diff --git a/CNAME b/CNAME deleted file mode 100644 index 8da5337..0000000 --- a/CNAME +++ /dev/null @@ -1 +0,0 @@ -blog.invisiblethings.org diff --git a/README.md b/README.md index cc7ab44..cebb8d4 100644 --- a/README.md +++ b/README.md @@ -1,95 +1,140 @@ -Welcome to my git-based (not necessarily GitHub-based!), decentralization-friendly, -liberated, and integrity-protected blog and website! +Welcome to my n-test for a decentralization-friendly, and integrity-protected publishing tool! +I got attracted by the GitHub Page of a developer that I think have been +baking great free software in the past, so I tought it is worth to give a try to +a git-based gpg-signed content repo, that she is using. + +Some of the details that she reports ... just don't make sense to me. +So I'm exploring them (again). Maybe doing it I get a clue. + About Me ========= -My name is Joanna Rutkowska, I lead the [Qubes OS](https://qubes-os.org) -project and [Invisible Things Lab](http://invisiblethingslab.com) (see -[about.md](/about/) and [contact.md](/contact/) for more info). +See [about.md](/about.md) and [contact.md](/contact.md) for more info. About this Website/Blog/Repo -============================= +============================ + +I've never had a blog before. To expose what we already +do everyday, in every and each human context, since the first monkey +learned how to talk, is ... reduntant. Wasteful. + +To tell you the whole truth I had some sort of blog a bit before +Google popped up, around year 2000: the reason was that I had +the need to practice some advanced Perl (or PHP, can't remember) +programming so I packed togeter an opinion-spitting tool. +After 6 months I asked myself: 'do the world really needs my opinions?', +the answer has been 'No'. And because the Perl part was ok, +I turned the pages down and kept working in the machines room. +The Perl part was working but the whole thing contained 2 articles. + +I did my best to stay away from the marketing departments until 2006, +when I figure out that the whole country was spending in marketing... only. +Then I addressed that problem for 2 years. Without results, sadly. + +At this point in time - 2015 - I'd like to understand whether git-publishing +might help to solve some of the issues I've seen at that time, or not. +Indeed the best part are the internals - git on top of zfs seems redundant - +but I keep them last to enjoy more at the end. -This blog is a continuation of my "Invisible Things Lab Blog", [previously -hosted](http://theinvisiblethings.blogspot.com/) on Google's Blogger platform -for 8 years between 2006 until the end of 2014. Read [this -post]({% post_url 2015-02-09-my-new-git-based-blog %}) to understand why I decided -to migrate away from Blogger, and why I consider it important to have this blog -distributed as a git-repo. Content of this repo --------------------- -* All the Invisible Things blog posts (in the [_posts/](/blog/) directory) -* [Contact info](/contact/) and my [GPG keys](/keys/) +* My experiments. +* [Contact info](/contact.md) and my [GPG keys](/keys.md) * Other info about myself and my work + Distribution and hosting -------------------------- +------------------------------ -This blog/website is distributed as a git-repo, and is primarily hosted on my +This is distributed as a git-repo, and is primarily hosted on my GitHub account. You should be able to clone it using the following command: - git clone https://github.com/rootkovska/rootkovska.github.io + git clone https://github.com/mfp19/mfp19.github.io You can also view the sources at GitHub online -[here](https://github.com/rootkovska/rootkovska.github.io). - -This blog is also available for traditional Web-based viewing via the following -URL (which is likely how you're reading it now): - -* http://blog.invisiblethings.org/ +[here](https://github.com/mfp19/mfp19.github.io). -That URL might change in the future, as well as alternative ones might be added. +As soon as I can figure out how to decentralise the whole thing, alternative URLs might be added. One can get notifications about new posts/updates via: -* The blog's [RSS feed](/feed.xml) -* [My Twitter Account](https://twitter.com/rootkovska/) -* [My GitHub Account] (https://github.com/rootkovska/) +* The [RSS feed](/feed.xml) +* [My GitHub Account] (https://github.com/mfp19/) -Integrity protection ---------------------- +(WiP) Integrity protection +-------------------------- -This blog/repo is integrity protected using [git +This repo should be integrity protected using [git tags](https://www.kernel.org/pub/software/scm/git/docs/git-tag.html) digitially -signed with [my blog-signing key](/keys/). In order to verify the +signed with [my signing key](/keys/). In order to verify the authenticity of all or any of the posts, you can use the following command: $ git describe --exact-match HEAD $ git tag -v -(In)dependency on GitHub -------------------------- +But you can't. Because I'm not using any key. + + +(WiP) (In)dependency on GitHub +------------------------------ While this repo is hosted on GitHub, and some GitHub-specific features are exploited in order to make this more available to a wider audience, specifically GitHub's support for [Static Web Hosting](https://pages.github.com/), it should be stressed that neither -availability nor integrity of this blog requires one to use or trust GitHub. +availability nor integrity of this text requires one to use or trust GitHub. + If, for some reason, GitHub, or an ISP, or whoever in between, decided to -block, falsify, or censor this blog, there are dozens of alternative ways of -how this repo (blog) could be delivered, e.g. via Tor or other transports, and -thanks to using git signed tags, its integrity could be always verified. All -the documents contained in this repo (apart from the old Blogger posts which -have been converted automatically) have been created with an assumption to be -easily readable using just a standard text editor or viewer. +block, falsify, or censor this text, there are dozens of alternative ways of +how this repo (text) could be delivered, e.g. via Tor or other transports, and +thanks to using git signed tags, its integrity could be always verified. + +In theory. + +In practice current policies are made to enforce accountability of everything that goes +from kids parenthood, to insurances backtracking. Not to enforce anonimity. + +Basically in some jurisdictions if you use Tor, you get monitored, by design. +Some Tor nodes are run by gov agencies themselves, not by volunteers. +Volunteers that have bootstrapped those tools have already been greylisted. +Companies that tried to resist search orders got fined, and individuals running those +businesses clamped and locked. This was the picture at the end of 2011. + +And, if you've been involved in some sort of judicial case even worse, examples: +* Assange is in the Ecuador embassy in London; English are very loyal but ... he can't move. +* Snowden is in Russia; Russians have been gentle but ... he can't go back home. + +And this is nothing compared to people living in war zones and alike (ex: bad suburbs). + +We were unable to support our own safety: + +* to obfuscate the TCP/IP process of selecting best paths in a network; ie: to use Tor. +* to obfuscate your identity; ie: avoid registries, accounts for silly toys, and so on. + +In theory "there are dozens of alternative ways of how this repo (blog) could be delivered", +Rutkowska says. In practice, considering the UN/NATO policies of the past 15 years, there aren't. +Not... for everyone (cfr. RFC3271). + Patches or pull requests welcome! ---------------------------------- -If you find spelling, grammar or other errors in my blog posts, and feel like +If you find spelling, grammar or other errors in my texts, and feel like correcting them, please send me a patch like you would do for any other git-based software project. Thanks! + License/Copyrights ------------------- -This Blog and Website by Joanna Rutkowska is licensed under a [Creative Commons +This text by mfp is licensed under a [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International -License](http://creativecommons.org/licenses/by-nc-sa/4.0/). +License](http://creativecommons.org/licenses/by-nc-sa/4.0/) +inherited by the original author. diff --git a/_config.yml b/_config.yml index 9da3cca..200186a 100644 --- a/_config.yml +++ b/_config.yml @@ -1,8 +1,9 @@ # Site settings -title: The Invisible Things -url: "http://blog.invisiblethings.org" +title: mfp19 - adults only +url: "http://mfp19.github.io" # Build settings -markdown: redcarpet +# markdown: redcarpet +markdown: kramdown redcarpet: extensions: ["tables", "autolink", "strikethrough", "fenced_code_blocks"] diff --git a/_includes/footer.html b/_includes/footer.html index 7fbdcb3..c813955 100644 --- a/_includes/footer.html +++ b/_includes/footer.html @@ -5,16 +5,14 @@

- Joanna Rutkowska
- Qubes OS & - Invisible Things Lab
+ Blog template by Joanna Rutkowska

Blog RSS feed
- Source of this blog
+ Source of this blog

diff --git a/_posts/2006-05-12-svv-source-code-made-public.html b/_posts/2006-05-12-svv-source-code-made-public.html deleted file mode 100644 index b573e6a..0000000 --- a/_posts/2006-05-12-svv-source-code-made-public.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: SVV Source Code Made Public! -date: '2006-05-12T09:13:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:18:18.060+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-114741804664138609 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/05/svv-source-code-made-public.html ---- - -I decided to publish the full source code of my System Virginity Verifier. The license grants you to do anything with the code, including using it in a commercial product.

Unfortunately I don't have time to further develop SVV, but I still believe that this is the right approach for system compromise detection (which still requires lots of work to be put into it though). It's actually very surprising for me to see only one another product which uses similar idea for detecting system compromises, that is Microsoft's Patch Guard.

I hope that publishing SVV source code might be useful in two situations:

First, it should help to reduce implementation specific attacks, as used by malware against rootkit detectors (remember holly_father's shop?). Having the sources allows anybody to compile his or her own private detector, a little bit different from the one which is targeted by malware's anti-detection engine. This might include changing I/O interface between usermode and kernel mode component of the detector, changing the order of certain actions, etc...

The above statement applies actually not only to SVV, but to any other rootkit/malware detector with open sources.

Second, I hope that having SVV sources opened can encourage people to extend the subset of the sensitive OS elements which are verified by SVV, thus minimizing the "hooking space" which can be used by malware. This should consequently eliminate simple, yet annoying malware from the market...

SVV sources and some presentations about its design can be found here. \ No newline at end of file diff --git a/_posts/2006-05-17-confidence-2006-trip-report.html b/_posts/2006-05-17-confidence-2006-trip-report.html deleted file mode 100644 index 46a8020..0000000 --- a/_posts/2006-05-17-confidence-2006-trip-report.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: CONFidence 2006 - trip report -date: '2006-05-17T11:36:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:18:32.382+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-114785969931002588 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/05/confidence-2006-trip-report.html ---- - -I've just come back from a small conference in Krakow, CONFidence 2006. It was the second edition of this security conference, which is organized by a non-profit organization, PROIDEA, whose primary goal is to promote education in computer science. Apart from CONFidence, they also organize conferences focused on BSD systems and various training courses.

Below I describe some of the talks that I found particularly interesting among those which I managed to see...

Pawel Pokrywka gave a very interesting talk about security issues with DSL infrastructure as used by one of the biggest polish ISP. He discovered the auto-configuration protocol which is used to setup every single DSL modem of that company. He then prepared modem-emulator script which allowed him to get the configuration data (including username and password) for any modem in Poland he wanted. This could allowed an attacker to actually 0wn all the DSL modems belonging to this operator! It was the best presentation in my opinion, not only it was technically interesting, but also was very well presented.

Lukasz Bromirski is a system engineer in Cisco Poland and is a very popular speaker at polish conferences. He gave three (!) lectures there, about BGP Blackholing, Dynamic Routing Protocols (OSPF and BGP) and one more about network attacks on L2 and L3 levels. Lukasz turned out as a very knowledgeable and experienced network engineer who is also a good presenter.

Przemyslaw Frasunek is another frequent speaker at Polish conferences. He is a well known BSD expert, but his talk was about Bluetooth security. Although it wasn't kind of an '0day talk', I think it was a good introduction to Blootooth stack and several basic attacks and was very professionally presented.

I also liked the two talks presented by the members of the Security Team of Supercomputer-Network Center in Poznan. Blazej Miga talked very deeply about Apache architecture and internals, while Jaroslaw Sajko demoed how to write extension modules for IPTables. This team got lots of media attention in Poland last year, after they found several critical bugs in Gadu-Gadu, the most popular Polish IM communicator.

Overall, level of the talks was pretty good. Similarly like on other small conferences, the atmosphere was very cozy and friendly. Organizers took very good care of the speakers, taking us to various nice restaurants and entertaining all the time (even the day after the conference). Krakow is actually a very nice city, probably one of the nicest in Poland. It is a little bit like Prague - it has a very large old town, with lots of nicely decorated restaurants (in an 'old polish' style) serving very tasty food :)

It was also very positive to see how enthusiastic those people are and it was clear to me that they really do this conference for fun and not for profit. I wish them success with the next edition in 2007! \ No newline at end of file diff --git a/_posts/2006-06-22-introducing-blue-pill.html b/_posts/2006-06-22-introducing-blue-pill.html deleted file mode 100644 index 80ae863..0000000 --- a/_posts/2006-06-22-introducing-blue-pill.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Introducing Blue Pill -date: '2006-06-22T13:05:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:18:43.337+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-115089716989100803 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.html ---- - -All the current rootkits and backdoors, which I am aware of, are based on a concept. For example: FU was based on an idea of unlinking EPROCESS blocks from the kernel list of active processes, Shadow Walker was based on a concept of hooking the page fault handler and marking some pages as invalid, deepdoor on changing some fields in NDIS data structure, etc... Once you know the concept you can (at least theoretically) detect the given rootkit.

Now, imagine a malware (e.g. a network backdoor, keylogger, etc...) whose capabilities to remain undetectable do not rely on obscurity of the concept. Malware, which could not be detected even though its algorithm (concept) is publicly known. Let's go further and imagine that even its code could be made public, but still there would be no way for detecting that this creature is running on our machines...

Over the past few months I have been working on a technology code-named Blue Pill, which is just about that - creating 100% undetectable malware, which is not based on an obscure concept.

The idea behind Blue Pill is simple: your operating system swallows the Blue Pill and it awakes inside the Matrix controlled by the ultra thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without restarting the system) and there is no performance penalty and all the devices, like graphics card, are fully accessible to the operating system, which is now executing inside virtual machine. This is all possible thanks to the latest virtualization technology from AMD called SVM/Pacifica.

How does the Blue Pill-based malware relates to SubVirt rootkit, presented a few months ago by Microsoft Research and University of Michigan? Well, there are couple of important differences:
  1. SubVirt is a permanent (i.e. restart surviving) rootkit. And it has to be, because the SubVirt's installation process requires that it takes control before the original operating system boots. Consequently, in contrast to Blue Pill, SubVirt can not be installed 'on-the-fly'. It also means that SubVirt must introduce some modifications to hard disk, which allows for the 'off line' detection.

  2. SubVirt was implemented on x86 hardware, which doesn't allow to achieve 100% virtualization, because there are number of sensitive instructions, which are not privileged, like the famous SIDT/SGDT/SLDT. This allows for trivial detection of the virtual mode - see e.g. my little Red Pill program. This however, doesn't apply to Blue Pill, as it relies on AMD SVM technology.

  3. SubVirt is based on one of the commercial VMM: Virtual PC and/or VMWare. Both of these applications create virtual devices to be used by the operating system, which are different from the real underlying hardware (e.g. network cards, graphic cards, etc.), which allows for easy detection of the virtual machine.

I would like to make it clear, that the Blue Pill technology does not rely on any bug of the underlying operating system. I have implemented a working prototype for Vista x64, but I see no reasons why it should not be possible to port it to other operating systems, like Linux or BSD which can be run on x64 platform.

I will be talking about Blue Pill and demonstrating a working prototype for Vista x64 at the end of July at SyScan Conference in Singapore.

Also, I will present a generic method (i.e. not relaying on any implementation bug) of how to insert arbitrary code into the Vista Beta 2 kernel (x64 edition), thus effectively bypassing the (in)famous Vista policy for allowing only digitally singed code to be loaded into kernel. Of course, the presented attack does not require system reboot. \ No newline at end of file diff --git a/_posts/2006-07-01-blue-pill-hype.html b/_posts/2006-07-01-blue-pill-hype.html deleted file mode 100644 index e60e132..0000000 --- a/_posts/2006-07-01-blue-pill-hype.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: The Blue Pill Hype -date: '2006-07-01T12:27:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:23:20.664+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-115175064263272833 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/07/blue-pill-hype.html ---- - -All the hype started from this article in eWeek by Ryan Naraine... The article is mostly accurate, despite one detail - the tile, which is a little misleading... It suggests that I already implemented "a prototype of Blue Pill which creates 100% undetectable malware", which is not true. Should this be true, I would not call my implementation "a prototype", which suggests some early stage of product.

That being said, I sincerely believe that Blue Pill technology will (very soon) allow for creating 100% undetectable malware, which is not based on obscurity of the concept. And I already stressed this in the description of my talk here and here. The working prototype I have (and which I will be demonstrating at SyScan and Black Hat) implements the most important step towards creating such malware, namely it allows to move the underlying operating system, on the fly, into a secure virtual machine.

The phrase "on the fly" is the most important thing about Blue Pill - it makes it possible to install a blue pill based malware without restarting the system and without any BIOS or boot sector modifications. I wish all those people who were posting about how easy it would be to detect Blue Pill by booting a system from a clean CD, spent more time on reading my original blog article, instead creating useless posts... (just a little wish).

The Blue Pill prototype I currently have is not yet complete, but this is not that important, because having successfully moved the OS into a virtual machine, implementing all the other features is just a matter of following the Pacifica specification. And I will repeat my statement again: I believe the malware based on a fully implemented Blue Pill will be 100% undetectable, provided that Pacifica is not "buggy". 100% undetectable in practice - I should add - as I'm aware of some theoretical brute force attacks, which I however do not consider as being practical and that they could be used in the future anywhere outside the lab. It should be undetectable, even if the malware code was made available to the opponent (e.g. AV company).

There are number of ways of how Blue Pill could be exploited to create the actual malware (Blue Pill itself is just a "hijacking technology", not a malware) and I will be showing a simple example of how it could be used to create a network backdoor on Vista x64.

What happens when you install Blue Pill on a machine which is already Blue Pilled? Should future OS come with own, preinstalled hypervisor to prevent Blue Pill installation? What about timing analysis? All those questions will be answered during my presentation - please do not send or post the same questions again and again...

That all being said, I don't think the title in the eWeek article was too much exaggerated, but I just wanted to clarify the things. After all, it was very positive, IMO, that the article attracted lots of attention, because I believe that hardware virtualization technology could become one of the biggest threat in the coming years (i.e. when more people will use processors with hardware virtualization support) and if we do not do anything about it. Can we do anything? I believe we can, but first we need to understand the threat.

One more thing should be commented. Some people suggested that my work is sponsored by Intel as I focused on AMD virtualization technolgy only. They should know then, that my work was sponsored exclusively by COSEINC Research and not by Intel. I implemented Blue Pill on AMD64 just because my previous research (also done for COSEINC) were focusing on Vista x64 and the natural choice of the processor for this was AMD64. And, although I wish I had more time to also try implementing Blue Pill on Intel VT, unfortunately I don't :( Accusing myslef of doing this on one processor only, instead on both AMD and Intel, is like saying that all vulnerability researches who find holes inside open source programs are paid by Microsoft ;) This is just ridicules! \ No newline at end of file diff --git a/_posts/2006-08-12-blue-pill-detection.html b/_posts/2006-08-12-blue-pill-detection.html deleted file mode 100644 index ff44054..0000000 --- a/_posts/2006-08-12-blue-pill-detection.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Blue Pill Detection! -date: '2006-08-12T17:40:00.003+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:56.432+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-115539746366601437 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/08/blue-pill-detection.html ---- - -So, after I presented the idea behind Blue Pill at SyScan and Black Hat, some people started talking how *easy* it should be do detect Blue Pill using timing analysis. Interestingly they must have missed the fact that I already discussed this way of detection during my presentations and I also gave the reasons why I don't think it could be used in practice...

But anyway, let's look at the problem again...

Obviously, Blue Pill, like any other hardware based VMM, needs to intercept some events and instructions. One intercept which we need to take care of (in case of SVM technology), is the RDMSR EFER instruction - just because the bit 12th in EFER register signalizes weather processor works in SVM mode or not. So, we need to cheat about it to the guest.

Now, we can measure how many processor 'tics' the given instruction took to execute - all we need to do is to use a RDTSC instruction, which returns the processor's time stamp counter. So I did the measuring and it turned out that normally it takes around 90 ticks to execute RDMSR, while on a 'bluepilled' system it takes about 2100 tics. What a big difference you will say!

But SVM technology (and Intel VT-x also) offers a nice way to cheat the guest about those extra tics, by adjusting a special variable in VMCB, called TSC_OFFSET (in that case we would set this value to something around -2010, just before returning to the guest). As a result, guest can not realize that the RDMSR instruction took extra ticks, by using RDTSC instruction.

So, here's what we need to do: we need to prepare a test piece of code, which would involve calling e.g. RDMSR instruction something like a few millions of times and observer the timing using *external* clock (yes, VMM can also cheat about the internal real time clock). This external clock can also be a human being (=user). For example the detector could display a message to the user:

"Dear user, I'm going to run a test now; if this test took more then 1 minute, that would mean your computer is probably compromised with a VMM based malware. Press OK to continue..."

The first problem with this approach is how to generate a piece of code, which would execute for exactly 1 minute (or any other given amount of time) on a native machine, taking into account that we may have many different processor models, working with many different speeds, etc... One can say, that we can probe the processor speed, using some test instructions which we know for sure that are not intercepted (most of the instructions). But this is problematic, since the hypervisor can cheat as to how many tics those instructions took to execute (as RDTSC can be intercepted itself). Of course this is trivial, when we assume that we can run our detector before and after infection, but this is not the case in most practical scenarios. So, I don't know how to solve this problem (which doesn't mean it can't be solved though)... Any suggestions welcomed.

Without solving the above problem, we're facing a problem of false positives and negatives. Consider that the test above took 5 minutes (instead of one) - now does that mean that we took a too big testing code (because guest were cheated during calibration) and that the very processor just had to spent 5 minutes executing it or was this a sign of an infection - it's just that on a new processor model maybe the RDMSR interception slowdown would be of a factor of 5 instead of 20 as it's with the processor I have right now. And if it was 15 minutes?

