraBRE
Why? To what benefit? What attack is on your threat model that is defeated by that design choice?

Follow

@rysiek @HerraBRE The date on this advisory is yesterday, and note that at that time 90+% were already done worldwide. Who patches faster than that? aws.amazon.com/security/securi

· · Web · 0 · 0 · 0

@paco @HerraBRE that is completely missing the point.

The point is not how fast AWS patched their systems for this. The point is since we were using bare metal in the first place, we were basically not affected in any way.

As in, there was no possible malicious co-tenant on the same hardware that could have extracted anything from our memory space.

Because all memory space is our memory space.

On our bare metal.

@HerraBRE @paco you do realize, I'm sure, that the vulnerability was there way before GPZ discovered it and vendors started working on the fix.

And during that time AWS, Azure, all other Cloud platforms were vulnerable, and their users open to malicious co-tenants.

But again, not on bare metal.

@rysiek @HerraBRE I understand it was there for 20 years. Like the OpenSSL and bash bugs that were old when they were discovered. Do you think it was being actively exploited but somehow nobody knows? It's all been hushed up? Or was it perhaps not actually exploited? I have no idea, myself. But it seems hard to believe that it was being exploited a lot for 6 months, but nobody knew.

@paco @rysiek We'll probably never know, unless some too-big-to-keep-secrets agency was using it and proof gets leaked.

If you've got an 0-day like this, you will keep it real quite and use it sparingly on high-value targets.

@paco @HerraBRE I would not be surprised if it had been actively exploited, yes.

The NSAs and FSBs of this world have budgets way bigger than GPZ. And this is exactly the kind of clandestine, effective vulnerability that nobody expects which the three-letter-agencies love the most.

@rysiek @HerraBRE It's impressive that you've built a data centre that withstands the NSAs and FSBs of this world. If that's your threat model and you've countered it, that's pretty impressive. You must be confident that you've countered that threat better than the cloud providers can, too, which is all the more impressive. I don't know many smal businesses that run data centres capable of resisting the 3-letter-agencies.

@paco @HerraBRE I appreciate your stinging sarcasm there; however I must point out that no-where have I claimed we can resist three-letter-agencies in general.

Nor are we confident we can always protect stuff (on the technical level) better than large providers. Not using their services, however, solves other (non-technical) issues.

@rysiek @HerraBRE
My point is this: security people often reach for the agency threat when they talk about reasons to use bare metal. It's the ONE threat that bare metal seemingly solves. But bare metal ONLY solves that threat if you ALSO do a long list of other expensive security controls. So, given that you probably AREN"T defeating the agencies, what's the point of bare metal? The NSA/FSB threat isn't an interesting security discussion. Nobody (on here) is really designing to defeat them.

@paco @HerraBRE Agency threat (and APTs, and HackingTeams and Gamma Internationals of this world) are one.

Legal threats are another issue using bare metal helps mitigate, at least partially.

@paco @rysiek @HerraBRE you guys suck i had 'defence in depth' on my bingo card. I thought i was going to win 😢

@finux @HerraBRE @paco so let me get this straight:

1. you played bingo
2. you lost
3. you complain about it
4. and it is us who suck?

:P

@rysiek @paco @HerraBRE what else was i suppose to do whilst waiting for the NSA to hack my bingo machine host in my own private AWS

@finux @rysiek @paco Defense in depth dictates avoiding bingo and other gambling.

The house always wins and attacks only ever get better. 😜

@HerraBRE @finux @paco unless...

Unless we put the bingo on Blockchain! In spaaaaaaace!

@rysiek @paco @HerraBRE problem is the bingochain is now 30% longer than it could have been

@rysiek @paco @HerraBRE all jokes aside you guys all made some valid points. In the end i use cloud services to move traffic around and keep services up, but yes i'm paranoid to make sure some of our more sensitive data stays at 'home'. I'm personally of the opinion that most of the attacks we face are not coming from someone dedicated to pwning us, but just pwning something

@finux @rysiek @paco It's a truism, but understanding your threat model is where it all starts.

Your statement is true for lots and lots of people, but obviously not everybody.

Binary thinking in security is usually wrong. Being a little bit insecure is usually fine, nothing is perfect. Which threats you address first and how depends on your needs.

@HerraBRE @rysiek @paco generally speaking our threats are really no different from anyone else managing consultants on the road, however from time-to-time that changes depending on the client. Basically it's important to remember that 'every individual is an exception to the rule' - stolen from Jung but it works

@HerraBRE @finux @rysiek Right. That's why I get annoyed at the NSA/FSB argument for avoiding cloud. Nobody is really thinking that way. Very few orgs are engineering their data centres or their clouds with defeating an agency as a primary goal. So when I ask "why avoid the cloud?" and the answer comes back "Spooks" it's frustrating. That's not a reasonable conversation. The person saying that is usually not doing enough to avoid spooks on premises. So there's no point bringing it up WRT cloud

Show newer
Show newer
Show newer

@paco @HerraBRE

Nevertheless, we do our own threat modelling and make decisions that seem best for us.

One of them was going bare-metal for sensitive stuff.

This decision has been validated by #Meltdown and #Spectre.

@paco @HerraBRE so at this point I am kind of at a loss trying to understand what your point is.

Is it that "tree-letter-agencies can get into anything, so why use bare metal"? If so, my question is: do you use SSH? Why not Telnet?

@rysiek @paco Exactly. By using bare metal you have eliminated an entire class of attacks.

There will be more bugs like this.

Security professionals know this and have known for a long time. Thus my claim it was a standard best practice, albeit one that has costs not everyone could justify.

That math has shifted now, more people will justify the expense. Not all, but more.

Sign in to participate in the conversation
Mastodon.org.uk

General purpose mastodon instance