Another multi-core...

Tilera has come out of the closet. There is a good writeup about its 64 core processor here

Here is a snippet from the article:
"what will make or break Tilera is not how many peak theoretical operations per second it's capable of (Tilera claims 192 billion 32-bit ops/sec), nor how energy-efficient its mesh network is, but how easy it is for programmers to extract performance from the device."

I agree. And by focusing on the development environment, ability to run SMP Linux etc, Tilera has chosen to offer a smooth learning curve to software engineers. Although there are some design wins, it remains to be seen whether taking the first few steps on this curve offer a significant advantage over the wares sold by Tilera's competitors: Intel, AMD, Cavium, RMI and Sun.

There is another good article here. An interesting point about pricing:
"For a new entry into the market, Tilera priced its product with confidence: 10K-tray pricing is set at $435 for each Tile64 – which appears cheap, if it can replace ten Xeon processors. But in a real world environment, the processor is priced against a quad-core Xeon 5345 (2.33 GHz, 8 MB L2 cache), which currently sells for a 1K tray price of $455. "





Add to Technorati Favorites

Chief blogging officers debating NAC

"Chief Blogging Officers" at two security vendors have a highly technical and meaningful debate:

http://www.nevis-blog.com/2007/08/wondernac-i-lik.html
http://www.stillsecureafteralltheseyears.com/ashimmy/2007/08/more-on-the-won.html





Add to Technorati Favorites

Privacy@Google

While responding to concerns about privacy of those who use Google's services Eric Schmidt said that users worried about privacy can choose not to use Google's services. Not only does this response reflect sheer hubris on his part and alienate intelligent beings, it also sidesteps the real question "Should users of Google be worried about privacy?". Privacy international says YES.

Privacy international findings are here: http://www.privacyinternational.org/issues/internet/interimrankings.pdf





Add to Technorati Favorites

security research, rootkits and TPM

The recent highlight on security research has encouraged a lot of "security researchers" (although the term is a bit too generic...these people are actually "vulnerability researchers"). Today's software contains a lot of security bugs and these researchers find a lot of them. It is a good thing...it helps raise awareness of the problem and pushes the software vendors to fix these bugs.
The media limelight on these researchers also encourages "publicity stunts" and other "celebrity wars". Here is an example:
http://www.securityfocus.com/brief/537
http://www.matasano.com/log/895/joanna-we-can-detect-bluepill-let-us-prove-it/

I do believe that "theoretically" it is impossible to write an undetectable rootkit if the detection system is allowed access to the external world (network access is usually good enough). However, "practically" it is a contest between the rootkit engineer and the rootkit detector engineer. It is certainly possible although difficult to create a rootkit that will be very hard to detect. Similarly, it is possible but difficult to engineer a rootkit detector good enough to detect this rootkit.

Trusted Platform Module is a promising technology that might render the issue moot in the long run. However, TPM itself may have bugs in the beginning: http://www.networkworld.com/news/2007/062707-black-hat.html
I don't know why these guys withdrew...was it because they had found no exploits or were silenced by the TCG?

TPM may have some vulnerabilities in its specification and implementations of the specification will certainly have more. It is still a good technology because in a world with TPM bugs will be confined to a small area and therefore could be more easily found and fixed than in a world without TPM.



Add to Technorati Favorites

What is a Host IPS?

The term Host IPS is used mostly to denote endpoint software that monitors execution of applications and looks for intrusions. Interestingly, the term Host IPS implies the absence of signatures whereas the term network IPS generally implies the presence of them :) Of course, Host IPS is generally supposed to complement signature based anti-virus and contemporary network IPS's utilize more techniques in addition to signatures.

Most host IPS's use a mix of the following techniques to monitor program execution (sometimes called program "behavior"):
- intercept system calls
- intercept access to resources like registry, file system, libraries(DLLs)
- track origin of the code being executed
- execute the program in a sandbox...the extreme case is interpreting the program instruction by instruction instead of running it directly on the processor.

There are several compile time tools for making the stack difficult to overflow. These defend(not foolproof) against buffer overflows on a stack:
- stack guard
- stack shield
- stack ghost

...and a run time method
- program shepherding

Some commercially available Host IPS products are:
- McFee
- Cisco
- Symantec
- Determina



Add to Technorati Favorites

Methods for network based devices implementing data leak prevention

I wrote about data leaks before . A painful problem like this is an opportunity for some and we now have quite a few startups selling products to monitor data leaving a company's network for sensitive information. Vontu and Reconnex are a couple of them. Port Authority was another that was acquired by WebSense.
It is interesting to see how one can go about solving this problem. [Note: In this writeup I focus only on detecting leaks through the company's network. There is another ways in which information can be leaked: through storage devices like hard disks and USB flash. The techniques I mention here do not work for them.]
First we need to define sensitive data. A few items like social security numbers can be easily defined as regular expressions (ddd-dd-dddd, where d is a digit) and one can scan all network data for anything that looks like a social security number. But what about other information? We can apply the pattern matching approach to other structured information like patient records in a healthcare facility, account information in a bank etc. What about unstructured information like design documents or patent ideas communicated between team members in emails? It does not follow a pre-defined pattern. Is there a way of monitoring it? Fortunately, there is. One method is to use rabin fingerprints . Calculate these fingerprints for all potentially sensitive data and match it with the fingerprints calculated for network traffic. This method works well because even if the data was changed a little (like a section from a document was copy-pasted into an email etc) it is matched by the fingerprints.
An approach that combines pattern matching for known and/or structured data and fingerprinting for unstructured data works well in detecting unintended accidental data leaks in information passing through a company's network. A report says that 60% of the leaks reported so far are of this nature. So it is a useful approach. What about the other 40% intentional data theft? I will write about it another day but the first thing that will come into mind is to apply some kind of "locks" and "alarms". Locks in the digital world are cryptographic techniques and alarms are data access, modification and transmission logs.

[Some readers will note that I did not mention "watermarks". I consider that as a subset of structured data]




Add to Technorati Favorites

Sandboxes for false positives in IDS

Signatures have been an effective but not exhaustive method for threat prevention for a long time. In the early days there were issues with false postives, then there were shortcomings in dealing with polymorphic threats but these were due to "bad signatures" and sometimes performance tradeoffs. That is no longer true [I wrote about various IDS algorithms before]
However, as I said it is not an exhaustive method so it is often complemented by protocol anomaly detection and behavioral anomaly detection. Protocol anomaly detection(PAD) is a very reliable technique but a mere presence of an anomaly does not always indicate an intrusion. Behavioral anomaly detection(NBAD) is worse because it relies on unproven statistical models of network traffic and user behaviour. [Related reading ]. However, both of these methods are useful in locating "suspicious activity", protocol anomaly detection more so than behavioral. The challenge is to deal with the false positives they inevitably result in. A good solution to this problem is now available in atleast two commercial products: FireEye and CheckPoint's MCP which use "sandbox execution" of code extracted from anomalous traffic. The approach is in its infancy but is very promising because it is to intrusion detection what "blood tests"are to disease diagnosis. It has very low false positives and works against zero day threats. It is "expensive" because it requires a lot of computation if PAD and NBAD are used to narrow the search space of traffic, it can scale well.
I believe most commercial IDS/IPS and even anti-virus/spyware vendors will add this weapon to their arsenal this year. Thoughts?



Add to Technorati Favorites