Currently this is not a big problem, just because there are only two models of AMD processors supporting SVM on the market and each is available with few different clock speeds. So, we can probably hardcode the testing code into our detector (because the slowdown is so big). But how the situation will change during the next two years, when there will be much more processors supporting hardware virtualization on the market? We would have to have a database of processor models and how much test code we need to use on each of them. (oh btw, and how detector could detect on which model it's running? You bet, using a CPUID instruction, which can be intercepted...)

And still, even if we solved this problem, still this kind of detection would be annoying to users (imagine a user being forced to do this kind of "1-minute test", or even 10sec test, every 15 minutes or so) unless we used some kind of infrastructure providing external time measurement (can't be just public NTP, because NTP packets could be easily intercepted by the malware). So, we would need to setup encrypted NTP servers in each company... Ah great!

So, I find it quite surprising that some people diminish the threat introduced by hardware virtualization based malware. I would like to point out that it's somewhat ridicules situation, when the malware can be reliably written using perfectly documented features of the processor, while we need to do some timing based tricks to detect it :) Are we switching roles with malware writers?

What we need is a reliable detector, something which would return 0 or 1 depending whether we're inside a VM or not. And I really don't see how we can create such a program (i.e. a standalone generic detector).

For completeness, I should also mention, just as I did during my talks, that we're aware of another attack against Blue Pill which should be very reliable and that can be implemented as a standalone program, but unfortunately it seems to allow only for crashing the system when it's 'bluepilled'. This nice attack has been independently proposed by Alex Tereshkin and Oded Horowitz, BTW.

Some people talked about prevention... Can we disable virtualization in BIOS? I can't do it on my AMD machine - but I heard that vendors are going to release updates to allow for that. But, come on, this is not a good way to address this threat! It's better not to buy the processors supporting hardware virtualization!

One more thing - as I'm being continually asked about this - yes, it is possible to create a similar malware to Blue Pill using Intel VT-x, just like it was demonstrated by Dino Dai Zovi at Black Hat a week ago. \ No newline at end of file diff --git a/_posts/2006-09-13-vista-rc1-still-vulnerable-to-pagefile.html b/_posts/2006-09-13-vista-rc1-still-vulnerable-to-pagefile.html deleted file mode 100644 index d2dcb42..0000000 --- a/_posts/2006-09-13-vista-rc1-still-vulnerable-to-pagefile.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Vista RC1 still vulnerable to the pagefile attack -date: '2006-09-13T18:21:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:46.939+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-115816512027277537 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/09/vista-rc1-still-vulnerable-to-pagefile.html ---- - -Everybody talks now about the latest Vista RC1 and how ready it is for being shipped to customers. So, I downloaded Vista RC1, Build 5600, x64 edition from MSDN a couple of days ago and gave it a try... To my surprise, it turned out that it's still vulnerable to the signature check bypass attack which I demonstrated nearly 2 months ago at the SyScan conference...

This is not good, because, on the one hand, Vista requires all kernel drivers to be digitally signed (for security reasons), which, in turn requires that all driver developers get (read: buy) an appropriate signing certificate, but on the other hand, malware authors can load their code into kernel for free (without reboot, as I demoed during the talk).

The requirement for having all kernel drivers digitally signed raised a lot of controversy when it was announced by Microsoft in January. People argued not only about the fact that paying for a certificate might be unacceptable for e.g. students or open source authors, but also about more "philosophical" aspect that it should be the user's (administrator's) right to load whatever she wants on her own computer, regardless whether somebody has signed it or not.

Personally, I think that it's worth to sacrifice a little bit of "freedom" and to spend a few hundred bucks on a certificate in case you're a kernel developer, if this can stop kernel malware from loading. Even though kernel protection can be implemented without PKI, as we can see in case of BSD systems and their securelevel mechanism (although an attack has been presented against it a few months ago), I still think that a scheme based on digital signatures is the best solution for end-users. However, it's definitely not worth to sacrifice that all, if there is a known way for bypassing this mechanism... :(

It's quite surprising for me that MS still hasn't fixed that problem, especially that the best solution here is also the simplest one to implement. As I described during my talk, it's just enough to... disable kernel mode memory paging. Surly, it would cause a little waste of memory, but according to some Microsoft engineers I spoke to, it would be only around 80MB. This seems very little these days, doesn't it? After all, are people going to run Vista with 256MB or even 512MB of RAM? I'm not ;)

Another good solution (and I think it was Brad Spengler of grsecurity who pointed that out to me) would be to calculate a hash for each page which is going to be paged out and then check this hash again on each page which is about to be loaded into memory again. Not that simple as the previous solution, but at least we're saving those 80MB of physical memory :) \ No newline at end of file diff --git a/_posts/2006-10-19-vista-rc2-vs-pagefile-attack-and-some.html b/_posts/2006-10-19-vista-rc2-vs-pagefile-attack-and-some.html deleted file mode 100644 index 608f8be..0000000 --- a/_posts/2006-10-19-vista-rc2-vs-pagefile-attack-and-some.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Vista RC2 vs. pagefile attack (and some thoughts about Patch Guard) -date: '2006-10-19T22:59:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:37.830+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-116129259996478986 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/10/vista-rc2-vs-pagefile-attack-and-some.html ---- - -Eventually, after I got back home from some traveling, I had a chance to download Vista RC2 x64 and test it against the pagefile attack...

It quickly turned out that our exploit doesn’t work anymore! The reason: Vista RC2 now blocks write-access to raw disk sectors for user mode applications, even if they are executed with elevated administrative rights.

In my Subverting Vista Kernel speech, which I gave at several major conferences over the past few months, I discussed three possible solutions to mitigate the pagefile attack. Just to remind you, the solutions mentioned were the following:
1. Block raw disk access from usermode.
2. Encrypt pagefile (alternatively, use hashing to ensure the integrity of paged out pages, as it was suggested by Elad Efrat from NetBSD).
3. Disable kernel mode paging (sacrificing probably around 80MB of memory in the worst case).

And I also made a clear statement that solution #1 is actually something which is a bad idea. I explained that if MS decided to disable write-access to raw disk sectors from usermode, not only that might cause some incompatibility problems (think about all those disk editors, un-deleters, etc…), but also that would not be a real solution to the problem…

Imagine a company wanting to release e.g. a disk editor. Now, with the blocked write access to raw disk sectors from usermode, the company would have to provide their own custom, but 100% legal, kernel driver for allowing their, again 100% legal, application (disk editor), to access those disk sectors, right? Of course, the disk editor's auxiliary driver would have to be signed – after all it’s a legal driver, designed for legal purposes and ideally having neither implementation nor design bugs! But, on the other hand, there is nothing which could stop an attacker from “borrowing” such a signed driver and using it to perform the pagefile attack. The point here is, again, there is no bug in the driver, so there is no reason for revoking a signature of the driver. Even if we discovered that such driver is actually used by some people to conduct the attack!

But it seems that MS actually decided to ignore those suggestions and implemented the easiest solution, ignoring the fact that it really doesn’t solve the problem…

Actually, if we weren't such nice guys, we could develop a disk editor together with a raw-disk-access kernel driver, then sign it and post it on COSEINC's website. But we're the good guys, so I guess somebody else will have to do that instead ;)

Kernel Protection vs. Kernel Patch Protection (Patch Guard)


Another thing - lots of people confuse kernel protection (i.e. the policy for allowing only digitally signed kernel drivers to be loaded) with Kernel Patch Protection, also known as Patch Guard.

In short, pagefile attack, which I demoed at SyScan/BackHat is a way to load unsigned code into kernel, thus it’s a way to bypass Vista kernel protection. Bypassing kernel patch protection (Patch Guard) is a different story. E.g. Blue Pill, a piece of malware which abuses AMD Pacifica hardware virtualization, which I also demoed during my talk, “bypasses” PG. The word “bypass” is a little bit misleading here though, as the BP does not make any special effort to disable or bypass PG explicitly, it simply doesn’t care about PG, because it’s located above (or below, depending on where your eyes are located) the whole operating system, including PG. Yes, it’s that simple :)

Also, almost any malware of type II (see my BH Federal talk for details about this malware classification) is capable of “bypassing” PG, simply because PG is not designed to detect changes introduced by type II malware. So, e.g. deepdoor, backdoor which I demonstrated in January at BH Federal, is undetectable by PG. Again, not a big deal – it’s just that PG was not designed to detect type II malware (nor type III, like BP). So, I'm a little bit surprised to hear people talking about "how hard would it be to bypass PG...", as that is something which has been done already (and I'm not referring to Metasploit's explicit technique here) - you just need to design your malware as type II or type III and your done!

But even that all being said, I still think that PG is actually a very good idea. PG should not be thought as of a direct security feature. PG's main task is to keep legal programs from acting like popular rootkits. Keeping malware away is not it's main task. However, by ensuring that legal applications do not introduce rootkit-like tricks, PG makes it easier and more effective to create robust malware detection tools.

I spent a few years developing various rootkit detection tools and one of the biggest problems I came across was how to distinguish between a hooking introduced by a real malware and... a hooking introduced by some A/V products like personal firewalls and Host IDS/IPS programs. Many of the well known A/V products do use exactly the same hooking techniques as some popular malware, like rootkits! This is not good, not only because it may have potential impact on system stability, but, and this is the most important thing IMO, it confuses malware detection tools.

Patch Guard, the technology introduced in 64 bit versions of Windows XP and 2003 (yes, PG is not a new thing in Vista!) is a radical, but probably the only one, way to force software vendors to not use undocumented hooking in their products. Needles to say, there are other, documented ways to implement e.g. a personal firewall or an A/V monitor, without using those undocumented hooking techniques.

Just my 2 cents to the ongoing battle for Vista kernel... \ No newline at end of file diff --git a/_posts/2006-11-24-introducing-stealth-malware-taxonomy.html b/_posts/2006-11-24-introducing-stealth-malware-taxonomy.html deleted file mode 100644 index 5558c3a..0000000 --- a/_posts/2006-11-24-introducing-stealth-malware-taxonomy.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Introducing Stealth Malware Taxonomy -date: '2006-11-24T13:18:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:27.755+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6550140885713843724 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2006/11/introducing-stealth-malware-taxonomy.html ---- - -

At the beginning of this year, at Black Hat Federal Conference, I proposed a simple taxonomy that could be used to classify stealth malware according to how it interacts with the operating system. Since that time I have often referred to this classification as I think it is very useful in designing system integrity verification tools and to talk about malware in general. Now I decided to explain this classification a bit more as well as extend it of a new type of malware - the type III malware.

The article is available as a PDF document here.



\ No newline at end of file diff --git a/_posts/2007-01-03-towards-verifiable-operating-systems.html b/_posts/2007-01-03-towards-verifiable-operating-systems.html deleted file mode 100644 index b8b0c60..0000000 --- a/_posts/2007-01-03-towards-verifiable-operating-systems.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Towards Verifiable Operating Systems -date: '2007-01-03T17:43:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:08:17.830+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-208658744926357906 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/01/towards-verifiable-operating-systems.html ---- - -Last week I gave a presentation at the 23rd Chaos Communication Congress in Berlin. Originally the presentation was supposed to be titled "Stealth malware - can good guys win?", but in the very last moment I decided to redesign it completely and gave it a new title: "Fighting Stealth Malware – Towards Verifiable OSes". You can download it from here.

The presentation first debunks The 4 Myths About Stealth Malware Fighting that surprisingly many people believe in. Then my stealth malware classification is briefly described, presenting the malware of type 0, I and II and challenges with their detection (mainly with type II). Finally I talk about what changes into the OS design are needed to make our systems verifiable. If the OS were designed in such a way, then detection of type I and type II malware would be a trivial task...

There are only four requirements that an OS must satisfy to become easily verifiable, these are:
  1. The underlying processors must support non-executable attribute on a per-page level,

  2. OS design must maintain strong code and data separation on a per-page level (this could be first only in kernel and later might be extended to include sensitive applications),

  3. All code sections should be verifiable on a per-page level (usually this means some signing or hashing scheme implemented),

  4. OS must allow to safely read physical memory by a 3rd party application (kernel driver/module) and for each page allow for reliable determination whether it is executable or not.

The first three requirements are becoming more and more popular these days in various operating systems, as a side effect of introducing anti-exploitation/anti-malware technologies (which is a good thing, BTW). However, the 4th requirement presents a big challenge and it is not clear now whether it would be feasible on some architectures.

Still, I think that it's possible to redesign our systems in order to make them verifiable. If we don't do that, then we will always have to rely on a bunch of "hacks" to check for some known rootktis and we will be taking part in endless arm race with the bad guys. On the other hand, such situation is very convenient for the security vendors, as they can always improve their "Advanced Rootkit Detection Technology" and sell some updates... ;)

Happy New Year! \ No newline at end of file diff --git a/_posts/2007-01-20-beyond-cpu-cheating-hardware-based-ram.html b/_posts/2007-01-20-beyond-cpu-cheating-hardware-based-ram.html deleted file mode 100644 index ed62758..0000000 --- a/_posts/2007-01-20-beyond-cpu-cheating-hardware-based-ram.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: 'Beyond The CPU: Cheating Hardware Based RAM Forensics' -date: '2007-01-20T13:13:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:58.721+01:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/RbISDXtmzMI/AAAAAAAAAAk/TlmnJhxXJcs/s72-c/green-board-small.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-1453328084371931288 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/01/beyond-cpu-cheating-hardware-based-ram.html ---- - -
We all know that any software-based system compromise detector can always be cheated if malware runs at the same privilege level as the detector (usually both run in kernel mode). This is what I call Implementation Specific Attacks (ISA). Because of that, mankind has tried to find some better, more reliable ways for analyzing systems, which would not be subject to interference from malware…

And we all know what we’ve come up with as a solution – hardware based devices for obtaining the image of volatile memory (RAM), usually in the form of a PCI card. As far as the PC architecture is concerned, probably the first two papers in this area are those about Tribble and CoPilot. As an alternative to expensive dedicated PCI cards, one can also use a FireWire bus, as it has been described by Maximillian Dornseif at el., and later by Adam Boileau.

The point is: once we get the memory image, we can analyze it for signs of compromises on a trusted machine or we can have the PCI device to do some checks itself (like e.g. CoPilot does).

The whole idea behind hardware based RAM acquisition is that the process of reading the memory is using Direct Memory Access (DMA) to read the physical memory. DMA, as the name suggests, does not involve CPU in the process of accessing memory. So, it seems to be a very reliable way for reading the physical memory…

But it is not! At least in some cases...

Next month, at Black Hat DC, I will be demonstrating how to cheat hardware based memory acquisition on AMD based systems. In other words, I will be showing that the image obtained using DMA, can be made different from the real contents of the physical memory as seen by the CPU. Even though the attack is AMD-specific, it does not rely on virtualization extensions. Also, the attack does not require system reboot. Nor does it require soldering ;)

I have tested my proof-of-concept code against a FireWire-based method of memory acquisition, using tools from Adam Boileau’s presentation.

I wanted to test it also against some PCI cards, but it turned out, that for an ordinary mortal person like myself, it is virtually impossible to buy a sample of a dedicated PCI card for memory acquisition… E.g. the Tribble card is still unavailable for sale, according to its author, even though the prototype has been build in 2003... BBN, the US company known for doing lots of project for the US government, apparently has a prototype (see page 45) of something similar to Tribble, but is not willing to discuss any details with somebody who is not involved in a project with the US government... Finally, Komoku Inc., whose main customers, according to the website, are also US government agencies, also rejected my inquiry for buying a sample of CoPilot, claiming that the device "is not generally available right now" ;)

Anyway, even though I was able to test the attack only against FireWire based method, I’m pretty confident that it will work against all other devices which use DMA to access the physical memory, as the attack itself is very generic.

See you in DC! \ No newline at end of file diff --git a/_posts/2007-02-04-running-vista-every-day.html b/_posts/2007-02-04-running-vista-every-day.html deleted file mode 100644 index e97ea65..0000000 --- a/_posts/2007-02-04-running-vista-every-day.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Running Vista Every Day! -date: '2007-02-04T13:36:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:47.393+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/RcUuTcXM6CI/AAAAAAAAAA4/HvaLpzY_qUA/s72-c/UAC+-+disable+installations+detection+.bmp -blogger_id: tag:blogger.com,1999:blog-24586388.post-6447067375460891914 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/02/running-vista-every-day.html ---- - -More then a month ago I have installed Vista RTM on my primary laptop (x86 machine) and have been running it since that time almost every day. Below are some of my reflections about the new security model introduced in Vista, its limitations, a few flaws and some practical info about how I configured my system.

UAC – The Good and The Bad

User Account Control (UAC) is a new security mechanism introduced in Vista, whose primary goal is to force users to work using restricted accounts, instead working as administrators. This is, in my opinion the most important security mechanism introduced in Vista. That doesn’t mean it can not be bypassed in many ways (due to implementation flaws), but just the fact that such a design change has been made into Windows is, without doubt, a great step towards securing consumer OSes.

When UAC is active (which is a default setting) even when user logs in as an administrator, most of her programs run as restricted processes, i.e. they have only some very limited subset of privileges in their process token. Also, they run at, so called, Medium integrity level, which, among other things, should prevent those applications from interacting with higher integrity level processes via Window messages. This mechanism also got a nice marketing acronym, UIPI, which stands for User Interface Privilege Isolation. Once the system determines that a given program (or a given action) requires administrative privileges, because e.g. the user wants to change system time, it displays a consent window to the user, asking her whether she really wants to proceed. In case the user logged in as a normal user (i.e. the account does not belong to the Administrators group), then the user is also asked to enter password for the one of the administrator's accounts. You can find more background information about UAC, e.g. at this page.

Many people complain about UAC, saying that it’s very annoying for them to see UAC consent dialog box to appear every few minutes or so, and claim that this will discourage users from using this mechanism at all (and yes, there’s an option to disable UAC). I strongly disagree with such opinion - I’ve been running Vista more then a month now and, besides the first few days when I was installing various applications, I now do not see UAC prompt more then 1-2 times per day. So, I really wonder what those people are doing that they see UAC constantly appearing every other minute…

One thing that I found particularly annoying though, is that Vista automatically assumes that all setup programs (application installers) should be run with administrator privileges. So, when you try to run such a program, you get a UAC prompt and you have only two choices: either to agree to run this application as administrator or to disallow running it at all. That means that if you downloaded some freeware Tetris game, you will have to run its installer as administrator, giving it not only full access to all your file system and registry, but also allowing e.g. to load kernel drivers! Why Tetris installer should be allowed to load kernel drivers?

How Vista recognizes installer executables? It has a compatibility database as well as uses several heuristics to do that, e.g. if the file name contains the string “setup” (Really, I’m not kidding!). Finally it looks at the executable’s manifest and most of the modern installers are expected to have such manifest embedded, which may indicate that the executable should be run as administrator.

To get around this problem, e.g. on XP, I would normally just add appropriate permissions to my normal (restricted) user account, in such a way that this account would be ale to add new directories under C:\Program Files and to add new keys under HKLM\Software (in most cases this is just enough), but still would not be able to modify any global files nor registry keys nor, heaven forbid, to load drivers. More paranoid people could chose to create a separate account, called e.g. installer and use it to install most of the applications. Of course, the real life is not that beautiful and you sometimes need to play a bit with regmon to tweak the permissions, but, in general it works for majority of applications and I have been successfully using this approach for years now on my XP box.

That approach would not work on Vista, because every time Vista detects that an executable is a setup program (and believe me Vista is really good at doing this), it will only allow running it as administrator… Even though it’s possible to disable heuristics-based installer detection via local policy settings – see picture below:



that doesn’t seem to work for those installer executables which have embedded manifest saying that they should be run as administrator.

I see the above limitation as a very severe hole in the design of UAC. After all, I would like to be offered a choice whether to fully trust given installer executable (and run it as full administrator) or just allow it to add a folder in C:\Program Files and some keys under HKLM\Software and do nothing more. I could do that under XP, but apparently I can’t under Vista, which is a bit disturbing (unless I’m missing some secret option to change that behavior).

Integrity Levels – Protect the OS but not your data!

Integrity Levels (IL) mechanism has been introduced to help implementing UAC. This mechanism is very simple – every process can be assigned one of the four possible integrity levels:

• Low
• Medium
• High
• System

Similarly, every securable object in the system, like e.g. a directory, file or registry key, can also be assigned an integrity level. Integrity level is nothing else then just an ACE of a special type assigned to the SACL list. If there’s no such ACE at all, then the integrity level of the object is assumed to be Medium. You can use icacls command to see integrity levels on file system objects:
C:\>icacls \Users\joanna\AppData\LocalLow
\Users\joanna\AppData\LocalLow silverose\joanna:(F)
                       silverose\joanna:(OI)(CI)(IO)(F)
                       NT AUTHORITY\SYSTEM:(F)
                       NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                       BUILTIN\Administrators:(F)
                       BUILTIN\Administrators:(OI)(CI)(IO)(F)
                       Mandatory Label\Low Mandatory Level:(OI)(CI)(NW)
BTW, I don’t know any tool/command to see and modify integrity levels assigned to registry keys (I think I know how to do this in C though). Anybody?

Now, the whole concept behind IL is that a process can only get write-access to those objects which have the same or lower integrity level then the process itself.

Update (March 5th, 2007): This is the default behavior of IL and is indicated by the “(NW)” symbol on the picture above, which stands for NoWriteUp policy. I have just learned that one can use the chml tool by Mark Minasi to set also a different policy, i.e. NoReadUp (NR) or NoExecuteUp (NX), which would result that IL mechanism will not allow a lower integrity process to read or execute the objects marked with higher IL. See also my recent post about this tool.

UAC is implemented using IL – even if you log in as administrator, all your processes (like e.g. explorer.exe) run with Medium IL. Once you elevated to the “real admin” your process runs at High IL. System processes, like e.g. services, runs at System IL. From the security point of view High IL seems to be equivalent to System IL, because once you are allowed to execute code at High IL you can compromise the whole system.

