Author Archives: Andrea Pasquinucci

It never happens to me :-(

Posted on by

ICT “Glitches” are smaller brothers of “Bugs” which in turn can become major security disasters. Well sometimes they can make us (the one benefitting innocently from the Glitch) happy or at least they can make us laugh. This case is quite notable: “Bank error makes restaurant manager the world’s first ever trillionaire (and he even offered to pay off the national debt before the glitch was spotted)”.

I am also addicted to this blog “IT Hiccups of the Week” which sometime reports on some very good discounts (due to some kind or another of Glitch) we just missed at our local supermarket.

On Trust and Security

Posted on by

Since a few months we have been reading and discussing the Snowden’s documents. Most of the information present in these NSA documents is not new since we have been discussing the possibility of similar facts at lenghts in many occasions. For example, years ago the modifications introduced in the cryptographic algorithm DES by the NSA led initially to suspicions: were they backdoors or algorithm improvements? (In this case later it turned out to be improvements.)

The real difference is that now we know that our worst suspicions in many recent cases were correct.

So what can or should we do? This is a very interesting and hard question since the main issue in my opinion is that we are mostly dealing with the possible introduction of backdoors in hardware and software, for example to weaken cryptographical algorithms. As normal, even if technical-savy, users we do not have personally the competences nor the resources to verify that all hardware and software we use, from mobile phone to super-computers, are clean of backdoors. So we have to trust third parties, in particular hardware and software makers, that hardware, operating systems, applications, libraries (in particular cryptographic libraries) etc. do not have hidden functionalities or backdoors.

This is not new, we trust car, train, airplane makers with our life, so we should also trust hardware and software makers with our information, or not?

Is our trust in today ICT companies well-founded?

I’m back

Posted on by

After a few months absence due to personal reasons, I am back to my blog. In the next days I will catch up with what has happened recently, sharing my comments and ideas.

Honeypot per Sistemi ICS/SCADA

Posted on by

L’idea di connettere ad internet un Industrial Control System (ICS/SCADA) fa sicuramente tremare i polsi a chi ha una minima idea di cosa possa succedere. Ben venga quindi l’iniziativa di TrendMicro di realizzare un Honeypot dedicato agli scan e attacchi ai device ICS/SCADA connessi direttamente a internet.

I risultati raccolti dall’Honeypot possono essere letti qui, e non mancano di farci paura. Infatti basta pensare a cosa potrebbe succedere alle centrali elettriche, idriche ecc. se fossero (ed in troppi casi già lo sono) connesse a internet, ma anche più semplicemente ai piccoli oggetti casalinghi che sempre più offrono la possibilità di essere controllati via internet da una App sul nostro smartphone.

Statistiche sulle Vulnerabilità

Posted on by

Secunia ha rilasciato il suo Vulnerability Review 2013 (qui c’è un breve riassunto) da cui risulta che la grande maggioranza delle vulnerabilità che hanno afflitto i sistemi Microsoft nel 2012 hanno avuto origine in applicazioni di terze parti quali flash, acrobat, java ecc.

E’ probabile che i numeri citati da Secunia siano corretti, ma la cosa importante è quale conclusione se ne trae. E’ ovvio che la presenza di vulnerabilità in qualunque applicazione è una mancanza, ma quello che personalmente mi preoccupa di più è che un sistema operativo, che per definizione ha come principale scopo quello di gestire le risorse hardware e software, quindi anche le applicazioni, possa essere sovvertito a causa non di una propria vulnerabilità interna ma di una vulnerabilità di una applicazione.

More Trouble for SSL/TLS

Posted on by

Besides CRIME, BEAST and Lucky13, two new attacks for SSL/TLS have been just announced. One attack exploits weaknesses in the RC4 cypher, which is used by most websites starting from Gmail, and many cryptographers had been thinking about this possibility for a long time, now they found out how. The second attack, called TIME; is a new timing attack, in part a refinement of CRIME.

As of today, both attacks are not practical, but they could become real threats in the future. Notice that the adoption of RC4 by many websites has been mostly to withstand BEAST attacks. Now that Lucky13 and this new attack aim at RC4, it is not clear what to do in practice.

Of course, we should seriously consider what to do with SSL/TLS and even more the CA model, but it will take a long time and I do not see among the big internet players, enough motivation or incentive to change the current situation.

You can find a summary description of these new attacks for example in this article by ArsTechnica.

More Evidence for the Higgs Boson

Posted on by

At the 2013 Moriond Conference, CERN has released more data indicating that the particle discovered last year is really a Higgs boson, and it looks more like the Standard Model particle we studied in text books, see here for CERN announcement.

The ATLAS experiment has also published here some very nice animated plots which show how the measured events slowly build up statistics which give the above mentioned results.