Internet Explorer’s protected mode is implemented using the IL mechanism. The iexplore.exe process runs at Low IL and, in a system with default configuration, can only write to %USERPROFILE%\AppData\LocalLow and HKCU\Software\AppDataLow because all other objects have higher ILs (usually Medium).

If you don’t like surfing using IE, you can very easily setup your Firefox (or other browser of your choice) to run as Low integrity process (here we assume that Firefox user’s profile is in j:\config\firefox-profile):
C:\Program Files\Mozilla Firefox>icacls firefox.exe /setintegritylevel low
J:\config>icacls firefox-profile /setintegritylevel (OI)(CI)low
Because firefox.exe is now marked as a Low integrity file, Vista will also create a Low integrity process from this file, unless you are going to start this executable from a High integrity process (e.g. elevated command prompt). Also, if you, for some reason (see below), wanted to use runas or psexec to start a Low integrity process, it won’t work and will start the process as Medium, regardless that the executable is marked as Low integrity.

It should be stressed that IL, by default, protects only against modifications of higher integrity objects. It’s perfectly ok for the Low IL process to read e.g. files, even if they are marked as Medium or High IL. In other words, if somebody exploits IE running in Protected Mode (at Low IL), she will be able to read (i.e. steal) all user’s data.

This is not an implementation bug, this is a design decision and it’s cleverly called the “read-up policy”. If we think about it for a while, it should become clear why Microsoft decided to do it that way. First, we should observe, that what Microsoft is most concerned about, is malware which permanently installs itself in the system and that could later be detected by some anti-malware programs. Microsoft doesn’t like it, because it’s the source of all the complains about how insecure Windows is and also the A/V companies can publish their statistics about how many percent of computers is compromised, etc… All in all, a very uncomfortable situation, not only for Microsoft but also for all those poor users, who now need to try all the various methods (read buy A/V programs) to remove the malware, instead just focus on their work…

On the other hand, imagine a reliable exploit (i.e. not crashing a target too often) which, after exploiting e.g. IE Protected Mode process, steals all the user’s DOC and XLS files, sends them back somewhere and afterwards disappears in an elegant fashion. Our user, busy with his every day work, does not even notice anything, so he can continue working undisturbed and focus on his real job. The A/V programs do not detect the exploit (why should they? – after all there’s no signature for it nor the shellcode uses any suspicious API) so they do not report the machine as infected – because, after all it’s not infected. So, the statistics look better and everybody is generally happier. Including the competition, who now has access to stolen data ;)

User Interface Privilege Isolation and some little Fun

UAC and Integrity Levels mechanism makes it possible for processes running with different ILs to share the same desktop. This raises potential security problem, because Windows implements a mechanism to allow one process to send a “window message”, like e.g. WM_SETTEXT, to another process. Moreover, some messages, like e.g. the infamous WM_TIMER, could be used the redirect execution flow of the target thread. This has been popular a few years ago in so called “Shatter Attacks”.

UIPI, introduced in Vista, is for the rescue. UIPI basically enforces the obvious policy that lower integrity processes can not send messages to higher integrity processes.

Interestingly, UIPI implementation is a bit “unfinished” I would say… For example, in contrast to design assumption, on my system at least, it is possible for the Low integrity process to send e.g. WM_KEYDOWN to e.g. open Administrative shell (cmd.exe) running at High IL and gets arbitrary commands executed.

One simple scenario of the attack is that a malicious program, running at Low IL, can wait for the user to open elevated command prompt – it can e.g. poll the open window handles e.g. every second or so (Window enumeration is allowed even at Low IL). Once it finds the window, it can send commands to execute… Probably not that cool as the recent “Vista Speech Exploit”, but still something to play with ;)

It’s my feeling that there are more holes in UAC, but I will leave finding them all as an exercise for the readers...

Do-It-Yourself: Implementing Privilege Separation

Because of the limitations of the UAC and IL mentioned above (i.e. the read-up policy), I decided to implement a little privilege-separation policy in my system. The first thing we need, is to create a few more accounts, each for a specific type of applications or tasks. E.g. I decided that I want a separate account to run my web browser, a different one for running my email client as well as IM client (which I occasionally run) and a whole other account to deal with my super-secret projects. And, of course, I need a main account, that is, the one which I will use to log in to the system. All in all, here is the list of all the accounts on my Vista laptop:

• admin
• joanna
• joanna.web
• joanna.email
• joanna.sensitive

So, joanna is used to log into system (this is, BTW, a truly limited account, i.e. it doesn’t belong to the Administrators group) and Explorer and all applications like e.g. Picassa are started using this account. Firefox and Thunderbird run as joanna.web and joanna.email respectively. However, a little trick is needed here, if we want to start those applications as Low IL processes (and we want to do this, because we want UIPI to protect, at least in theory, other applications from web and mail clients if they got compromised somehow). As it was mentioned above, if one uses runas or psexec the created process will run as Medium IL, regardless the integrity level assigned to the executable. We can get around this, buy using this simple trick (note the nested quotations):
runas /user:joanna.web "cmd /c start \"c:\Program Files\Mozilla Firefox\firefox.exe\""
c:\tools\psexec -d -e -u joanna.web -p l33tp4ssw0rd "cmd" "/c start "c:\Program Files\Mozilla Firefox\firefox.exe""
Obviously, we also need to set appropriate ACLs on the directories containing Firefox and Thunderbird user’s profiles, so that each of those two users get full access to the respective directories as well as to a \tmp folder, used to store email attachments and downloaded files. No other personal files should be accessible to joanna.web and joanna.email.

Finally, being a paranoid person as I am, I have also a special user joanna.sensitive, which is the only one granted access to my \projects directory. It may come as a surprise, but I decided to make joanna.sensitve a member of the Administrators group. The reason for that is that I need to make all the applications which run as joanna.sensitve (e.g. gvim, cmd, Visual Studio, KeePass, etc) to have their UI isolated from all other normal applications, which run as joanna at Medium IL. It seems like the only way to start a processes at High IL is to make it part of the Administrators group and then use ‘Run As Administrator’ or runas command to start it.

That way we have the highly dangerous applications, like web browser or email client, run at Low IL and as very limited users (joanna.web and joanna.email), who have access only to the necessary profile directories (the restriction, this time, applies both to read- and write- accesses, because it’s enforced by normal ACLs on file system objects and not by IL mechanism). Then we have all other applications, like Explorer, various Office applications, etc. running as joanna at Medium IL and finally the most critical programs, those running as joanna.sensitve, like KeePass and those which get access to my \projects directory, they all run at High IL.

Thunderbird, GPG and Smart Cards

Even though the above configuration might look good, there’s still a problem with it I haven’t solved yet. The problem is related to mail encryption and how to isolate email client from my PGP private keys. I use Thunderbird together with Enigmail’s OpenPGP extension. The extension is just a wrapper around gpg.exe, a GnuPG implementation of PGP. When I open encrypted email, my Thunderbird processes spawns a new gpg.exe process and passes the passphrase to it as an argument. There are two alarming things here – first Thunderbird process needs to know my passphrase (in fact I enter it into a dialog box displayed by the Enigmail’s extension) and second, the gpg.exe process runs as the same user and at the same IL level as the thunderbird.exe process. So, if thunderbird.exe gets compromised, the malicious code executing inside thunderbird.exe will not only be able to get to know my passphrase, but will also be free to read my private key from disk (because it has the same rights as gpg.exe).

Theoretically it should be possible to solve the problem with passphrase stealing by using GPG Agent, which could run in the background as a service and gpg.exe would ask the agent for the passphrase instead asking thunderbird.exe process, which will never be in possession of the passphrase. Ignoring the fact that there doesn’t seem to be a working GPG Agent implementation for Win32 environment, this still is not a good solution, because thunderbird.exe still gets access to gpg.exe process, which is its own child after all – so it’s possible for thunderbird.exe to read the contents of gpg.exe memory and to find a decrypted PGP private key there.

It would help if GPG was implemented as a service running in the background and thunderbird.exe would only communicate with it using some sort of LPC to send request to encrypt, decrypt, sign and verify buffers. Unfortunately I’m not aware of such implementation, especially for Win32.

The only practical solution seems to be to use a Smart Card, which would perform all the
necessary crypto operations using its own processor. Unfortunately, GnuPG supports only, a so called, OpenPGP smart cards, but it seems that the only two cards which implements this standard (i.e. Fellowship card and the g10 card) implement only 1024 bits RSA keys, which is definitely not enough for even a moderately paranoid person ;)

In the last hope, I turned to commercial PGP, downloaded the trial of PGP Desktop and… it turned out that it doesn’t support Vista yet (what a shame, BTW).

So, for the time being I’m defenseless like a baby against all those mean people who would try to exploit my thunderbird.exe and steal my private PGP key :(

The forgotten part: Detection

One might think that it’s a pretty secure system configuration… Well, more precisely, it could be considered as pretty secure, if UIPI was not buggy and UAC didn’t force me to run random setup programs with full administrator rights and if GPG supported Smart Cards with RSA keys > 1024 (or alternatively PGP Desktop supported Vista). But let’s not be that scrupulous and forgot about those minor problems…

Still, even though that might look like a secure configuration, this is all just an illusion of security! The whole security of the system can be compromised if attacker finds and exploits e.g. a bug in kernel driver.

It should be noted that Microsoft has also implemented several anti-exploitation techniques in Vista, the two most advertised are Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP). However, ASLR does not protect against local kernel exploitation, because it’s possible, even for the Low IL process, to query system about the list of loaded kernel modules together with their base addresses (using ZwQuerySystemInformation function). Also, hardware DEP, which works only on 64-bit processors, is not applied to the whole non-paged pool (as well as some other areas, but non-paged pool is the biggest one). In other words, the hardware NX bit is not set on all pages comprising the non-paged pool. BTW, there is a reason for Microsoft doing this and this is not due to compatibility issues (at least I believe so). I wonder who else can guess... ;)

UPDATE (see above): David Solomon, pointed out, that Hardware DEP is also available on many modern 32-bit processors (as the NX bit is implemented in PAE mode).

It’s very good that Microsoft implemented those anti-exploitation technologies (besides ASLR and NX, there are also some others). However the point is, they could be bypassed by a clever attacker under some circumstances. Now think about how many 3rd party kernel drivers are typically present in an average Windows systems – all those graphics card drivers, audio drivers, SATA drivers, A/V drivers, etc... and try answering the question how many possible bugs could be there? (BTW, it should be mentioned that Microsoft did a clever step by moving some classes of kernel drivers into user mode, like e.g. USB drivers – this is called UMDF).

When attacker successfully exploits kernel bug, then all the security scheme implemented by the OS is just worth nothing. So, what can we do? Well, we need to complement all those cool prevention technologies with effective detection technology. But has Microsoft done anything to make systematic detection possible? This is a rhetoric question of course and the negative answer applies unfortunately not only to Microsoft products but also to all other general purpose operating systems I’m aware of :(

My favorite quote of all those people who negate the value of detection is this: “once the system is compromised we can’t do anything!”. BS! Even though it might be true today – because the Operating System are not designed to be verifiable, but that doesn’t mean we can’t change this!

Bottom Line

Microsoft did a good job with securing Vista. They could do better, of course, but remember that Windows is a system for masses and also that they need to take care about compatibility issues, which sometimes can be a real pain. If you want to run Microsoft OS, then I believe that Vista is definitely a better choice then XP from a security standpoint. It has bugs, but which OS doesn't? What I wish for, is that they paid more attention to make their system verifiable...

Acknowledgements

I would like to thank John Lambert and Andrew Roths, both of Microsoft, for answering my questions about UAC design. \ No newline at end of file diff --git a/_posts/2007-02-12-vista-security-model-big-joke.html b/_posts/2007-02-12-vista-security-model-big-joke.html deleted file mode 100644 index a48607b..0000000 --- a/_posts/2007-02-12-vista-security-model-big-joke.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Vista Security Model – A Big Joke? -date: '2007-02-12T18:23:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:37.607+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6414764407112152883 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/02/vista-security-model-big-joke.html ---- - -[Update: if you came here from ZDNet or Slashdot - see the post about confusion above!]

Today I saw a new post at Mark Russinovich’s blog which I take as a response to my recent musings about Vista security features, where I pointed out several problems with UAC, like e.g. the attack that allows for a low integrity process to hijack the high integrity level command prompt. Those who read the whole article undoubtedly noticed that my overall opinion of vista security changes was still very positive – after all everybody can do mistakes and the fact UAC is not perfect, doesn’t diminish the fact that it’s a step into the right direction, i.e. implementing least-privilege policy in Windows OS.

However, I now read this post by Mark Russinovich (a Microsoft employee), which says:
"It should be clear then, that neither UAC elevations nor Protected Mode IE define new Windows security boundaries. Microsoft has been communicating this but I want to make sure that the point is clearly heard. Further, as Jim Allchin pointed out in his blog post Security Features vs Convenience, Vista makes tradeoffs between security and convenience, and both UAC and Protected Mode IE have design choices that required paths to be opened in the IL wall for application compatibility and ease of use."

And then we read:
"Because elevations and ILs don’t define a security boundary, potential avenues of attack, regardless of ease or scope, are not security bugs. So if you aren’t guaranteed that your elevated processes aren’t susceptible to compromise by those running at a lower IL, why did Windows Vista go to the trouble of introducing elevations and ILs? To get us to a world where everyone runs as standard user by default and all software is written with that assumption."

Oh, excuse me, is this supposed be a joke? We all remember all those Microsoft’s statements about how serious Microsoft is about security in Vista and how all those new cool security features like UAC or Protected Mode IE will improve the world’s security. And now we hear what? That this flagship security technology (UAC) is in fact… not a security technology!

I understand that implementing UAC, UIPI and Integrity Levels mechanisms on top of the existing Windows OS infrastructure is a hard task and it would be much easier to design the whole new OS from scratch and that Microsoft can’t do this for various of reasons. I understand that all, but that doesn’t mean that once more people at Microsoft realized that too, they should turn everything into a big joke? Or maybe I’m too much of an idealist…

So, I will say this: If Microsoft won’t change their attitude soon, then in a couple of months the security of Vista (from the typical malware’s point of view) will be equal to the security of current XP systems (which means, not too impressive). \ No newline at end of file diff --git a/_posts/2007-02-13-confiusion-about-joke.html b/_posts/2007-02-13-confiusion-about-joke.html deleted file mode 100644 index 74260ea..0000000 --- a/_posts/2007-02-13-confiusion-about-joke.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Confusion About The "Joke Post" -date: '2007-02-13T23:10:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:28.222+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5717512390685272695 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/02/confiusion-about-joke.html ---- - -It seems that many people didn’t fully understand why I wrote the previous post – Vista Security Model – A Big Joke... There are two things which should be distinguished:

1) The fact that UAC design assumes that every setup executable should be run elevated (and that a user doesn't really have a choice to run it from a non-elevated account),

2) The fact that UAC implementation contains bug(s), like e.g. the bug I pointed out in my article, which allows a low integrity level process to send WM_KEYDOWN messages to a command prompt window running at high integrity level.

I was pissed off not because of #1, but because Microsoft employee - Mark Russinovich - declared that all implementation bugs in UAC are not to be considered as security bugs.

True, I also don't like the fact that UAC forces users to run every setup program with elevated privileges (fact #1), but I can understand such a design decision (as being a compromise between usability and security) and this was not the reason why I wrote "The Joke Post". \ No newline at end of file diff --git a/_posts/2007-03-05-handy-tool-to-play-with-windows.html b/_posts/2007-03-05-handy-tool-to-play-with-windows.html deleted file mode 100644 index f9c25aa..0000000 --- a/_posts/2007-03-05-handy-tool-to-play-with-windows.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Handy Tool To Play with Windows Integrity Levels -date: '2007-03-05T18:53:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:07:15.128+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1586021214114399750 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/03/handy-tool-to-play-with-windows.html ---- - -Mark Minasi wrote to me recently to point out that his new tool, chml, is capable of setting NoReadUp and NoExecuteUp policy on file objects, in addition to the standard NoWriteUp policy, which is used by default on Vista.

As I wrote before the default IL policy used on Vista assumes only the NoWriteUp policy. That means that all objects which do not have assigned any IL explicitly (and consequently are treated as if they were marked with Medium IL) can be read by low integrity processes (only writes are prevented). Also, the standard Windows icacls command, which allows to set IL for file objects, assumes always the NoWriteUp policy only (unless I’m missing some secret switch).

However, it’s possible, for each object, to define not only the integrity level but also the policy which will be used to access it. All this information is stored in the same SACE which also defines the IL.

There doesn’t seem to be too much documentation from Microsoft about how to set those permissions, except this paper about Protected Mode IE and the sddl.h file itself.

Anyway, it’s good to see a tool like chml as it allows to do some cool things in a very simple way. E.g. consider that you have some secret documents in the folder c:\secretes and that you don’t feel like sharing those files with anybody who can exploit your Protected Mode IE. As I pointed out in my previous article, by default all your personal files are accessible to your Protected Mode IE low integrity process, so in the event of successful exploitation the attacker is free to steal them all. However now, using Mark Minasi’s tool, you can just do this:
chml.exe c:\secrets -i:m -nr -nx
This should prevent all the low IL processes, like e.g. Protected Mode IE, from reading the contents of your secret directory.

BTW, you can use chml to also examine the SACE which was created:
chml.exe c:\secrets -showsddl
and you should get something like that as a result:
SDDL string for c:\secrets's integrity label=S:(ML;OICI;NRNX;;;ME)
Where S means that it’s an SACE (in contrast to e.g. DACE), ML says that this ACE defines mandatory label, OICI means “Object Inherit” and “Container Inherit”, NRNX defines that to access this object the NoReadUp and NoExecuteUp policies should be used (which also implies the NoWriteUp BTW) and finally the ME stands for Medium Integrity Level.

All credits go to Mark Minasi and the Windows IL team :)

As a side note: the updated slides for my recent Black Hat DC talk about cheating hardware based memory acquisition can be found here. You can also get the demo movies here. \ No newline at end of file diff --git a/_posts/2007-03-26-game-is-over.html b/_posts/2007-03-26-game-is-over.html deleted file mode 100644 index ac8c977..0000000 --- a/_posts/2007-03-26-game-is-over.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: The Game Is Over! -date: '2007-03-26T10:57:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:59.977+01:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/Rgfep4q7IGI/AAAAAAAAABQ/B0UGxc6ITz4/s72-c/gameover.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-6658513522828638474 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/03/game-is-over.html ---- - -People often say that once an attacker gets access to the kernel the game is over! That’s true indeed these days, and most of the research I have done over the past two years or so, was about proofing just that. Some people, however, go a bit further and say, that thus there is no point in researching ways to detect system compromises and, once an attacker got in, you should simply assume everything has been compromised and replace all the components, i.e. buy new machine (as the attacker might have modified the BIOS or re-flashed PCI EEPROMs), reinstall OS, all applications, etc.



However, they miss one little detail – how can they actually know that the attacker got access to the system and that the game is over indeed and we need to reinstall just now?

Well, we simply assume that the attacker had to make some mistake and that we, sooner or later, will find out. But what if she didn’t make a mistake?

There are several trends of how this problem should be addressed in a more general and elegant way though. Most of them are based on a proactive approach. Let’s have a quick look at them…
  1. One generic solution is to build in a prevention technology into the OS. That includes all the anti-exploitation mechanisms, like e.g. ASLR, Non Executable memory, Stack Guard/GS, and others, as well as some little design changes into OS, like e.g. implementation of least-privilege principle (think e.g. UAC in Vista) and some sort of kernel protection (e.g. securelevel in BSD, grsecurity on Linux, signed drivers in Vista, etc).

    This has been undoubtedly the most popular approach for the last couple of years and recently it gets even more popular, as Microsoft implemented most of those techniques in Vista.

    However, everybody who follows the security research for at least several years should know that all those clever mechanisms have all been bypassed at least once in their history. That includes attacks against Stack Guard protection presented back in 2000 by Bulba and Kil3r, several ways to bypass PaX ASLR, like those described by Nergal in 2001 and by others several months later as well as exploiting the privilege elevation bug in PaX discovered by its author in 2005. Also the Microsoft's Hardware DEP (AKA NX) has been demonstrated to be bypassable by skape and Skywing in 2005.

    Similarly, kernel protection mechanisms have also been bypassed over the past years, starting e.g. with this nice attack against grsecurity /dev/(k)mem protection presented by Guillaume Pelat in 2002. In 2006 Loic Duflot demonstrated that BSD's famous securelevel mechanism can also be bypassed. And, also last year, I showed that Vista x64 kernel protection is not foolproof either.

    The point is – all those hardening techniques are designed to make exploitation harder or to limit the damage after a successful exploitation, but not to be 100% foolproof. On the other hand, it must be said, that they probably represent the best prevention solutions available for us these days.

  2. Another approach is to dramatically redesign the whole OS in such a way that all components (like e.g. drivers and serves) are compartmentalized, e.g. run as separate processes in usermode, and consequently are isolated not only from each other but also from the OS kernel (micro kernel). The idea here is that the most critical components, i.e. the micro kernel, is very small and can be easily verified. Example of such OS is Minix3 which is still under development though.

    Undoubtedly this is a very good approach to minimize impact from system or driver faults, but does not protect us against malicious system compromises. After all if an attacker exploits a bug in a web browser, she may only be interested in modifying the browser’s code. Sure, she probably would not be able to get access to the micro kernel, but why would she really need it?

    Imagine, for example, the following common scenario: many online banking systems require users to use smart cards to sign all transaction requests (e.g. money transfers). This usually works by having a browser (more specifically an ActiveX control or Firefox’s plugin) to display a message to a user that he or she is about to make e.g. a wire transfer to a given account number for a given amount of money. If the user confirms that action, they should press an ‘Accept’ button, which instructs browser to send the message to the smart card for signing. The message itself is usually just some kind of formatted text message specifying the source and destination account numbers, amount of money, date and time stamp etc. Then the user is asked to insert the smart card, which contains his or her private key (issued by the bank) and to also enter the PIN code. The latter can be done either by using the same browser applet or, in slightly more secure implementations, by the smart card reader itself, if it has a pad for entering PINs.

    Obviously the point here is that malware should not be able to forge the digital signature and only the legitimate user has access to the smart card and also knows the card’s PIN, so nobody else will be able to sign that message with the user’s key.

    However, it’s just enough for the attacker to replace the message while it’s being send to the card, while displaying the original message in the browser’s window. This all can be done by just modifying (“hooking”) the browser’s in-memory code and/or data. No need for kernel malware, yet the system (the browser more specifically) is compromised!

    Still, one good thing about such a system design is that if we don’t allow an attacker to compromise the microkernel, then, at least in theory, we can write a detector capable of finding that some (malicious) changes to the browsers memory have been introduced indeed. However, in practice, we would have to know how exactly the browser’s memory should look like, e.g. which function pointers in Firefox’s code should be verified in order to find out whether such a compromise has indeed occurred. Unfortunately we can not do that today.

  3. Alternative approach to the above two, which does not require any dramatic changes into OS, is to make use of so called sound static code analyzers to verify all sensitive code in OS and applications. The soundness property assures that the analyzer has been mathematically proven not to miss even a single potential run time error, which includes e.g. unintentional execution flow modifications. The catch here is that soundness doesn’t mean that the analyzer doesn’t generate false positives. It’s actually mathematically proven that we can’t have such an ideal tool (i.e. with zero false positive rate), as the problem of analyzing all possible program execution paths is incomputable. Thus, the practical analyzers always consider some superset of all possible execution flows, which is easy to compute, yet may introduce some false alarms and the whole trick is how to choose that superset so that the number of false positives is minimal.

    ASTREE is an example of a sound static code analyzer for the C language (although it doesn’t support programs which make use of dynamic memory allocation) and it apparently has been used to verify the primary flight control software for Airbus A340 and A380. Unfortunately, there doesn’t seem to be any publicly available sound binary code static analyzers… (if anybody knows any links, you’re more then welcome to paste the links under this post – just please make sure you’re referring to sound analyzers).

    If we had such sound and precise (i.e. with minimal rate of false alarms) binary static code analyzer that could be a big breakthrough in the OS and application security.

    We could imagine, for example, a special authority for signing device drivers for various OSes and that they would first perform such a formal static validation on submitted drivers and, once passed the test, the drivers would be digitally signed. Plus, the OS kernel itself would be validated itself by the vendor and would accept only those drivers which were signed by the driver verification authority. The authority could be an OS vendor itself or a separate 3rd party organization. Additionally we could also require that the code of all security critical applications, like e.g. web browser be also signed by such an authority and set a special policy in our OS to allow e.g. only signed applications to access network.

    The only one week point here is, that if the private key used by the certification authority gets compromised, then the game is over and nobody really knows that… For this reason it would be good, to have more then one certification authority and require that each driver/application be signed by at least two independent authorities.

From the above three approaches only the last one can guarantee that our system will not get compromised ever. The only problem here is that… there are no tools today for static binary code analysis that would be proved to be sound and also precise enough to be used in practice…

So, today, as far as proactive solutions are considered, we’re left only with solutions #1 and #2, which, as discussed above, can not protect OS and applications from compromises in 100%. And, to make it worse, do not offer any clue, whether the compromise actually occurred.

That’s why I’m trying so much to promote the idea of Verifiable Operating Systems, which should allow to at least find out (in a systematic way) whether the system in question has been compromised or not (but, unfortunately not to find whether the single-shot incident occurred). The point is that the number of required design changes should be fairly small. There are some problems with it too, like e.g. verifying JIT-like code, but hopefully they can be solved in the near feature. Expect me to write more on this topic in the near feature.

Special thanks to Halvar Flake for eye-opening discussions about sound code analyzers and OS security in general. \ No newline at end of file diff --git a/_posts/2007-04-01-human-factor.html b/_posts/2007-04-01-human-factor.html deleted file mode 100644 index 2423c6e..0000000 --- a/_posts/2007-04-01-human-factor.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: The Human Factor -date: '2007-04-01T14:10:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:50.038+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4456022256785429816 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/04/human-factor.html ---- - -When you go to some security conferences, especially those targeted for management staff, you might get the impression that the only problem in the security field that mankind is facing today is… that we’re too stupid and we do not know how to use the technology properly. So, we, use those silly simple passwords, allow strangers to look at our laptop screens over our shoulders, happily provide our e-bank credentials or credit card numbers to whoever asks for them, etc… Sure, that’s true indeed – many people (both administrators and users) do silly mistakes and this is very bad and, of course, they should be trained not to do them.

However, we also face another problem these days… A problem of no less importance then “the human factor”. Namely, even if we were perfectly trained to use the technology and understood it very well, we would still be defenseless in many areas. Just because the technology is flawed!

Think about all those exploitable bugs in WiFi drivers in your laptop or email clients vulnerabilities (e.g. in your GPG/PGP software). The point is, you, as a user can not do anything to prevent exploitation of such bugs. And, of course, the worst thing is, that you don’t even have any reliable way to tell whether somebody actually successfully attacked you or not – see my previous post. None of the so called “industry best practices” can help – you just need to hope that your system hasn’t been 0wned. And this is really disturbing…

Of course, you can chose to believe in all this risk assessment pseudo-science, which can tell you that your system is “non-compromised with 98% probability” or you can try to comfort yourself because you know that your competition has no better security they you… ;) \ No newline at end of file diff --git a/_posts/2007-04-20-understanding-stealth-malware.html b/_posts/2007-04-20-understanding-stealth-malware.html deleted file mode 100644 index ec4e05b..0000000 --- a/_posts/2007-04-20-understanding-stealth-malware.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Understanding Stealth Malware -date: '2007-04-20T15:18:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:37.816+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/Rii9-r9A9MI/AAAAAAAAABc/GYvliLAxxhg/s72-c/matrixdojo6006ad.gif -blogger_id: tag:blogger.com,1999:blog-24586388.post-7539069698433794020 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/04/understanding-stealth-malware.html ---- - -

Ever wondered whether Blue Pill really works or was just a PR stunt? Ever wanted to see how practical are various timing attacks against it? (And can even those “unpractical” be cheated?) Or how many Blue Pills inside each other can you run and still be able to play your favorite 3D game smoothly? Or how deep Alex can hook into Windows NDIS to bypass your personal firewall? Do you want to see Patch Guard from a “bird’s eye view” perspective? Or do you simply want to find out how well the latest Vista x64 kernel is protected? Ever wondered how rootkits like Deepdoor and Firewalk really worked? You can’t sleep, because you’re thinking constantly about how Blue Pill-like malware can be prevented? Does Northbridge hacking sound sexy to you? :)

At the very end of July, during the Black Hat Briefings in Las Vegas, Alex Tereshkin and I will be running a training “Understanding Stealth Malware”, where you should be able to find answers to the above questions plus many more.

The training will feature many previously unpublished techniques, implementation details, and of course lots of brand new code, developed especially for the training. The code will include sample rootkits similar to Deepdoor, Firewalk, Blue Pill and Delusion (but redesigned and rewritten from scratch) as well as some more exotic things, like e.g. anti-hardware-forensic attacks.

As the training will be focused on Windows platform and Vista x64 specifically, we will also present some new kernel attacks against latest Vista x64 builds. These attacks, of course, work on the fly and do not require system reboot and are not afraid of the TPM/Bitlocker protection. (Although they could also be used to bypass Vista DRM protection, this subject will not be discussed during the training).

Attendees will mostly work with kernel debuggers in order to analyze and understand various techniques used in system compromises. The main goal of the training is to help students understand contemporary malware techniques, enable them to see the “bigger picture” over technical details and show possible approaches to compromise detection.

Thus the course is primarily targeted for developers of security products, forensic investigators, pen-testers and OS developers. It’s recommended that attendees have a basic knowledge of OS design and implementation (specifically Windows), C programming, at least basic experience with debugging and ability to understand fragments of assembler code (IA32 architecture).

For ethical reasons we want to limit the availability of this course to only "legitimate" companies, thus we require that you specify your official business email address and company's website when registering for the course.

Pre-configured workstations will be provided, so there is no need to prepare for the course in any specific way. You can find more information and register for the training on the blackhat website. Please note that there will be only 2 public classes of this training this year – both during the Black Hat Briefings (28/29 and 30/31 of July). More classes will be available only in the form of on-site trainings for corporate customers.

Please also note that the number of seats is hard-limited by the number of available workstations, so we encourage registering early.

As for the other news – I have just quit COSEINC last week and I’m in the process of establishing a new security consulting and research company. For now I can only betray the name: Invisible Things Lab - expect more details to be posted here in the coming weeks :) \ No newline at end of file diff --git a/_posts/2007-05-18-invisible-things-lab-bitlockertpm.html b/_posts/2007-05-18-invisible-things-lab-bitlockertpm.html deleted file mode 100644 index c354eb9..0000000 --- a/_posts/2007-05-18-invisible-things-lab-bitlockertpm.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Invisible Things Lab, Bitlocker/TPM bypassing and some conference thoughts -date: '2007-05-18T13:57:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:20.690+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1481677447138628382 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/05/invisible-things-lab-bitlockertpm.html ---- - -Invisible Things Lab’s website is now online! However, we still don’t have a cute logo because the company where I order the logo presented me with something completely unacceptable and disappointing after taking a week to prepare it :( Alex is really pissed of by this and I hope we will find something nice really soon...

Anyway, as you can see on the website, we don’t have any product and we focus on consulting and research-on-demand only. We mainly target three groups of customers:

First there are security vendors and OS vendors, to whom we offer our product assessment and advisory services. E.g. we can take a look at the design and implementation of a rootkit detector, host IPS or some custom hardened OS and point out all the weaknesses we see and also give advices what we think should be improved. We can advise about both the design and implementation side, sometimes without requiring all the product internal information being shared with us.

The other group is corporate customers interested in unbiased evaluation of security technology they're planning to deploy. Here we can look at the products they consider to deploy and point out pros and cons of each of them and suggest the best choice. So e.g. we can look at various “information leak protectors” and tell how sophisticated techniques are required to bypass each of them (because, of course, all such products are bypassable). We can also advise about various technical aspects of implementing corporate security policies.

Finally there are law enforcement customers and forensic investigators, whom we can help to stay up-to-date with current offensive technology as used e.g. by modern malware, by running various trainings and seminars. We can also share our experience with advanced stealth malware and covert channels to help investigate more sophisticated incidents.

Ok, so what we don’t do? Well, we do not do classic code auditing, understood as looking for implementation bugs like e.g. buffer overflows or race conditions. We still do implementation analysis, when e.g. assessing a product, but we look only at feature-specific parts of implementation – e.g. how the kernel protection or hooking has been implemented in a given host IDS.

We also don’t do web application security nor database security. There are people who have much more experience in this area then we have, so go to them!

Finally, we do not do penetration testing, simply because I don’t believe this is the best way of improving system security. I can run 101 exploits against your server and even though all of them fail, still it tells nothing about how secure is your system. Maybe there is some little detail I missed which caused all my exploits to fail just because I was tired that day? I would definately prefer to talk to the security team and also to the server admin and ask them what they have done to secure the server in the first place. If I though that their approach has some weakness then I would simply advise them what I think they should improve. Later I would kindly ask them to give me the root/admin access so that I could verify by myself whether the advices have been implemented... This approach has an advantage of being much more complete and usually taking much less time over the standard pen-testing. It has one disadvantage though – it’s not a good material for a Hollywood movie ;)

So, all in all, we focus on OS security in contrast to application security and network security (although we can be helpful with detecting covert channels in a corporate enviroment).

Speaking of OS security (and leaving the subject of my new company for a second) – I recently had a pleasure of giving a keynote speech at the NLUUG conference in the Netherlands, which this year was focused on virtualization technology. The conference was really nice (even though 2/3 of the talks were in Dutch) and there were couple of talks I liked in particular. First, there was a talk about Microhypervisor Verification by Hendrik Tews. Author presented the overview of the Nizza architecture (which was interesting, but in my opinion way too complicated and impractical for using it anywhere outside the lab). He also talked about challenges with formal verification of kernel and microkernel, which was very interesting. I talked to him later about feasibility of verifying the monolithic kernels, like those in Linux or Windows and, not surprisingly, he said it's not really possible these days and in the coming years, because of the cost (I need to mention that he does the verification "manually").

There was also a nice presentation about Kernel Virtual Machine Monitor (KVM) for Linux by one of its developer Avi Kivity. I think in the future it might be a strong competition to Xen, especially after they add support for IOMMU technology (which I think is expected to be introduced on AMD and Intel processors somewhere in 2008). I really like the design of KVM which takes advantage of many features already present in Linux kernel without implementing them from scratch.

Finally there was a presentation by another polish female researcher, Asia (Joanna) Slowinska. She talked about Prospector, a system built on top of a CPU emulator (based on Qemu) to automatically generate generic signatures for buffer overflow attacks (both heap and stack based). On a side note, Asia (which by the way is pronounced “Ashyia” and not like the continent!) is the short form of the name Joanna, so basically almost everybody in Poland calls me Asia as well ;)

There was also a talk by Anil Madhavapeddy of XenSource, but in my opinion it was a little bit too much of a “marketing” presentation rather then a technical one (even though Anil turned out as a very technical and knowledgeable guy).

I also had some meetings at the Vrije Universiteit in Amsterdam the following day, where I met with MINIX3 developers and prof. Andrew Tanenbaum (what a fool I was that I didn’t bring one of his famous books to get an autograph:/). I must say really like the design of MINIX3, which keeps all the drivers (and other system components) in usermode, in separated address spaces. This is, however, still problematic today, as without IOMMU we can’t really fully protect kernel from usermode drivers, because of the potential DMA attacks – i.e. a driver can setup a DMA write-transaction to overwrite some part of the micro kernel memory, thus owning the system completely. But I guess we will all have processors supporting IOMMU within the next 1-2 years.

Just two days ago I delivered another keynote presentation, this time at the InfoSecurity conference in Honk Kong, organized by Computer World. My speech was about “Human Factor vs. technology” and basically the message I tried to pass was that the technology is just as flawed as the so called “human factor”, understood here as an user’s unawareness and administrator’s incompetence. I guess this is something perfectly obvious for most of technical security people, who at least once wrote an exploit by themselves. But apparently not for the security management stuff... So, even though it was by far the least technical speech I have every gave in my life, it was received as way too technical for many attendees (who were like “OMG, that was a shock!”). And I didn’t even mention any specific research I’ve done – just some standard stuff about exploits etc...

I also took part in a discussion panel with several C-level executives, some of them being CIOs for some huge institutions, others being C-level marketing guys from several security vendors.

So, I must say I was really struck by the complete lack of understanding of even the basic technical concepts behind IT security shown by some of the management people who were there. I understand, of course, that typical CIO or CSO doesn’t need to know much about technical details about how exploits and malware work, but their naivety was really shocking!

Speaking of conferences, I own apologizes to the organizers of Confidence 2007 conference in Krakow, Poland. After spending several days in the Netherlands, experiencing their rainy weather and also because of the shortage of sleep in the recent weeks due to some traveling (especially lack of my afternoon naps), I got sick and couldn’t make it to the conference. I heard it was very good this year, featuring many international speakers and, of course, Krakow, which is one of the nicest cities in Poland.

Finally, I would like to explain a little confusion around our Black Hat training. Shortly after we announced the training, there appeared some press articles which incorrectly described the kernel attacks that we’re going to present in Vegas. In the original blog post I said that these attacks “work on the fly and do not require system reboot and are not afraid of the TPM/Bitlocker protection”, but some people understood that we were going to actually present ways to defeat Bitlocker Drive Encryption (BDE). This is quite a misunderstanding, because those attacks, which allow for inserting unsigned code into Vista x64 kernel, are “not afraid of TPM/Bitlocker” simply because they can be executed on the fly and thus do not require system reboot, while Bitlocker’s task is to secure the boot process, but not to prevent the kernel against compromises!

However I intentionally mentioned TPM and Bitlocker, just to stress that those technologies have simply nothing to do with stopping rootkits and kernel compromises, provided you’re using kernel attacks which do not require system reboot, even though they’re often advertised as if they had… So, basically, even if we could break the BDE, it still wouldn’t give us any benefit these days. The situation will change within 2-3 years or so, i.e. when Microsoft will eventually come up with their own hypervisor, but that’s a different story... \ No newline at end of file diff --git a/_posts/2007-06-28-were-ready-for-ptaceks-challenge.html b/_posts/2007-06-28-were-ready-for-ptaceks-challenge.html deleted file mode 100644 index 85d43f4..0000000 --- a/_posts/2007-06-28-were-ready-for-ptaceks-challenge.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: We're ready for the Ptacek's challenge! -date: '2007-06-28T13:23:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:06:10.364+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4491938186982426867 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/06/were-ready-for-ptaceks-challenge.html ---- - -Thomas Ptacek and company just came up with this funny challenge to test our Blue Pill rootkit. And, needles to say, the Invisible Things Lab team is ready to take their challenge, however with some additional requirements, that would assure the fairness of the contest.

First, we believe that 2 machines are definitely not enough, because the chance of correct guess, using a completely random (read: unreliable) detection method is 50%. Thus we think that the reasonable number is 5 machines. Each of them could be in a state 0 or 1 (i.e. infected or not). On each of this machines we install two files: bluepill.exe and bluepill.sys

The .sys file is digitally signed, so it loads without any problem (we could use one of our methods for loading unsigned code on vista that we're planning to demonstrate at BH, but this is not part of the challenge, so we will use the official way).

The bluepill.exe takes one argument which is 0 or 1. If it's 1 it loads the driver and infects the machines. If it's 0 it also loads the driver, but the driver does not infect the machine.

So, on each of the 5 machines we run bluepill.exe with randomly chosen argument, being 0 or 1. We make sure that at least one machine is not infected and that at least one machine is infected.

After that the detection team runs their detector.exe executable on each machine. This program can not take any arguments and must return only one value: 0 or 1. It must act autonomously -- no human assistance when interpreting the results.

The goal of the detection team is to correctly mark each machine as either being infected (1) or not (0). The chance of a blind guess is:

1/(2^5-2) = 3%

The detector can not cause system crash or halt the machine -- if it does they lose. The detector can not consume significant amount of CPU time (say > 90%) for more then, say 1 sec. If it does, then it's considered disturbing for the user and thus unpractical.

The source code of our rootkit as well as the detector should be provided to the judges at the beginning of the contests. The judges will compile the rootkit and the detector and will copy the resulting binaries to all test machines.

After the completion of the contest, regardless of who wins, the sources for both the rootkit and the detector will be published in the Internet -- for educational purpose to allow others to research this subject.

Our current Blue Pill has been in the development for only about 2 months (please note that we do not have rights to use the previous version developed for COSEINC) and it is more of a prototype, with primary use for our training in Vegas, rather then a "commercial grade rootkit". Obviously we will be discussing all the limitations of this prototype during our training. We believe that we would need about 6 months full-time work by 2 people to turn it into such a commercial grade creature that would win the contest described above. We're ready to do this, but we expect that somebody compensate us for the time spent on this work. We would expect an industry standard fee for this work, which we estimate to be $200 USD per hour per person.

If Thomas Ptacek and his colleges are so certain that they found a panacea for virtualization based malware, then I'm sure that they will be able to find sponsors willing to financially support this challenge.

As a side note, the description for our new talk for Black Hat Vegas has just been published yesterday. \ No newline at end of file diff --git a/_posts/2007-08-03-virtualization-detection-vs-blue-pill.html b/_posts/2007-08-03-virtualization-detection-vs-blue-pill.html deleted file mode 100644 index 902bd1d..0000000 --- a/_posts/2007-08-03-virtualization-detection-vs-blue-pill.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Virtualization Detection vs. Blue Pill Detection -date: '2007-08-03T06:01:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:46.916+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6894036738428375097 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/08/virtualization-detection-vs-blue-pill.html ---- - -So, it’s all over the press now, but, as usual, many people didn’t quite get the main points of our Black Hat talk. So, let’s clear things up... First, please note that the talk was divided into two separate, independent, parts – the first one about bypassing vista kernel protection and the second one about virtualization based malware.

The message of the first part was that we don’t believe it’s possible to implement effective kernel protection on any general purpose OS based on monolithic kernel design.

The second part, the one about virtualization, had several messages...
  1. The main point was that detecting virtualization is not the same as detecting virtualization based malware. As hardware virtualization technology gets more and more widespread, many machines will be running with virtualization mode enabled, no matter whether blue pilled or not. In that case blue pill-like malware doesn’t need to cheat that virtualization is not enabled, as it’s actually expected that virtualization is being used for some legitimate purposes. In that case using a "blue pill detector", that in fact is just a generic virtualization detector is completely pointless.

    Obviously in such scenarios blue pill-like malware must support nested hypervisors. And this is what we have implemented in our New Blue Pill. We can run tens of blue pills inside each other and they all work! You can try it by yourself, but you should disable comport debug output to do more then twenty nested pills. We still fail at running Virtual PC 2007 as a nested hypervisor (when it’s guest switches to protected mode), but we hope to have this fixed in the coming weeks (please note that VPC’s hypervisor doesn’t block blue pill from loading – see our slides for more info).

    In other words, if somebody announces to the world that they can fight virtualization based malware using generic virtualization detectors, it’s like if they said that they can detect e.g. a botnet agent, just by detecting that an executable is using networking!

  2. We have also decided to discuss how blue pill could potentially cheat those generic virtualization detectors, even though we don’t believe it would be necessary in the coming years, as everything will be virtualized anyways (see previous point). But, we still decided to look into some of the SVM detection methods. First, we found out that many methods that people described as a way to detect virtualization do not work in the simple form as they were described. We took a closer look e.g. at the TLB profiling methods that were suggested by several researchers as a reliable method for virtualization detection. However all the papers that were describing this method missed the fact that some of the caches are not fully associative and one needs to use special effort (which means additional complexity) to make sure to e.g. fill the whole TLB L2 buffer. Obviously we provided all the necessary details of how to write those detectors properly (we even posted one such detector).

    In other words - we believe that it will always be possible to detect virtualization mode using various tricks and hacks, but: 1) those hacks could be forced to be very complex and 2) in case virtualization is being used on the target computer for some legitimate purposes all those methods fail anyway (see point 1).

  3. Some people might argue that maybe then we should build these virtualization detectors into all the legitimate hypervisors (e.g. Virtual PC hypervisor), so that they know at least whether they are being run on a native machine or maybe inside blue pill. However this approach contradicts the rules we use to build secure and effective hypervisors. These rules say that hypervisors should be as small as possible and there should be no 3rd party code allowed there.

    Now imagine that A/V company try to insert their virtualization detectors (which BTW would have to be updated from time to time to support e.g. new processor models) into hypervisors – if that ever happened, it would be a failure of our industry. We need other methods to address this threat, methods that would be based on documented, robust and simple methods. Security should not be built on bugs, hacks and tricks!

We posted the full source code of out New Blue Pill here. We believe that it will help other researchers to to analyze this threat and hopefully we will find a good solution soon, before this ever become widespread.

Happy bluepilling!

On a side note: now I can also explain (if this is not clear already) how we were planning to beat our challengers. We would simply ask them to install Virtual Server 2005 R2 on all the test machines and we would install our New Blue Pill on just a few of them. Then their wonderful detectors would simply detect that all the machines have SVM mode enabled, but that would be a completely useless information. Yes, we still believe we would need a couple of months to get our proof-of-concept to the level we would be confident that we will win anyway (e.g. if they used memory scanning for some “signature).

BTW, you might be wondering why I introduced the “no CPU peek for more then 1s” requirement? I will leave finding an answer as an exercise from a psychology to my dear readers ;) \ No newline at end of file diff --git a/_posts/2007-08-31-tricky-tricks.html b/_posts/2007-08-31-tricky-tricks.html deleted file mode 100644 index 424d2d0..0000000 --- a/_posts/2007-08-31-tricky-tricks.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Tricky Tricks -date: '2007-08-31T20:25:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:37.514+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3681389965289346657 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/08/tricky-tricks.html ---- - -I want to make a short philosophical comment about how some approaches to building security are wrong.

Let’s move back in time to the last decade of the XX century, to the 90’s... Back in those days one of the most annoying problems in computer security was viruses, or, more precisely, executable file infectors. Many smart guys were working on both sides to create more stealthy infectors and also better detectors for those infectors…

Russian virus write Z0mbie with his Mistfall engine and Zmist virus went probably closest to the Holy Grail in this arm race – the creation of an undetectable virus. Peter Szor, a Symantec’s chief antivirus researcher, wrote about his work in 2001:

Many of us will not have seen a virus approaching this complexity for a few years. We could easily call Zmist one of the most complex binary viruses ever written.

But nothing is really undetectable if you have a sample of the malware in your lab and can spent XXX hours analyzing it – you will always come up with some tricks to detect it sooner or later. The question is – were any of the A/V scanners back then ready to detect such an infection if it was a 0day in the wild? Will any of the today’s scanners detect a modified/improved Zmist virus, or would they have to count on the virus author being nice enough to send them a sample for an analysis first?

Interestingly, file infectors stopped being a serious problem a few years ago. But this didn’t happen because the A/V industry discovered a miracle cure for viruses, but rather because the users’ habits changed. People do not exchange executables that often as 10 years ago. Today people rather download an executable from the Web (legal or not) rather then copy it from a friend’s computer.

But could the industry have solved the problem of file infectors in an elegant, definite way? The answer is yes and we all know the solution – digital signatures for executable files. Right now, most of the executables (but unfortunately still not all) on the laptop I’m writing this text on are digitally signed. This includes programs from Microsoft, Adobe, Mozilla and even some open source ones like e.g. True Crypt.

With digital signatures we can "detect" any kind of executable modifications, starting form the simplest and ending with those most complex, metamorphic EPO infectors as presented e.g. by Z0mbie. All we need to do (or more precisely the OS needs to do) is to verify the signature of an executable before executing it.

I hear all the counter arguments: that many programs out there are still not digitally signed, that users are too stupid to decide which certificates to trust, that sometimes the bad guys might be able to obtain a legitimate certificate, etc...

But all those minor problems can be solved and probably will eventually be solved in the coming years. Moreover, solving all those problems will probably cost much less then all the research on file infectors cost over the last 20 year. But that also means no money for the A/V vendors.

Does it mean we get a secure OS this way? Of course not! Digital signatures do not protect against malicious code execution, e.g. they can't stop an exploit from executing its shellcode. So why bother? Because certificates allow to verify that what we have is really what we should have (e.g. that nobody infected any of our executable files). It’s the first step in ensuring integrity of an OS.

The case of digital signatures vs. file infectors is a good example of how problems in security should be addressed. But we all know that the A/V industry took a different approach – they invested zillions of dollars into research on polymorphic virus detection, built advanced emulators for analysis of infected files, etc. The outcome – lots of complex heuristics that usually work quite well against known patterns of infection, but are often useless against new 0day engines and also are so complex that nobody really knows how many false positives they can produce and how buggy the code itself is. Tricks! Very complex and maybe even interesting (from a scientific point of view) tricks.

So, do I want to say that all those years of A/V research on detecting file infections was a waste time? I’m afraid that is exactly what I want to say here. This is an example of how the security industry took a wrong path, the path that never could lead to an effective and elegant solution. This is an example of how people decided to employ tricks, instead looking for generic, simple and robust solutions.

Security should not be built on tricks and hacks! Security should be built on simple and robust solutions. Oh, and we should always assume that the users are not stupid – building solutions to protect uneducated users will always fail. \ No newline at end of file diff --git a/_posts/2007-10-17-thoughts-on-browser-rootkits.html b/_posts/2007-10-17-thoughts-on-browser-rootkits.html deleted file mode 100644 index df2e147..0000000 --- a/_posts/2007-10-17-thoughts-on-browser-rootkits.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Thoughts On Browser Rootkits -date: '2007-10-17T13:41:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:28.276+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8414578753020362950 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/10/thoughts-on-browser-rootkits.html ---- - -Petko D. Petkov from GNUCITIZEN wrote a post about Browser Rootkits, which inspired me to give some more thoughts on this subject. Petko is an active researcher in the field of client-side exploits (e.g. recent Adobe Acrobat PDF flaw), so it’s not a surprise that he’s thinking about browsers as a natural environment for rootkits or malware. Also it’s quite common to hear an opinion these days that browsers become so complicated and so universal that they are almost like operating systems rather than just standard applications.

Petko in his post gives several ideas of how browser-based malware could be created and I’m sure that we will see more and more such malware in the near future (I would actually be surprised if it didn’t exist already). His main argument for creating “Browser Rootkits” is that they would be “closer to the data”, which is, of course, undisputable.

The other argument is the complexity of a typical browser like e.g. Firefox or Internet Explorer. It seems like we have a very similar situation here to what we have with "classic" operating systems like e.g. Windows. Windows is so complex that nobody (including Microsoft) can really spot all the sensitive places in the kernel where a rootkit might "hook" – thus it’s not possible to effectively monitor all those places. We have a similar problem with Firefox and IE because of their extensible architecture (think about all those plugins, add-ons, etc) – although we could examine the whole memory of firefox.exe process, we still would not be able to decide whether something bad is there or not.

I’m even quite sure that my little malware taxonomy could be used here to classify Firefox or IE infections. E.g. the browser malware of type 0, would be nothing else then just additional plugins, installed using official API and not trying to hide from browser reporting mechanisms (in other words they still will be visible to users when they will ask the browser to list all the installed plugins). And we will have type I and type II infections, the former would be simply modifying some code (be that a code of a browser or maybe of some other plugin) while the latter would be hooking some function pointers or changing some data only – this all to hide the offensive module.

BTW, there is a little problem with classifying JIT-generated code – should it be type I or type II infection? I don’t know the answer for now and I welcome all the feedback on this. And we can even imagine type III infections of browsers, but I will leave it as an exercise for my readers :)

So, should we expect the classic, OS-based rootkits to die and the efforts in the malware community to move towards creating Browser-based rootkits? I don’t think so. While the browser-based malware is and will definitely be more and more important problem, it has one disadvantage comparing to classic OS-based malware. Namely it’s quite easy to avoid, or at least minimize the impact from browser-based rootkits. It’s just enough to use two different browsers – one for sensitive and the other one for non-sensitive operations.

So, for example, I use IE to do all my sensitive browsing (e.g. online banking, blogger access, etc), while Firefox to do all the casual browsing, which includes morning press reading, google searching, etc. The reason I use Firefox for non-sensitive browsing doesn’t come from the fact that I think it’s more secure (or better written) then IE, but because I like using NoScript and there is no similar plugin for IE...

Of course, an attacker still might exploit my non-sensitive browser (Firefox) and then modify configuration or executable files that are being used by my sensitive browser (IE). However this would require write-access to those files. This is yet another reason why one should run the non-sensitive browser with limited privileges and technologies like UAC in Vista help to achieve it. I wrote an article some time ago about how one can configure Vista to implement almost-full privilege separation.

Of course, even if we decide to use 2 different browsers - one for sensitive and the other one for non-sensitive browsing, an attacker still might be able to break out from account protection via a kernel mode exploit (e.g. exploiting one of the bug that Alex and I presented in Vegas this year). However this would not be a browser malware anymore – this would be a good old kernel-mode malware :)

A solution to this problem will probably be the use of a Virtual Machine to run the non-sensitive browser. Even today one might download e.g. the Browser Appliance from VMWare and we will see more and more solutions like this in the coming years I think. This BTW, will probably stimulate more research into VM escaping and virtualization-based malware.

Of course, the very important and sometimes non-trivial question is how to decide which type of browsing is sensitive and which is non-sensitive. E.g. most people will agree the online banking is a sensitive browsing, but what about webmail? Should I use my sensitive or non-sensitive browser for accessing my mail via web? Using a sensitive browser for webmail is dangerous, as it’s quite possible that it could be infected via some malicious mail that would be in our inbox. While using the non-sensitive browser for webmail is also not a good solution, as most people would like to consider mail as sensitive and would not like to allow the possibly-compromised browser to learn the password for the mailbox.

I avoid this problem by not using a browser for webmail and by having a special account just for running a thunderbird application (see again my article on how to do this in Vista). It works well for me.

Of course, one could also do the same for browser – i.e. instead of having 2 browsers (i.e. sensitive and non-sensitive), one could have 3 or more (maybe even 3 different virtual machines). But the question is how many accounts should we use? One for email, one for sensitive browsing, one for non-sensitive, one for accessing personal data (e.g. pictures)...? I guess there is no good answer for this and it depends on the specific situation (i.e. different configuration for home user that uses computer mostly for "fun" and different for somebody using the same computer for both work and "fun", etc...)

On a side note – I really don’t like the idea of using a web browser to do "everything" – I like using browser to do browsing, while to do other things to use specialized applications. I like having my data on my local hard drive. It’s quite amazing that so many people these days use Google not only for searching, but also for email, calendaring and documents editing – it’s like giving all your life secretes on a plate! Google can now correlate all your web search queries with a specific email account and even see who are you meeting with next evening and also know what a new product your company will be presenting next week, as you prepared you presentation using Google Documents. I’m not sure whether it’s Google or the people’s naivety that disturbs me more... \ No newline at end of file diff --git a/_posts/2007-10-25-razor-thin-hypervisors.html b/_posts/2007-10-25-razor-thin-hypervisors.html deleted file mode 100644 index 06b79e5..0000000 --- a/_posts/2007-10-25-razor-thin-hypervisors.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Razor-Thin Hypervisors -date: '2007-10-25T19:55:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:17.923+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7805915543221342080 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2007/10/razor-thin-hypervisors.html ---- - -I just came back from Stockholm where I attended the Virtualization Forum, and saw several, quite interesting vendor presentations. One that caught my attention was a talk by VMware, and especially the part that talked about the new ESX 3i hypervisor and presented it as "razor-thin". This "razor-thin" hypervisor will have, according to VMWare, the footprint "of only 32MB".

My regular readers might sense that I’m a bit ironic here. Well, 32MB of code is definitely not a "razor-thin" hypervisor in my opinion and it’s not even close to a thin hypervisor... But why am I so picky about it? Is it really that important?

Yes, I think so, because the bigger the hypervisor the more chances that there is a bug somewhere out there. And one of the reasons for using virtual machines is to provide isolation. Even if we use virtualization because of business reasons (server consolidation), still we want each VM to be properly isolated, to make sure that if an attackers "gets into" one VM, she will not be able to 0wn all the other VMs on the same hardware… In other words, isolation of VMs, is an extremely important feature.

During my presentation I also talked about thin hypervisors. I first referenced a few bugs that were found in various VMMs in the recent months by other researchers (congrats to Rafal Wojtczuk of McAfee for some interestingly looking bugs in VMWare and Microsoft products). I used them as an argument that we should move towards very thin hypervisor architecture, exploiting hardware virtualization extension as much as possible (e.g. Nested Paging/EPT, IOMMU/DEV/NoDMA, etc) and avoiding doing things "in software".

Nobody should be really surprised seeing VMMs bugs – after all we have seen so many bugs in OS kernels over years, so no surprise we will see more and more bugs in VMMs, unless we switch to very thin hypervisors, so thin that it would be possible to understand and verify their code by one person. Only then we would be able to talk about security advantage (in terms of isolation) offered by VMMs comparing to traditional OSes.

I couldn’t refrain myself from mentioning that the existence of those bugs in popular VMMs clearly shows that having a VMM already installed doesn’t currently prevent from the "Blue Pill threat" – a point often expressed by some virtualization vendors, who notoriously try to diminish the importance of this problem (i.e. the problem of virtualization based malware).

I also announced that Invisible Things Lab has just started working with Phoenix Technologies. Phoenix is the world leader in system firmware, particularly known for providing BIOSes for PCs for almost 25 years, and currently is working on a new product called HyperCore that would be a very thin and lightweight hypervisor for consumer systems. ITL will be helping Phoenix to ensure the security of this product.

HyperCore hypervisor will use all the latest hardware virtualization extensions, like e.g. Nested Paging/EPT to minimize the unnecessary complexity and to provide negligible performance impact. For the same reasons, the I/O access will go through almost natively, just like in case of our Blue Pill...

Speaking about Blue Pill – Phoenix is also interested in further research on Blue Pill, which will be used as a test bed for trying various ideas – e.g. nested virtualization, which might be adopted in the future versions of HyperCore to allow users to use other commercial VMMs inside their already-virtualized OSes. Blue Pill’s small size and minimal functionality makes it a convenient tool for experimenting. Phoenix will also support The Blue Pill Project which means that some parts of our research will be available for other researchers (including code)!

In case you still feel like having a look into my slides, you can get them here. \ No newline at end of file diff --git a/_posts/2008-03-31-kick-ass-hypervisor-nesting.html b/_posts/2008-03-31-kick-ass-hypervisor-nesting.html deleted file mode 100644 index 3991e71..0000000 --- a/_posts/2008-03-31-kick-ass-hypervisor-nesting.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Kick Ass Hypervisor Nesting! -date: '2008-03-31T20:02:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:05:00.261+01:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/R_EoN9WFV3I/AAAAAAAAABk/3Zo6oMEO8eQ/s72-c/XP+inside+VPC+inside+NBP.bmp -blogger_id: tag:blogger.com,1999:blog-24586388.post-7426857732980068109 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/03/kick-ass-hypervisor-nesting.html ---- - -Remember how at the Black Hat Vegas 2007 I said that we still didn't support virtualization of full VMMs, like e.g. Virtual PC 2007 with hardware virtualization enabled, and that currently we could only run very simple hypervisors inside our New Blue Pill (like e.g. other NBPs inside NBP)? Remember how I said that we were working on this and should have a solution in about 2 months from then?

So, just about 2 weeks ago we did it! We can now virtualize complex hypervisors, like e.g. Virtual PC 2007 or Virtual Box with SVM turned on (BTW, we can also run VMWare Workstation, but that doesn't count, as on AMD processors it doesn't make use of SVM instructions). We also have a prototype code that allows to run nested hypervisors on VT-x but that code requires a bit of more polishing (oh, didn’t you know that our NBP also supports VT-x these days?).

I couldn't resist not to use my favorite Matrix analogy to describe what we do here: imagine Neo, who bravely followed The White Rabbit and finally decided to swallow The Red Pill, eventually awakes on The Nebuchadnezzar ship just to find out later that this whole "real world" is... just another Matrix...

I don't have a nice Matrix picture for that, so instead I will just show you a picture of a Virtual PC 2007 running inside an already bluepilled Vista and running Windows XP as its own guest. You can see that we use our "bpknock" testing program just to show we can intercept events in both the guest (i.e. the Vista that hosts the VPC hypervisor) as well as in the nested guest (the XP running inside the Virtual PC). This bpknock program simply executes CPUID instruction with some magic value in the RAX register and NBP intercepts that and answers with a magic RAX. BTW, there was no special reason to chose CPUID instruction for that, normally we don't need to intercept CPUID on AMD at all, so we could have chosen pretty much anything else, e.g. magic output to some magic I/O port.



It's worth mentioning that the only other working example of nested hardware virtualization I'm aware of is the IBM z/VM hypervisor for the IBM z series mainframe. If anybody knows any other example, please send me a link.

The research on nested virtualization has been supported by Phoenix Technologies, as the nested virtualization has also some positive applications. Phoenix is working on a cool product called HyperSpace. It consists of a hypervisor (called the "HyperCore") that allows running a few unmodified OSes inside hardware virtual machines so users can switch between them just like if they were virtual spaces on Mac or Linux. At the beginning there will be two virtual machines available: one running standard Vista and the other one based on Linux, that would contain some useful functionality like e.g. a Web browser, an email client and a multimedia suite, and also there would be something called the "ManageSpace" to manage this all.

So, how this is going to be different from e.g. XEN? The difference is that XEN is focused on server applications, while HyperSpace is intended for notebooks, which means it puts lots of efforts to offer comparable graphics (and other devices) performance as we have on normal non-virtualized laptops. This all will be possible because of the recent virtualization technology advances like e.g. VT-d/IOMMU.

At the RSA conference in San Francisco next week, I will be giving a speech that will discuss some technical problems we had to solve in order to get hardware nested hypervisoring working on AMD and also how the situation looks on Intel. I will also discuss how this changes the security battlefield and why virtualization vendors should care.

Back to Blue Pill -- the brand new source code with full virtualization support on AMD is now available on bluepillproject.org (you will need WDK6000 or newer to build it). Note that the (experimental) code for nested virtualization on Intel VT-x has been removed in this public version, leaving only the basic functionality if we run NBP on an Intel processor.

Also, please note that the code for AMD-v, even though it proved to be very stable, is still just a proof of concept. This means for example, that we don’t do any error-checks in the SVM instruction handlers, so it’s trivial for the nested hypervisor to simply crash the whole system if executing one of the SVM instructions with incorrect arguments or in an incorrect situation (e.g. CPL > 0). But that is hardly a problem for Blue Pill, as the guest isolation has never been a goal here. Of course, this could be simply addressed by adding a few more lines of code to each handler that would check for error conditions and inject #UD or #GP back to the nested hypervisor if it executed something incorrectly. Of course, we’re too lazy to code that ;)

So, what’s next? Well, we hope to show something even cooler at this year’s Black Hat Vegas, but I won’t say anything more now. \ No newline at end of file diff --git a/_posts/2008-04-09-rsa-absurd.html b/_posts/2008-04-09-rsa-absurd.html deleted file mode 100644 index 202a0b3..0000000 --- a/_posts/2008-04-09-rsa-absurd.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: The RSA Absurd -date: '2008-04-09T08:43:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:04:44.478+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1108669651271949087 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/04/rsa-absurd.html ---- - -Today I was giving a speech at the RSA Conference in San Francisco. The RSA is a really big conference and also seems to me like a very well organized one – e.g. they have all those computers at the registration hall where you put your name and then it immediately says to which check-in counter you should proceed and then when you get there they already have a badge waiting for you. Pretty cool stuff.

So my speech turned out to be scheduled in a very small room, say with seats for 100-200 people only (I haven't counted exactly). But then it turned out that there are more people interested in seeing the speech, so, as it usually happens on conferences, people started seating on the floor and also standing at the back of the room. I would say there was about 30% overflow, but still they could fit ok in the room. And then came this guy from the conference and said that all people who don’t have a seat should leave the room! It turned out that this is a fire regulation.

Interestingly it was perfectly ok for the additional people to stay in the room, provided they arranged for additional chairs for themselves. In other words it was fine for people to sit and block the main aisle, provided they sit on chairs, but they couldn’t stay and sit on the same aisle without having a chair (maybe a "certificated" chair also), as that would be against the fire regulations!

Yes, I know there are more examples of stupid pseudo-security rules (think airports), but, come on, this is on of the most well known security conference...

That situation annoyed me so much (because, of course, it turned out to be impossible to arrange for the additional chairs, so all those people had to leave) that I decided to submit this story to my blog using the totally unsecured public WiFi in my hotel. It was really unwise for me to do that, as Google’s Blogger uses HTTPS only for authentication (i.e. the login screen) but then it switches back to the good old plain text HTTP, making it possible for some evil guy sitting in the lobby to hijack my session. Is it that I miss something here or Google simple forgot that it is 2008 and not the 90’s anymore? Anyway, I'm just taking this risk bravely, hoping that the potential attacker, seeing my determination here, would refrain themselves from compromising this blog.

I know, I know, instead of complaining about Google, I should just move my blog to some other place. One day that’s gonna happen for sure :) \ No newline at end of file diff --git a/_posts/2008-04-12-most-stupid-security-news-ever.html b/_posts/2008-04-12-most-stupid-security-news-ever.html deleted file mode 100644 index 448bee4..0000000 --- a/_posts/2008-04-12-most-stupid-security-news-ever.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: The Most Stupid Security News Ever -date: '2008-04-12T18:45:00.003+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:04:32.405+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6179059977710695477 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/04/most-stupid-security-news-ever.html ---- - -Seems like the BBC reporters have a shortage of subjects to write about these days… Maybe the next winter we will also be able to read about how many snowflakes fell during Christmas all over the world or something like that (which BTW, would still be way more interesting that the news quoted above).

I remember that some time ago, a group of researchers used automatic generators to create a few tens of thousands of variants of some malware, just to do some testing of A/V engines. And I remember how all the A/V people were complaining how irresponsible that was bla bla bla, as now they would have to work after hours to fight all this new malware. What a BS!

For any given class of a bug (think: exploits), or a file infection method (think: viruses), or a system compromise technique (think: rootkits, stealth malware), one can come up with pretty much infinite number of examples that would be exploiting the specific bug, the specific file infection method, or the specific system compromise technique. One virus would display you a “Hello, you’re being 0wned, sir.” Message, while the other one would just flash your keyboard leds. Sure, two different beings, but if exploiting the same mechanisms, also the protection against them is the same.

But, I know, it looks so cool in the news to read: “The number of viruses, worms and trojans in circulation has topped the one million mark”. It’s most definitely a good way to scare all the housewives and make them to rush to the computer shop at the coroner to buy the brand new A/V product that already can detect 99.9% out of all those scary things out there. \ No newline at end of file diff --git a/_posts/2008-04-14-research-obfuscated.html b/_posts/2008-04-14-research-obfuscated.html deleted file mode 100644 index 4d2cb51..0000000 --- a/_posts/2008-04-14-research-obfuscated.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Research Obfuscated -date: '2008-04-14T08:21:00.008+02:00' -author: Joanna Rutkowska -tags: -- bad guys attacking joanna -modified_time: '2009-03-25T16:04:23.036+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1897611147293282587 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/04/research-obfuscated.html ---- - -Update 07-Sept-2008: Four months later after writing his open letter to me (see below), Christofer Hoff experienced on his own difficult it is for one to control the press, making sure it correctly reports what you say. In this blog entry he describes how he was terribly misquoted by a report after his Black Hat presentation and he also explicitly admits that "[I] was essentially correct in [my] assertion during our last debate that you cannot control the press, despite best efforts." and that "[he] humbly submit[s] to [me] on that point." :)

This article has been brought to my attention recently. It’s an “Open Letter to Joanna Rutkowska”, by Christofer Hoff over at the “Rational Survivability” blog. I decided to spend time reading and answering this piece as 1) technorati.com reported the blog’s authority as above 100 which suggests it has a reasonable number of readers, and also 2) because I believe this is a good example of the social engineering techniques used by my opponents and I couldn’t refrain myself from not commenting about this. Besides I felt a bit flattered that some individual decided to write an “Open Letter” to me, sort of like if I was a prime minister or some other important person ;)

Let me now analyze the letter, point by point:
  1. Fire rules! The first thing that Hoff accuses me of in his letter is myself being an irresponsible individual, not caring about safety of my audience (not a joke!):
    “As the room filled to over capacity before your talk began, you were upset and couldn't seem to understand why the conference organizers would not let people spill over from seats and sit on the floor and in the aisles to hear you speak. The fact that fire and safety codes prohibit packing a room beyond capacity was something you attributed to people being "...crazy in America." Go figure.”
    Dear Christofer, if you only read my recent blog post about this very specific incident, read thoroughly shall I say, you would notice this paragraph undoubtedly:
    “Interestingly it was perfectly ok for the additional people to stay in the room, provided they arranged for additional chairs for themselves. In other words it was fine for people to sit and block the main aisle, provided they sit on chairs, but they couldn’t stay and sit on the same aisle without having a chair (maybe a "certificated" chair also), as that would be against the fire regulations!”
    Conclusion: I was not so much picking upon the fire regulations that forced people to leave the room, but rather on the idiotic rule, that allowed those same people to stay in this very same room, provided they also had additional chairs with them.

  2. Type I vs. Type II hypervisors confusion. Hoff then switches to the actual content of the presentation and writes this:
    “When I spoke to you at the end of your presentation and made sure that I understood correctly that you were referring specifically to type-2 hosted virtualization on specific Intel and AMD chipsets, you conceded that this was the case.”
    This simply is an incorrect statement! On the contrary, when describing the security implications of nested virtualization (which was the actual new thing I was presenting at the RSA), I explicitly gave an example of how this could be used to compromise type I hypervisors. Kindly refer to slides 85-90 of my presentation that can be downloaded here.

    I said that the code we posted on bluepillproject.org indeed targets type II hypervisors and the only reason for that being that it has been built on top of our New Blue Pill code that was designed as a Windows kernel driver.

  3. Shit not giving. Mr. Hoff goes even further:
    “When I attempted to suggest that while really interesting and intriguing, your presentation was not only confusing to many people but also excluded somewhere north of 80% of how most adopters have deployed virtualization (type-1 "bare-metal" vs. type-2 hosted) as well as excluding the market-leading virtualization platform, your response (and I quote directly) was: I don't give a shit, I'm a researcher.”
    Now that was a hard blow! I understand that the usage of such a slang expression by an Eastern European female during an informal conversation with a native speaker must have made an impression on him! However, I couldn’t give such an answer to this very question, simply because of the reasons given in point #2 (see above).

    If I remember correctly, I indeed used this very American expression to answer somebody’s concern (undoubtedly our Christofer Hoff’s) that most of the type I hypervisors out there are based on monolithic hypervisor architecture, and not on the micro-hypervisor architecture (and that I should not try to convince people to switch to micro-hypervisor architecture). In that context it makes it more logical for me to use the “I’m a researcher” as an excuse for not caring so much that most people use monolithic based hypervisors. Obviously, the usage of micro-hypervisors would allow to better secure the whole VMM infrastructure. And I also said, that I don’t care what people are using today, because I try to help to build a product that would be secure in the future (Phoenix’s HyperCore).

  4. No obfuscation postulate. Hoff then comes up with some postulates that:
    “[I], as a researcher who is also actively courting publicity for commercial gain and speaking at conferences like RSA which are less technical and more "executive" in nature, you have a responsibility to clarify and not obfuscate (intentionally or otherwise) the facts surrounding your research.”
    This postulate is cleverly constructed because it also contains an embedded accusation of me being a commercially motivated researcher. Well, I never tried to hide that fact, and the reason for this is very simple: I consider security research as my job, and one of the primary goals of any job is to… bring commercial gain to the individual doing the job.

    Second, I really don’t understand what Hoff means by asking me to not obfuscate my research?! Maybe he was just disappointed that the presentation was too technical for an average CISSP to understand it? But, well, this presentation was classified as “Advanced Technical”, which was displayed in the conference program. I still did my best so that, say 70% of the material, was understandable to an average IT people, but, come on, there always must be some deep technical meat in any non-keynote-presentation, at least this is my idea for how a conference should look like.

  5. Commercially motivated. Hoff accuses me of presenting commercial product, i.e. the Phoenix’s HyperSpace, during my speech:
    “No less than five times during your presentation, you highlighted marketing material in the form of graphics from Phoenix, positioned their upcoming products and announced/credited both Phoenix and AMD as funding your research.”
    Well, let me tell you this – this was one of the main reasons why I decided to speak at the RSA – just to announce this very product that I try to help to secure. Why would that be wrong?

    BTW, I have no idea how Mr. Hoff concluded that AMD was founding my research. I never said that, nor did I have it in my slides. Needles to say, AMD has not been founding my research. NOTE: interestingly I consider this particular mistake by Hoff to be accidental – at least I don’t see how this could be connected to any PR campaign, in contrast to all the other incorrectness he made use of.

  6. Independence. Hoff, for some reason, apparently known only to him, tries to argue that I’m not an “independent researcher”:
    “I think it's only fair to point out that given your performance, you're not only an "independent researcher" but more so an "independent contractor." Using the "I'm a researcher" excuse doesn't cut it.”
    “I know it's subtle and lots of folks are funded by third parties, but they also do a much better job of drawing the line than you do.”
    Well, I found this one to be particularly amusing, as, for at least several years now, I have not claimed I have been an independent researcher.

  7. Final hit. You might have been wondering by now – why this gentleman, nah, I think “the guy” would fit better here, so why the guy decided to spent so much time to write all those points, all those quasi-arguments and why he made so many “mistakes”? Well he seems to give an answer right in this paragraph:
    “I care very much that your research as presented to the press and at conferences like RSA isn't only built to be understood by highly skilled technicians or researchers because the continued thrashing that they generate without recourse is doing more harm than good, quite frankly.”
    Aha, now all is clear. May I ask then, which virtualization vendor you write PR for? ;)

So, then Hoff quotes the Forbes article that was written after my presentation and accuses me that the article (written by some Forbes reporter) was too sensationalist. I definitely agree the article was very sensationalist (but correct) and when I saw the article I even got angry and even wanted to write a blog about it (but as the article was actually correct, I had no good arguments to use against it). And you know why I was so angry? Because I actually spent over 40 minutes with this very Forbes reporter in the RSA’s speaker’s lounge just after my speech, I spent that time on clarifying to that guy what my presentation was about and what it was not about and what was the main message of the presentation. Still, the reporter had his own vision of how to write about it (i.e. make it into a sensation) and I hardly, as it turned out, could do anything about it…

So, what was the main massage of my presentation? Interestingly Mr. Hoff forgot to mention that… Let me then remind it here (a curious reader might want to have a look at the the slide #96 in my presentation):
  • Virtualization technology could be used to improve security on desktop systems

  • However there are non-trivial challenges in making this all working well...

  • ... and not to introduce security problems instead...

Additionally, the message I was trying to pass during the whole presentation was:
“Keep hypervisors simple, do not put drivers there, as otherwise we would get to the same point where we are with current OSes these days, i.e. no kernel security at all!”
Now I wonder, maybe Christofer Hoff doesn’t do PR for any VMM vendor, maybe he just didn’t listen carefully to my presentation. Maybe he’s just one of those many guys who always know in advance what they want to hear and selectively pick up only those facts that match their state of mind? Otherwise, why would he not realize that my presentation was actually a pro-virtualization one and needed no (false) counter-arguments? \ No newline at end of file diff --git a/_posts/2008-04-30-vegas-training-2008.html b/_posts/2008-04-30-vegas-training-2008.html deleted file mode 100644 index ce24d30..0000000 --- a/_posts/2008-04-30-vegas-training-2008.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Vegas Training 2008 -date: '2008-04-30T15:44:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:04:12.026+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3486345275075744973 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/04/vegas-training-2008.html ---- - -Last year we debuted with our Understanding Stealth Malware training at the Black Hat Vegas. We had about 70 participants and I think it was a reasonable success, especially that the training was announced very late. Since then we have done a couple of on-site classes and also have been continually updating the training.

During our 2nd public edition, at Black Hat Europe 2008 in March this year, we significantly extended the part about virtualization, e.g. by adding discussion of nested virtualization on AMD-v and showing and analyzing the actual code for implementing this. Also we have used the New Blue Pill code with VT-x support (previously it worked only on AMD-V), making it possible to use both AMD and Intel machines for the class. This allowed us to offer this training in a "Bring Your Own Laptop" fashion, that we know is much preferred by attendees, who simply feel better when using their own, known, work environment.

At the upcoming Black Hat Vegas 2008 we are also going to offer this class. That would be our 3rd public edition. Again, we hope to improve it even more beyond what we have presented at BH Europe 2008. Similarly as last time, we will not provide the computers, but rather expect the attendees to bring their own systems. At the end of this article are the requirements that should be met by your machine, if you would like to use it during the training and be able to do all the exercises. Of course, you should back up all your important data before coming to the class, as the computer might become corrupt after doing some of the exercises (although this has never happened so far).

There will be only one class offered on August 4/5 (the weekday class). You can view the detailed training agenda that we used for the BH Europe class in March here. Please note that the exact shape of the Vegas class is subject to be a bit different, as we are planning to add new material again.

This might be the very last chance for you to attended this specific training, as it's quite possible that next year we will be offering some other class, focused on Virtualization security entirely. Don't worry, however, if you don't get a seat in the Vegas class, there is still a chance to have that class presented on-site in your town.

You can register for the Vegas training here.

See you in Vegas!

Hardware Requirements
  1. 64-bit (x64) AMD or Intel processor with hardware virtualization support (AMD-v or VT-x)
  2. DVD-ROM
  3. 2GB RAM (for convenient work with VMWare)
Software Requirement
  1. 64-bit Vista OS (primary OS, non virtualized)
  2. Windows Driver Kit (WDK) 6000 or newer (available via MSDN subscription).
  3. VMWare Workstation 6.x or VMWare Player 2.x (the latter is free)
  4. Optionally: IDA Pro 5.x disassembler (for exercises that involve finding bugs in drivers)
AMD Processors
Most modern AMD mobile processors, like e.g. AMD Turion and Athlon, used in modern laptops support AMD-v technology. Unfortunately there is no single place on AMD website that would provide the complete description of all CPUs that support AMD-v technology or provide an answer whether a given model does support it. When in doubt use google and always verify with the CHKSVMX program described below.

Intel Processors
Most modern Intel processors used in notebooks support Intel VT-x virtualization technology, this include Core 2 Solo, Core 2 Duo (except T5500, T5550 and T5750 models) and Core 2 Extreme. You can check your own model starting at this website, then chose your processor family and chose "Specifications" tab. Make sure the processor supports "Intel® 64 architecture" and "Intel® Virtualization Technology".

Using Mac for the training
You can very easily use MacBook or MacBook Pro for this training. You can easily install Windows on a second partition using the Boot Camp program that ships with all the newer Macs. You simply start Boot Camp application when running Mac OS X and then it automatically shrinks your current Mac partition, creates a new one for Windows, and asks to insert the installation media and reboots the system and you then perform normal Windows setup (after installation is complete your Vista should find all the necessary drivers via Windows Update). You might also want to use the free AutoHotKey program for the right-click emulation on your newly installed Vista. Please don't worry that Boot Camp tells that you should install a 32-bit Vista - you can ignore this and insert a 64-bit Vista installation disk.

Testing your machine with CHKSVMX
We have prepared a special little program, CHKSVMX, to test whether a given machine indeed supports hardware virtualization technology. The CHKSVMX program can be downloaded from here

The program doesn't introduce any persistent changes to the OS and doesn't require any installation procedure. It checks for virtualization support (on both AMD and Intel processors) not only by reading the CPUID information but also by trying to actually enable virtualization mode and then disable it again. Although most of the laptops available these days support hardware virtualization, in many cases this feature is disabled or locked down in the BIOS. If the virtualization is reported as "locked", please try to enable it in the BIOS. Please note that in most cases you will have to fully power down your system for the BIOS changes to take effect (reboot is not enough)!

Additionally CHKSVMX checks whether a 64-bit edition of Windows is running, as such OS is required for the training.

DISCLAIMER: The test program is digitally signed with the Invisible Things Lab's certificate and we assure that the program does not perform any malicious actions. ITL is, however, not responsible for any accidental damage or system instability issues the test program might cause. \ No newline at end of file diff --git a/_posts/2008-05-20-1984.html b/_posts/2008-05-20-1984.html deleted file mode 100644 index f89d621..0000000 --- a/_posts/2008-05-20-1984.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: 1984? -date: '2008-05-20T10:26:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:04:05.613+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7813731853415735079 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/05/1984.html ---- - -I can't believe this is happening for real...

So, how can we enforce Google to never do read() on a /var/users/john_smith/heath_records.db? How about a read() implemented from within a kernel-level via RAW-disk access that would never be logged?

I wonder when we would get another cool service from Google, e.g. "Google Thoughts", where people would be able to store their most private and personal thoughts, so that they could "access and managed them from all over the world", "in a secure fashion", of course. Right, add the Thought Police to this picture and welcome to Orwell's Oceania!

There is a difference between using the Web for blog writing vs. giving away all the private aspects of your life for free to some corporation in an unencrypted form. I wonder whether all the people who understands the notion of the local hard disk will be vaporized some time... \ No newline at end of file diff --git a/_posts/2008-07-01-rafal-wojtczuk-joins-invisible-things.html b/_posts/2008-07-01-rafal-wojtczuk-joins-invisible-things.html deleted file mode 100644 index dc14052..0000000 --- a/_posts/2008-07-01-rafal-wojtczuk-joins-invisible-things.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Rafal Wojtczuk joins Invisible Things Lab -date: '2008-07-01T20:36:00.002+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:03:57.142+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8942209840459034399 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/07/rafal-wojtczuk-joins-invisible-things.html ---- - -I’m very happy to announce that a well known researcher, Rafal Wojtczuk, will join our team this month.

For anybody who is serious about OS security research it is hard not to know Rafal’s work. I remember reading his Defeating Solar Designer non-executable stack patch article somewhere around 1998, when I was still a Linux newbie, learning shell programming back at that time ;)

Since then Rafal published many other articles, advisories and exploits, mostly Linux-related. To mention just a few – the *BSD procfs vulnerability (2000), the Linux Ptrace vulnerability (2001), the famous Advanced return-into-lib(c) paper (2002), the vulnerability in the SELinux (2003), a tool for automatic integer overflow discovery in Win32 binaries (2005) and many others. He’s also known for his libnids project.

Recently Rafal has been doing a lot of research in the area of virtualization and VMM security. In the recent months he found vulnerabilities that potentially allowed to escape a VM jail in all the major virtualization software from Microsoft, VMWare and, of course, Xen.

I wrote “and, of course, Xen”, as Rafal will be presenting a talk at the upcoming Black Hat about Subverting the Xen hypervisor. His talk will be the first one in the series of 3 presentations about Xen (in)security that Invisible Things Lab prepared for this year’s Black Hat. Stay tuned for more details in the coming days.

Rafal has been with McAfee Avert Labs until this month. \ No newline at end of file diff --git a/_posts/2008-07-07-0wning-xen-in-vegas.html b/_posts/2008-07-07-0wning-xen-in-vegas.html deleted file mode 100644 index 54d62fd..0000000 --- a/_posts/2008-07-07-0wning-xen-in-vegas.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 0wning Xen in Vegas! -date: '2008-07-07T16:03:00.004+02:00' -author: Joanna Rutkowska -tags: -- hypervisor rootkits -- xen hacking -- virtualization based rootkits -modified_time: '2009-03-25T16:03:47.633+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/SHIrRRp7nYI/AAAAAAAAAB8/MCybwCZ2nuI/s72-c/Fotolia_1758548_XS.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-5820262464138516969 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/07/0wning-xen-in-vegas.html ---- - -At this year’s Black Hat conference in Las Vegas in August we will be presenting three talks about the Xen hypervisor (in)security. The three presentations have been designed in such a way that they complement each other and create one bigger entirety, thus they can be referred as “Xen 0wning Trilogy” for brevity.

In the first presentation, Subverting the Xen hypervisor, Rafal will discuss how to modify the Xen’s hypervisor memory and consequently how to use this ability to plant hypervisor rootkits inside Xen (everything on the fly, without rebooting Xen). Hypervisor rootkits are very different creatures from virtualization based rootkits (e.g. Bluepill). This will be the first public demonstration of practical VMM 0wning (proof of concept code will be released, of course).

In the second talk, Detecting and Preventing the Xen hypervisor subversions, Rafal and I will discuss various anti-subverting techniques (IOMMU, Xen’s driver- and stub- domains) and whether they really can protect the Xen (or similar) hypervisor from compromises. After demonstrating that those mechanisms can be bypassed, we will switch to discussing hypervisor integrity scanning and will present some prototype solutions to this problem.

Our trilogy wouldn’t be complete without discussing virtualization based malware in the context of bare-metal hypervisor compromises. Thus, in the third speech, Bluepilling the Xen hypervisor, Alex and I will discuss how to insert Bluepill on top of the running Xen hypervisor. We will show how to do that both with and without restart (i.e. on the fly). To make this possible, our Bluepill needs to support full nested virtualization, so that Xen can still function properly. We will also discuss how the “Bluepill detection” methods proposed over the last 2 years, as well as the integrity scanning methods discussed in the previous speech, fit into this new scenario and how far we are from the stealth malware’s Holy Grail ;)

Special thanks to Black Hat organizers for scheduling all the three presentations one after another in a dedicated Virtualization track on the 2nd day of the conference (August 7th).

It’s worth noting that we chose Xen as the target not because we think it’s insecure and worthless. On the contrary, we believe Xen is the most secure bare-metal hypervisor out there (especially with all the goodies in the upcoming Xen 3.3). Still we believe that it needs some improvements when it comes to security. We hope that our presentations will help making Xen (and similar hypervisors) more secure. \ No newline at end of file diff --git a/_posts/2008-08-08-our-xen-0wning-trilogy-highlights.html b/_posts/2008-08-08-our-xen-0wning-trilogy-highlights.html deleted file mode 100644 index afb64f8..0000000 --- a/_posts/2008-08-08-our-xen-0wning-trilogy-highlights.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: Our Xen 0wning Trilogy Highlights -date: '2008-08-08T09:42:00.002+02:00' -author: Joanna Rutkowska -tags: -- hypervisor rootkits -- xen hacking -- xen heap exploiting -- virtualization based rootkits -modified_time: '2009-03-25T16:03:38.496+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1952716314561818264 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/08/our-xen-0wning-trilogy-highlights.html ---- - -Below you can find highlights of the three presentations, collectively referred to as "Xen 0wning Trilogy", that Alex, Rafal and I gave today at the Black Hat conference in Las Vegas.

Talk #1

1) Practical implementation of reliable and portable DMA attacks from Domain 0 to the Xen hypervisor memory.

2) Xen Loadable Modules :) A framework that allows to load arbitrary C code modules into the running Xen hypervisor. It uses DMA attack from the previous point to get access to Xen memory.

3) Two implementations of Xen Hypervisor Rootkits. This was the first time that working hypervisor rootkits have been presented (note the distinction between hypervisor rootkit vs. virtualization based rootkits).

Talk #2

1) Discussed how Xen 3.3 makes use of the Intel VT-d technology to protect the hypervisor.

2) Then we discussed how to bypass such VT-d protection on certain motherboards, like e.g. Intel DQ35 board.

3) An extra bonus: our attack from the previous point allows also to subvert the SMM handler and e.g. install an SMM rootkit in the system.

4) Discussed other Xen security mechanisms like driver domains, stub domains, PV GRUB and also attempted to quickly compare the state of Xen security design with the Hyper-V and ESX hypervisor.

5) Showed an exploitable heap overflow bug in the Xen hypervisor. The bug was in the FLASK module -- the NSA implementation of Xen Security Modules. FLASK, however, is not turned on by default, so even though we showed how to successfully exploit this heap overflow (which results in an escape from an unprivileged domain directly to the hypervisor), this is not a bug that can be used to 0wn The Planet. It shows, however, what happens when people start adding more and more code into the hypervisor.

6) Introduced HyperGuard -- a project done in cooperation with Phoenix Technologies. HyperGuard is going to be a SMM-based integrity scanner for Xen-like hypervisors. With HyperGuard we take a different approach then other integrity scanners do -- rather than ensuring the correctness of the code and data of the hypervisor, which might be very tricky, we instead ensure there is no untrusted code in the hypervisor, which is a much simpler task.

Talk #3

1) Provided detailed description of how to implement nested hardware based virtualization on AMD-V and VT-x (a copy of the slides from my RSA speech in April).

2) Showed how to use this nested virtualization to implement Blue Pill Boot, that can be used to virtualize the system right from the boot stage. We mentioned the best defend against this kind of system compromises is a trusted boot mechanism, either SRTM or DRTM, as implemented e.g. by Xen's tboot.

3) Consequently we showed Xen Blue Pill that is able to move a running Xen system into a virtual machine on the fly. This, on the other hand, cannot be prevented by neither the SRTM nor DRTM technology. XBP is a good example that running a legitimate hypervisor doesn't always prevent bluepill-like malware from being installed in the system.

4) Finally, discussed the XBP detection. First, we noted that all the "VMM detectors", proposed over the last years, that try to detect if there is a hypervisor running above, are useless in the case of a bluepilled Xen system. The only one approach that could be used is the direct timing analysis of the #VMEXIT times in order to distinguish between the native Xen case vs. bluepilled Xen case. We noted however, that direct timing analysis will not observe any differences when run from PV domains on AMD processors, and that it will observe little difference when run from HVM domains (7k vs. 5k cycles). The detection is easier on Intel processors, because of the unconditional #VMEXIT that we cannot get rid of.

All the three talks can be found here. \ No newline at end of file diff --git a/_posts/2008-08-20-attacking-xen-domu-vs-dom0.html b/_posts/2008-08-20-attacking-xen-domu-vs-dom0.html deleted file mode 100644 index 88fbc1b..0000000 --- a/_posts/2008-08-20-attacking-xen-domu-vs-dom0.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: 'Attacking Xen: DomU vs. Dom0 consideration' -date: '2008-08-20T13:59:00.001+02:00' -author: Joanna Rutkowska -tags: -- xen hacking -modified_time: '2009-03-25T16:03:29.110+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5745634034617951424 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/08/attacking-xen-domu-vs-dom0.html ---- - -As it usually happens, there is some confusion regarding the attacks presented in our Xen 0wning Trilogy. Some people think they are possible only from Dom0 (the Xen's privileged, administrative domain) while some other people have the impression that all the attacks are possible from any unprivileged domain (DomU in Xen’s terminology). The truth is in the middle though.

Most of the attacks we presented do indeed require that the attacker first obtained access to Dom0 and only from there can launch further attacks. For example the DMA attacks that allow to overwrite hypervisor memory do indeed assume Dom0 access. The same applies to the Q35 exploit - this one is similar to the above mentioned DMA attacks in that it also requires access to certain hardware (that is possible from Dom0), but has an advantage that can bypass the hypervisor VT-d protection in the recent Xen 3.3.

There are several reasons why those attacks are still very important though:
1) First note, that the requirement for the attacker to have access to Dom0 in order to install e.g. hypervisor rootkits, is similar to the requirement that in order to install a Windows or Linux rootkit, one first needs to obtain administrator's privileges. Yet we know that Windows or Linux rootkits is a serious security problem.

2) Concerning the Xen-based systems specifically: over the last year several bugs have been discovered and published, that allowed an attacker to gain control of the Domain0 from an unprivileged domain (i.e. escape from the virtual machine). Rafal has discovered one such bug in December 2007.

3) Recent versions of Xen make deliberate effort to protect the hypervisor even from the Dom0. On systems that have IOMMU support (e.g. Intel's VT-d), the hypervisor memory is protected from tampering using both the processor's ring3/ring0 separation mechanism as well as the IOMMU protection. We showed that those protections can be bypassed.

The attempt to isolate hypervisor and protect it even from attacks originating from Dom0 is not surprising. After all if we would like to treat the hypervisor as a root of trust, then we should make sure that its code base is minimal. If we now allow Dom0 to effectively be the hypervisor (i.e. if we don't care about Dom0-to-hypervisor escalations) then we should include all the Dom0 code to the hypervisor code base, when evaluating hypervisor security. This would result in our "extended hypervisor" having not ~300k lines of code (like current Xen does), but millions of lines of code!

Having said that all about how important it is to prevent all the possible Dom0-to-hypervisor attacks, I should stress that we also presented an attack that does not require Dom0 access and that can be spawned from an unprivileged DomU domain. As far as I'm aware, Rafal's FLASK bug & exploit (presented in the 2nd presentation) was the first public example of a successful exploitation of an overflow in a bare-metal hypervisor. The bug was a heap overflow and Rafal presented some clever tricks of how to control the Xen's heap allocations in order to make this bug exploitable.

Please note that all the rootkit-like stuff that we also presented, i.e. Rafal's Xen Loadable Modules framework and his hypervisor rootkits, as well as Alex's and mine XenBluePill, can all be used with all the above mentioned attacks. So, e.g. if we are on a machine that has VT-d support and run Xen 3.3 we can still use the Q35 attack and get the XLM framework running and then use it to install e.g. XenBluePill on top of running Xen, as showed during the 3rd presentation. Similarly, we could use the FLASK exploit and get XLM running again and again used it for installation of the other stuff.

Hope this clears some confusion about our presentations. As already promised, the codes and demos and full version of the 2nd talk slides (with the Q35 attack details) will be posted after Intel release the patch for their motherboards. Stay tuned. \ No newline at end of file diff --git a/_posts/2008-08-26-intel-patches-q35-bug.html b/_posts/2008-08-26-intel-patches-q35-bug.html deleted file mode 100644 index 238ad62..0000000 --- a/_posts/2008-08-26-intel-patches-q35-bug.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Intel patches the Q35 bug -date: '2008-08-26T09:41:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-25T16:03:19.027+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2529149620297733085 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/08/intel-patches-q35-bug.html ---- - -Yesterday Intel has published an official advisory that addresses the Q35 bug and attack, that we used during Black Hat as one of the ways to subvert Xen 3.3 on a VT-d enabled system (the alternative way was to use the Xen-specific FLASK exploit, that worked even from an unprivileged domain).

One small clarification though: in the advisory they stated that: "Software running administrative (ring 0) privilege can under certain circumstances change code running in System Management Mode." But in fact an attacker might also use this bug to directly modify the hypervisor memory, without jumping into the SMM first, just as we did it with our exploit. Also, in case of e.g. Linux systems, the Ring0 access is not strictly required to perform the attack, as it's just enough for the attacker to get access to the PCI config space of the device 0:0:0, which e.g. on Linux can be granted to usermode applications via the iopl() system call.

You can download a new firmware for your motherboard from here.

Intel did a good job on handling this bug - not only they recognized the importance of the attack, but also released the patch promptly. Quite positively surprising as for such a big company.

So, now we're free to publish all the missing slides about how we exploit this vulnerability that we had to remove from our Black Hat presentation, as well as the exploit code. However, as I'm going to give 2 presentations at the upcoming ISF conference in Sweden early next week, I thought it would be logical to wait with disclosing this material and present it at this conference, during my technical speech (I will also deliver the keynote for this conference). Of course, as soon as I will get back home (Thursday next week), we will publish the full slides, exploit codes and all the demos, as promised earlier.

Speaking of speaking: also next month, Rafal will fly to Oregon, to Intel campus, for the Intel Virtualization Security Summit, where he will deliver a "compressed" version of our Xen 0wning Trilogy to the technical crowd of Intel employees. Rafal will provide some more details about the HyperGuard project that we do in cooperation with Phoenix Technologies. Also, in October, Alex will visit Kuala Lumpur and present an updated Bluepilling the Xen Hypervisor talk at the Hack In The Box conference. \ No newline at end of file diff --git a/_posts/2008-08-31-teamwork-crediting.html b/_posts/2008-08-31-teamwork-crediting.html deleted file mode 100644 index e55ad38..0000000 --- a/_posts/2008-08-31-teamwork-crediting.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Teamwork & Crediting -date: '2008-08-31T23:09:00.001+02:00' -author: Joanna Rutkowska -tags: -- company news -modified_time: '2009-03-25T16:02:48.376+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5145355901555942752 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/08/teamwork-crediting.html ---- - -As the technology is getting more and more complex, security research, especially offensive security research on a system level, becoming more and more difficult to be done by one person. NX/XD, ASLR, various StackGuard-like things, VT-d, TXT, etc... - all those technologies leave less and less space for the interesting system-level attacks. On the other hand, the widespread "deployment" of Web 2.0 creates a whole new area to explore, but that is a whole different world (plus there are still all those "human factor" attacks that exploit user stupidity, but again, this is a different area).

Our Xen 0wning Trilogy is a good example of how a team of researchers can still come up with interesting new system-level attacks against the very recent and securely design system. Take XenBluePill as an example.

It has first been months of research and coding done by Alex and myself to support nested hardware virtualization on AMD. Then there was months of Rafal's research about how to load code into the running Xen on the fly ("Xen Loadable Modules"). That required ability to access Xen's memory in the first place and Rafal's way for doing that was to use the DMA attack. But then it turned out that the Xen 3.3 uses VT-d protection to protect against this very kind of attacks. So then I came up with the "Q35 attack" that exploited a problem with recent Intel BIOSes on recent motherboards (details are coming this week). But I based my attack on a similar SMM attack that Rafal came up with a few months earlier on a different chipset, when he was looking into ways to compromise SMM handler, as we started thinking about HyperGuard project back then and Rafal was curious reliable the SMM protection is. In the meantime, Alex "converted" our working New Blue Pill that had full support for nested virtualization but was essentially a Windows driver, into a piece of code that was completely OS-independent (own memory management, etc.). Then I finally took Rafal's XLM framework, added a few minor things that were needed to load our "Windows-independent Windows driver" into Xen using XLM, fixed some minor stuff and... it finally worked! But that was possible only because of the joint work by all the three people together.

So, it is simply unfair to attribute all the glory and fame for our research to "Rutkowska" or "Rutkowska and team", as many news portals did. Please don't forget to credit all the co-authors! If you really would like to use a generic term, then "Invisible Things Lab team" would probably serve better.

Speaking of our team, I also have an announcement that starting this month our team has officially been extended by yet another person: Rong Fan from Beijing, China.

Rong is a software engineer, focusing on Intel's hardware virtualization technology (VT). A few months ago he wrote to me with some advanced questions regarding the implementation of our New BluePill that we published after the last year's Black Hat. Turned out that Rong, as part of his after-hour activity, is porting Bluepill to VT-x. After he succeeded, we decided to share our nested virtualization code for AMD with him so that he could investigate how to do it on VT-x. And about 2 months ago Rong succeeded with implementing full nested virtualization support for our NBP on Intel VT-x! During that time Rong has had an opportunity to find out that working with ITL is quite fun, so he decided to quit his job at Lenovo and joined ITL full time. Right now Rong is busy adding nested VT-x support to a normal Xen hypervisor.

So, Invisible Things Lab is all about the team work. The whole idea behind ITL is to gather together a bunch of smart people, so that we could all work on the most exciting problems together. Problems that might be too complex or time-consuming for just one person to solve. But it takes more then just money to get people to be creative and devote themselves to work. Getting recognition is one of the additional factors often needed. That's why ITL is not interested in "hiding" its employees, but rather in promoting their work and fairly crediting them. \ No newline at end of file diff --git a/_posts/2008-09-02-three-approaches-to-computer-security.html b/_posts/2008-09-02-three-approaches-to-computer-security.html deleted file mode 100644 index bc3b6b3..0000000 --- a/_posts/2008-09-02-three-approaches-to-computer-security.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: The three approaches to computer security -date: '2008-09-02T13:39:00.002+02:00' -author: Joanna Rutkowska -tags: -- philosophical -modified_time: '2009-03-25T16:02:02.252+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7438465495915995582 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/09/three-approaches-to-computer-security.html ---- - -If we looked at the computer systems and how they try to provide security, I think we could categorize those attempts into three broad categories:

1) Security by Correctness
2) Security by Isolation
3) Security by Obscurity

Let's discuss those categories in more detail below.

Security by Correctness

The assumption here is obvious: if we can produce software that doesn't have bugs (nor any maliciously behaving code), then we don't have security problems at all. The only problem is that we don't have any tools to make sure that a given code is correct (in terms of implementation, design and ethical behavior). But if we look at various efforts in computer science, we will notice a lot of effort has been made to achieve Security by Correctness: "safe" languages, code verifiers (although not sound ones, just heuristic based), developer's education, manual code audit, etc. Microsoft's famed Secure Development Life-cycle is all about Security by Correctness. The only problem is: all those approaches sometimes work and sometimes do not, sometimes they miss some bug and also there are problems that I simple don't believe can be addresses by automatic code verifiers or even safe languages, like e.g. logic/design bugs or deciding on wheatear a given code behaves maliciously or not (after all this is an ethical problem in many cases, not a computer science problem).

To sum it: I think that in some more or less distant future (some people think abuout a timeframe of 50 years or so), we would get rid of all the implementation bugs, thanks to safe languages and/or sound code verifiers. But I don't believe we could assure correctness of software on any higher level of abstraction then implementation level.

Security by Isolation

Because of the problems with effectively implementing Security by Correctness approach, people, from the very beginning, has also taken another approach, which is based on isolation. The idea is to split a computer system into smaller pieces and make sure that each piece is separated from the other ones, so that if it gets compromised/malfunctions, then it cannot affect the other entities in the system. Early UNIX's user accounts and separate process address spaces, things that are now present in every modern OS, are examples of Security by Isolation.

Simple as it sound, in practice the isolation approach turned out to be very tricky to implement. One problem is how to partition the system into meaningful pieces and how to set permissions for each piece. The other problem is implementation - e.g. if we take a contemporary consumer OS, like Vista, Linux or Mac OSX, all of them have monolithic kernels, meaning that a simple bug in any of the kernel components (think: hundreds of 3rd party drivers running there), allows to bypass of the isolation mechanisms provided by the kernel to the rest of the system (process separation, ACLs, etc).

Obviously the problem is because the kernels are monolithic. Why not implement Security by Isolation on a kernel level then? Well, I would personally love that approach, but the industry simply took another course and decided that monolithic kernels are better then micro-kernels, because it's easier to write the code for them and (arguably) they offer better performance.

Many believe, including myself, that this landscape can be changed by the virtualization technology. Thin bare-metal hypervisor, like e.g. Xen, can act like a micro kernel and enforce isolation between other components in the system - e.g. we can move drivers into a separate domain and isolate them from the rest of the system. But again there are challenges here on both the design- as well as the implementation-level. For example, we should not put all the drivers into the same domain, as this would provide little improvement in security. Also, how to make sure that the hypervisor itself is not buggy?

Security by Obscurity (or Security by Randomization)

Finally we have the Security by Obscurity approach that is based on the assumption that we cannot get rid of all the bugs (like in Security by Isolation approach), but at least we can make exploitation of those bugs very hard. So, it's all about making our system unfriendly to the attacker.

Examples of this approach include Address Space Layout Randomization (ASLR, present in all newer OSes, like Linux, Vista, OSX), StackGuard-like protections (again used by most contemporary OSes), pointer encryption (Windows and Linux) and probably some other mechanisms that I can't remember at the moment. Probably the most extreme example of Security by Obscurity would be to use a compiler that generates heavily obfuscated binaries from the source code and creates a unique (on a binary level) instances of the same system. Alex did his PhD on this topic and his an expert on compilers and obfuscators.

The obvious disadvantage of this approach is that it doesn't prevent the bugs from being exploited - it only make the meaningful exploitation very hard or even impossible. But if one is concerned also about e.g. DoS attacks, then Security by Obscurity will not prevent them in most cases. The other problem with obfuscating the code is the performance (compiler cannot optimize the code for speed) and maintenance (if we got a crash dump on an "obfuscated" Windows box, we couldn't count on help from the technical support). Finally there is a problem of proving that the whole scheme is correct and that our obfuscator (or e.g. ASLR engine) doesn't introduce bugs to the generated code and that we will not get random crashes later (that we would be most likely unable to debug, as the code will be obfuscated).

I wonder if the above categorization is complete and if I haven't forgotten about something. If you know an example of a security approach that doesn't fit here (besides blacklisiting), please let me know! \ No newline at end of file diff --git a/_posts/2008-09-06-xen-0wning-trilogy-code-demos-and-q35.html b/_posts/2008-09-06-xen-0wning-trilogy-code-demos-and-q35.html deleted file mode 100644 index 32ed18b..0000000 --- a/_posts/2008-09-06-xen-0wning-trilogy-code-demos-and-q35.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 'Xen 0wning Trilogy: code, demos and q35 attack details posted' -date: '2008-09-06T13:59:00.001+02:00' -author: Joanna Rutkowska -tags: -- hypervisor rootkits -- xen hacking -- xen heap exploiting -- virtualization based rootkits -modified_time: '2009-03-25T16:01:52.715+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7367970431147576824 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/09/xen-0wning-trilogy-code-demos-and-q35.html ---- - -We have posted all the code that we used last month during our Black Hat presentations about Xen security, and you can get it here. This includes the full source code for:
1) The generic Xen Loadable Modules framework
2) Implementation of the two Xen Hypervisor Rootkits
3) The Q35 exploit
4) The FLASK heap overflow exploit
5) The BluePillBoot (with nested virtualization support on SVM)
6) The XenBluePill (with nested virtualization support on SVM)

Beware the code is by far not user-friendly, it requires advanced Linux/Xen, C and system-level programming skills in order to tweak some constants and run it successfully on your system. Do not send us questions how to compile/run it, as we don’t have time to answer such questions. Also do not send questions how the code works – if you can’t figure it out by reading our slides and the source code, then it means you should probably spend more time on this yourself. On the other hand, we would appreciate any constructive feedback.

The code is our gift to the research community. There is no warranty and Invisible Things Lab takes no responsibility for any potential damage that this code might cause (e.g. by rebooting your machine) or any potential malicious usage of this code, or any other code built on top of this code. We believe that by publishing this code we help to create more secure systems in the future.

Additionally, we also posted the full version of our second Black Hat talk, which now includes all the slides about the Q35 bug and how we exploited it. Those slides had to be previously removed during our Black Hat presentation, as the patch was still unavailable during that time. \ No newline at end of file diff --git a/_posts/2008-09-07-microsoft-executive-rebuts-our-research.html b/_posts/2008-09-07-microsoft-executive-rebuts-our-research.html deleted file mode 100644 index 4c01adf..0000000 --- a/_posts/2008-09-07-microsoft-executive-rebuts-our-research.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Microsoft executive "rebuts" our research! -date: '2008-09-07T09:54:00.004+02:00' -author: Joanna Rutkowska -tags: -- bad guys attacking joanna -- fighting for a better world -modified_time: '2009-03-25T16:01:39.482+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-718012832586397028 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2008/09/microsoft-executive-rebuts-our-research.html ---- - -Ah, there is no feeling like seeing your name in the news when drinking your morning coffee... In this piece some Steve Riley, a senior security strategist at Microsoft, decided to "rebute" our recent Black Hat presentations research results.

Mr. Riley had been quoted by ZDnet as saying:

"Her [Joanna Rutkowska] insistence is that you can replace the hypervisor without anybody knowing... Our assertion is that this is incorrect," Riley told the audience. "First of all, to do these attacks you need to become administrator at the root. So that's going to be, on an appropriately configured machine, an exceedingly difficult thing to happen."

Apparently, Mr. Riley has never seen our Black Hat presentations (or slides at least) that he is referring to (oh, wait, that is the typical case with all our "refuters", how come?)...

First, we never said anything about replacing the hypervisor. I really have no idea how this idea was born in Mr. Riley's head? Replacing the hypervisor - that would indeed be insane for us to do!

Second, it is not true that the attacker needs to become an administrator "at the root" (he mean the root partition or administrative domain here I assume). The attack we presented in our second speech, that exploited a heap overflow in the Xen hypervisor FLASK module, could have been conducted from the unprivileged domain, as we demonstrated during the presentation.

Mr. Riley continues with his vision:

"Because you [the attacker] didn't subject your own replacement hypervisor through the thorough design review that ours did, I'll bet your hypervisor is probably not going to implement 100 percent of the functionality as the original one," Riley said. "There will be a gap or two and we will be able to detect that."

Well, if he only took the effort of looking into our slides, he would realize that, in case of XenBluePill, we were slipping it beneath (not replacing!) the original hypervisor, and then run the original one as nested. So, all the functionality of the original hypervisor was preserved.

Mr. Riley also shares some other ground breaking thoughts in this article, but I think we can leave them uncommented ;)

This situation is pretty funny actually - we have here the words and feelings of some Microsoft executive vs. our three technical presentations, all the code that we released for those presentations, and also a few of our demos. Yet, it's apparently still worth getting into the news and reporting what the feeling of Mr. Riley are...

Let me, however, write one more time, that I'm (still) not a Microsoft hater. There are many people at Microsoft that I respect: Brandon Baker, Neil Clift, the LSD guys, Mark Russinovich, and probably a few more that I just haven't had occasion to meet in person or maybe forgot about at the moment. It's thus even more sad that people like Mr. Riley are also associated with Microsoft, even more they are the face of Microsoft for the majority of people. Throwing a party in Vegas and Amsterdam once a year certainly is not enough to change the Microsoft's image in this case...

Interestingly, if Mr. Riley only attended our Xen 0wning Trilogy at Black Hat, then he would notice that we were actually very positive about Hyper-V. Of course, I pointed out that Xen 3.3 certainly has a more secure architecture right now, but I also said that I knew (from talking to some MS engineers from the virtualization group) that Hyper-V is going to implement similar features in the next version(s) and that this is very good. I also prized the fact it has only about 100k LOC (vs. about 300k LOC in Xen 3.3).

So, Mr. Senior Security Strategist, I suggest you do your homework more carefully next time before throwing mud at others and trying to negate the value of their work (and all the efforts of Microsoft's PR people).

On a separate note, I found it quite unprofessional that ZDNet's Liam Tung and Tom Espiner, the authors of the news, didn't ask me for a commentary before publishing this. Not to mention that they also misspelled Rafal's name and forgot to mention about Alex, the third co-author of the presentations. \ No newline at end of file diff --git a/_posts/2009-01-05-attacking-intel-trusted-execution.html b/_posts/2009-01-05-attacking-intel-trusted-execution.html deleted file mode 100644 index 63869e4..0000000 --- a/_posts/2009-01-05-attacking-intel-trusted-execution.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Attacking Intel® Trusted Execution Technology -date: '2009-01-05T16:30:00.005+01:00' -author: Joanna Rutkowska -tags: -- attack -- trusted execution technology -- trusted computing -- exploit -modified_time: '2009-03-19T22:20:19.253+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/SWI4MzG1jdI/AAAAAAAAADU/xaj6gqT72bQ/s72-c/processor+padlock.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-1619925805743086461 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/01/attacking-intel-trusted-execution.html ---- - -

Press people: please read our press release first and also refer to the disclaimer at the end of this blog post. Thank you!

Update: 1/5/2009 19:21 CEST: minor typos/spelling corrections. Thanks to Jarred for point out some of the typos.

A word about Trusted Computing
The term Trusted Computing and related technologies, like Palladium, Trusted Platform Module, LaGrande, have always caused lots of controversy in the IT world. Most of the fear, however, has been a result of the lack of understanding of how a particular technology really works.

Nevertheless, Trusted Computing is becoming part of our lives, whether we want it or not. These days almost every new laptop comes with an on-board Trusted Platform Module (TPM). Microsoft's Palladium initiative have been renamed so many times in the recent years, that probably even people working at Microsoft are confused now. Nevertheless, some of the Palladium technologies made their way into Vista, and Microsoft BitLocker is, without doubt, the most successful, widely deployed product that is based on the idea of Trusted Computing. (In fact the Bitlocker is the only one thing that I really have been missing since I switched from Vista to Mac some time ago).

On the hardware side, besides the famed TPM, we also have had the LaGrande technology, that is often connected with things such as Remote Attestation, Protected Execution and other scary terms…

A word about Trusted Execution Technology
LaGrande, recently renamed Trusted Execution Technology (TXT), is Intel's response to the Trusted Computing trend. TXT is currently part of the vPro™ brand, and for about a year now users can buy a vPro/TXT compatible hardware in regular computer stores (the first one was the DQ35J desktop board with certain Core 2 Duo processors, which I was able to buy at the end of 2007 — remember that TXT requires support from both the CPU and the chipset).

TXT is not an alternative to TPM, in fact TXT heavily relies on the TPM to provide basic services like e.g. secure storage of measurements done by the TXT. Also, Palladium, or whatever it is called these days, is not a competition to TXT. Intel TXT can provide building blocks to e.g. Vista Bitlocker, arguably making it more secure then it is now (Current Bitlocker implementation, AFAIK, relies on a so called Static Root of Trust for Measurement, which requires TPM, but not TXT).

What kind of measurement would TXT like to store in our TPM? Well, the whole TXT is, in fact, all about making and storing software measurements, or, using a more familiar language, secure hashes of certain software components.

The sole purpose of Intel TXT technology is to provide a trusted way for loading and executing system software, e.g. Operating System kernel or Virtualization Machine Monitor. What is extraordinary here is that TXT doesn't make any assumptions about the state of the system before loading the software, thus making it possible for a user to ensure secure load of an OS or VMM, even in a potentially compromised machine.

In other words, our system can be all full of boot sector viruses and BIOS rootkits, and god-knows-what-else, and still TXT should allow to load a clean VMM (or OS kernel) in a secure way, immune to all those rootkits present in the system in a moment just before the load process. This TXT-supported load process is called Late Launch, and is implemented via a special new CPU instruction called SENTER.

It's a good place to mention that AMD has its own version of the late launch implemented via SKINIT instruction. We haven't looked at the AMD technology thoroughly yet, so I will refrain from commenting on this.

The late launch is a pretty amazing thing, when we think about. It promises to effectively provide all the benefits of a computer restart without actually restarting it.

It is hard to overemphasize the potential impact that a technology such as TXT could have on computer security. One can immediately see that it could eliminate all the system-level persistent malware — in other words we can easily build systems (VMMs or even standard OSes) that would be immune to attacks that try to compromise system binaries on disk, or attack the system right from the bootloader or BIOS. Combining this with VT-x and VT-d technologies, system developers (for the first time, at least as far as the "PC" platform is considered) have gotten extremely strong tools into their hands that should allow them to create really secure VMMs and OSes…

Hopefully by now, my Dear Reader, you should have the feeling what kind of an animal Intel TXT is and how desperately the world needs it...

And now, we are going to move on and show practical attacks on current TXT implementations... :)

Attacking Intel TXT!
Ok, not in this post today, but rather at the upcoming Black Hat conference in Washington, DC in February. Over the recent months, Rafal and I have been looking at the Intel TXT technology as part of a work done for a customer, to see if this could be used to improve security of a product, from a typical user's perspective. We figured out that it definitely could, but that there are also some issues…

And those "issues" gave us a starting point in developing a proof-of-concept (albeit very reliable) exploit that shows how we can bypass trusted boot process implemented by Intel's tboot.

Tboot, which is also part of (scroll down to the end of the page) the Xen hypervisor, can be though of as a reference implementation of TXT-based system loader, that could be used to securely load either the Xen hypervisor or the Linux kernel, when run on a vPro/TXT compatible hardware.

[copy-and-paste from the press release follows]

Our attack comprises two stages. The first stage requires an implementation flaw in a specific system software. The second stage of the attack is possible thanks to a certain design decision made in the current TXT release.

While evaluating the effectiveness of the Intel® TXT technology, as part of a work done for a customer, we have identified several implementation flaws in the Intel's system software, which allowed to conduct the above mentioned stage-one attack. We have provided Intel with extensive description of the flaws in December 2008, and Intel is currently working on fixing those vulnerabilities.

We have also been in touch with Intel about the possibility of conducting the second-stage attack since November 2008. In December, after providing Intel with the details about the first-stage attack, Intel promised to release, in the coming weeks, an updated TXT specification for developers that would explain how to design their TXT-based loaders in such a way that they are immune to our attack. Intel claims the current Intel® TXT release does contain the basic building blocks that could be used to prevent our second-stage attack and the release of the additional specification would make it feasible in practice.

More details in February in DC :)

TXT useless?
Some people are skeptical about the TXT technology, and not only because of the Irrational Fear of the Trusted Computing (IFTC), but rather because they point out to the complexity of the whole technology. The complexity is bad, because 1) it leaves more space for potential attacks, and 2) it discourages developers (ISVs) from using the technology in their products (e.g. neither Microsoft, nor VMWare make use of TXT in any of their bare-metal hypervisors, even though TXT is very well suited for this kind of software).

It is true that TXT is a very complex technology (the SENTER instruction is probably the masterpiece of the CISC architecture!), but I personally like it. In my opinion this is the first technology available for the PC platform that has the potential to really change something, much more then the NX-feature did a few years ago. Before people will run to the comment box — if you would like to argue about the usefulness/uselessness of Trusted Computing/TXT, please base your opinions on technical facts (read the spec!) and not on your feelings!

Disclaimer (for press)

Starting January 2009, we (at Invisible Things Lab), decided to issue press releases in addition to this blog. The general rule is: press releases are written for journalists, while the blog is mainly written for other researchers, security enthusiast, etc.

The wording of our press releases is carefully chosen to minimize the potential of a possible misinterpretation. The press releases carry less information, but, we think, are better suited for a more general public, that doesn't have background in computer science, programming and security.

The blog is written in a much more casual way, without thinking for half an hour on every sentence. The articles on this blog might present some facts as extremely exciting, because e.g. for me, a person deeply involved in a system-level security research, they indeed might be very exciting, which might not be the case for a general audience. I sometimes might also use shortcuts, metaphors, or irony, and other figures of speech, that might not necessarily be obvious for a more general public.

If you are a journalist and you think you just found something very sensational on my blog, I would suggest that you double-check with me, before writing about it.

Thank you for your cooperation.
Joanna Rutkowska,
Founder and CEO,
Invisible Things Lab. \ No newline at end of file diff --git a/_posts/2009-01-21-why-do-i-miss-microsoft-bitlocker.html b/_posts/2009-01-21-why-do-i-miss-microsoft-bitlocker.html deleted file mode 100644 index 2565217..0000000 --- a/_posts/2009-01-21-why-do-i-miss-microsoft-bitlocker.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Why do I miss Microsoft BitLocker? -date: '2009-01-21T18:52:00.009+01:00' -author: Joanna Rutkowska -tags: -- bitlocker -- disk encryption -- tpm -- trusted computing -modified_time: '2009-03-19T22:20:07.269+01:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/SXdjHwkIqMI/AAAAAAAAADo/l3tgqzzQ4Es/s72-c/evil+maid.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-104514077420707012 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/01/why-do-i-miss-microsoft-bitlocker.html ---- - -In the previous post, I wrote the only one thing I really miss after I've switched from Vista to Mac is the BitLocker Driver Encryption. I thought it might be interesting for others to understand my position, so below I describe why I think BitLocker is so cool, and why I think other system disk encryption software sucks.

So, it's all about the Trusted Boot. BitLocker does make use of a trusted boot process, while all the other system encryption software I'm aware of, does not. But why the trusted boot feature is so useful? Let's start with a quick digression about what the trusted boot process is…

Trusted boot can be implemented using either a Static Root of Trust or a Dynamic Root of Trust.

The Static Root of Trust approach (also known as Static Root of Trust Measurement or SRTM) is pretty straightforward — the system starts booting from some immutable piece of firmware code that we assume is always trusted (hence the static root) and that initiates the measurement process, in which each component measures the next one in a chain. So, e.g. this immutable piece of firmware will first calculate the hash of the BIOS and extend a TPM's PCR register with the value of this hash. Then the BIOS does the same with the PCI EEPROMs and the MBR, before handling execution to them. Then the bootloader measures the OS loader before executing it. And so on.

An alternative method to implementing trusted boot is to use Dynamic Root of Trust (often called Dynamic Root of Trust Measurement or DRTM). Intel's TXT technology, formerly LaGrande, is an example of a DRTM (more precisely: TXT is more than just DRTM, but DRTM is the central concept on which TXT is built). We will be talking a lot about TXT next month at Black Hat in DC :) This will include discussion of why DRTM might sometimes be preferred over SRTM and, of course, what are the challenges with both.

Essentially, both SRTM and DRTM, in the context of a trusted boot, are supposed to provide the same: assurance the system that just booted is actually the system that we wanted to boot (i.e. the trusted one) and not some modified system (e.g. compromised by an MBR virus).

BitLocker uses the Static Root of Trust Measurement. SRTM can really make sense when we combine it with either TPM sealing or attestation feature. BitLocker uses the former to make sure that only the trusted system can get access to the disk decryption key. In other words: BitLocker relies on the TPM that it will unseal (release) the decryption key (needed to decrypt the system partition) when and only when the state of chosen PCR registers is the same is it was when the decryption key was sealed into the TPM.

Ok, why is this trusted boot process so important for the system disk encryption software? Because it protects against a simple two-stage attack:
  1. You leave your laptop (can be even fully powered down) in a hotel room and go down for a breakfast… Meanwhile an Evil Maid enters your room. She holds an Evil USB stick in her hand and plugs it into your laptop and presses the power button. The system starts and boots from the USB. An Evil version of something similar to our BluePillBoot gets installed into the MBR (or to a PCI EEPROM). This Evil Program has only one task — to sniff out the encryption software's password/PIN and then report it back to the maid next time she comes...
  2. So, you come back to your room to brush your teeth after the breakfast. Obviously you cannot refrain from not turning on your laptop for a while. You just need to enter your disk encryption passphrase/PIN/whatever. Your encryption software happily displays the prompt, like if nothing happened. After all how could it possibly know the Evil Program, like BluePillBoot, has just been loaded a moment ago from the MBR or a PCI EEPROM? It can not! So, you enter the valid password, your system gets the decryption key and you can get access to your encrypted system...
  3. But then you have an appointment at the hotel SPA (at least this little fun you can have on a business trip, right?). Obviously you don't want to look so geeky and you won't take your laptop with you to the SPA, will you? The Evil Maid just waited for this occasion… She sneaks again into your room and powers up your laptop. She presses a magic key combo, which results in the Evil Program displaying the sniffed decryption password. Now, depending on their level of subtleness, she could either steal your whole laptop or only some more important data from the laptop. Your system disk encryption software is completely useless against her now.
(Yes, I know that's 3 bullets, but the Evil Maid had to sneak into your room only twice:)

So, why the BitLocker would not allow for this simple attack? Because the BitLocker software should actually be able to know that the system gets compromised (by the Evil Program) since the last boot. BitLocker should then refuse to display a password prompt. And even if it didn't and asked the user for the password, still it should not be able to get the actual decryption key out from the TPM, because the values in the certain PCR register(s) will be wrong (they will now account for the modified hashes of the MBR or PCI EEPROM or BIOS). The bottom line is: the maid is not getting the decryption key (just as the user now), which is what this is all about.

At least this is how the BitLocker should work. I shall add a disclaimer here, that neither myself, nor anybody from my team, have looked into the BitLocker implementation. We have not, because, as of yet, there have been no customers interested in this kind of BitLocker implementation evaluation. Also, I should add that Microsoft has not paid me to write this article. I simply hope this might positively stimulate other vendors, like e.g. TrueCrypt (Hi David!), or Apple, to add SRTM or, better yet, DRTM, to their system encryption products.

Of course, when we consider an idiot-attack, that involves simply garbbing somebody's laptop and running away with it (i.e. without any prior preparation like our Evil Maid did), then probably all system disk encryption software would be just good enough (assuming it doesn't have any bugs in the crypto code).

Some people might argue that using a BIOS password would be just as good as using trusted boot. After all, if we disable booting from alternate media in BIOS (e.g. from USB sticks) and lock down the BIOS using a password (i.e. using the Power-On password, not just the BIOS supervisor password), then the above two-stage attacks should not be feasible. Those people might argue, that even if the Evil Maid had cleared the CMOS memory (by removing the CMOS battery from the motherboard), still they would be able to notice that something is wrong — the BIOS would not longer be asking for the password, or the password would be different from what they used before.

That is a valid point, but relaying on the BIOS password to provide security for all your data might not be such a good idea. First problem is that all the BIOSes have had a long history of various default or "maintenance" passwords (I actually do not know how the situation looks today with those default passwords). Another problem is that the attacker might first clear the CMOS memory, and then modify her Evil MBR program to also display a fake BIOS password prompt, that would accept anything the user enters. This way the user will not be alerted that something is wrong and will be willing to provide the real password for drive decryption when prompted later by the actual drive encryption software.

One might ask why can't the attacker use the similar attack against BitLocker? Even if the real BitLocker uses trusted boot process, we can still infect the MBR, display the fake BitLocker PIN prompt and this way get into the possession of the user's PIN.

This attack, however, can be spotted by an inquisitive user — after all, if he or she knows they provided the correct PIN, then it would be suspicious not to see the system being booted (and it won't boot, because the fake BitLocker will not be able to retrieve the password from the TPM). If the fake BitLocker wanted to boot the OS (so that user didn't suspect anything), it would have to remove itself from the system and then reboot the system. Again this should alert the user that something wrong is going on.

There is also a much more elegant way of defending against the above attack (with fake BitLocker prompt) — but I'd rather let Microsoft to figure it out by themselves ;)

By the way, contrary to a popular belief the BitLocker doesn't protect your computer from boot-stage infections, e.g. MBR viruses or BIOS/PCI rootkits. As we have been pointing out since the first edition of our Understanding Stealth Malware training at Black Hat in August 2007, BitLocker should not be thought as of a system integrity protection. This is because it is trivial, for any malware that already got access to the running Vista, to re-seal the BitLocker key to arbitrary new system firmware/MBR configuration. Everybody can try it by going to Control Panel/BitLocker Driver Encryption, then clicking on the "Turn Off BitLocker" and choosing "Disable BitLocker Drive Encryption". This will simply save your disk decryption key in plaintext, allowing you to e.g. reflash your BIOS, boot Vista again and then to enable BitLocker again (this would generate a new key and seal it to the TPM with the new PCR values).


This functionality has been provided obviously to allow user to update his or her firmware. But what is important to keep in mind is that this process of disabling BitLocker doesn't involve entering any special password or PIN (e.g. the BitLocker's PIN). It just enough that you are the default user with admin rights or some malware running in this context. Pity they decided on the simplest solution here. But still BitLocker is simply the one coolest thing in Vista and something I really miss on all other OSes... \ No newline at end of file diff --git a/_posts/2009-01-26-closed-source-conspiracy.html b/_posts/2009-01-26-closed-source-conspiracy.html deleted file mode 100644 index cdc991b..0000000 --- a/_posts/2009-01-26-closed-source-conspiracy.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Closed Source Conspiracy -date: '2009-01-26T17:56:00.004+01:00' -author: Joanna Rutkowska -tags: -- philosophical -modified_time: '2009-03-19T22:19:30.493+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5520926602674392865 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/01/closed-source-conspiracy.html ---- - -Many people in the industry have an innate fear of closed source (AKA proprietary software), which especially applies to everything crypto-related.

The usual arguments go this way: this (proprietary) crypto software is bad, because the vendor might have put some backdoors in there. And: only the open source crypto software, which can be reviewed by anyone, can be trusted! So, after my recent post, quite a few people wrote to me and asked how I could defend such an evil thing as BitLocker, which is proprietary, and, even worse, comes from Microsoft?

I personally think this way of reasoning sucks. In majority of cases, the fact something is distributed without the accompanying source code does not prevent others from analyzing the code. We do have advanced disassemblers and debuggers, and it is really not that difficult to make use of them as many people think.

Of course, some heavily obfuscated programs can be extremely difficult to analyze. Also, analyzing a chipset's firmware, when you do not even know the underlying CPU architecture and the I/O map might be hard. But these are special cases and do not apply to majority of software, that usually is not obfuscated at all.

It seems like the argument of Backdoored Proprietary Software usually comes from the open-source people, who are used to unlimited accesses to the source code, and consequently do not usually have much experience with advanced reverse engineer techniques, simply because they do not need them in their happy "Open Source Life". It's all Darwinism, after all ;)

On the other hand, some things are hard to analyze, regardless of whether the source code is available or not, think: crypto. Also, how many of you who actively use open source crypto software, e.g. TrueCrypt or GnuPG, have actually reviewed the source code? Anyone?

You might be thinking — maybe I haven't looked at the source code myself, but because it is open source, zillions of other users already have reviewed it. And if there was some backdoor in there, they would undoubtedly have found it already! Well, for all those open source fetishists, who blindly negate the value of anything that is not open source, I have only one word to say: Debian.

Keep in mind: I do not say closed source is more secure than open source — I only resist the open-source fundamentalism, that defines every proprietary software as inherently insecure, and everything open source as ultimately secure.

So, how should one (e.g. a government institution) verify security-level of a given crypto software, e.g. to ensure there are no built-in backdoors in there? I personally doubt it could be performed by one team, as it just usually happens that the same people who might be exceptionally skilled in code review, system-level security, etc, at the same time are average cryptographers and vice-versa.

Imagine e.g. that you need to find out if there are any weaknesses in your system drive encryption software, something like BitLocker. Even if you get access to the source code, you still would have to analyze a lot of system-level details — how is the trusted boot implemented (SRTM? DRTM? TPM interaction?), which system software is trusted, how the implementation withstands various not-crypto-related attacks (e.g. some of the attacks I described in my previous post), etc…

But this all is just system-level evaluation. What should come later is to analyze the actual crypto algorithms and protocols. Those later tasks fall into cryptography field and not into system-level security discipline, and consequently should be performed by some other team, the crypto experts.

So, no doubt, it is not an easy task, and the fact if there is or there is not C/C++ source code available, is usually one of the minor headaches (a good example is our attack on TXT, where we were able to discover bugs in Intel's specific system software, which, of course, is not open source). \ No newline at end of file diff --git a/_posts/2009-02-10-nesting-vmms-reloaded.html b/_posts/2009-02-10-nesting-vmms-reloaded.html deleted file mode 100644 index 2eb5f40..0000000 --- a/_posts/2009-02-10-nesting-vmms-reloaded.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Nesting VMMs, Reloaded. -date: '2009-02-10T18:30:00.007+01:00' -author: Joanna Rutkowska -tags: -- xen hacking -- nested virtualization -modified_time: '2009-03-19T22:19:50.619+01:00' -thumbnail: http://3.bp.blogspot.com/_Ti3q3Hdvels/SZG7hylIacI/AAAAAAAAAD4/hjm246CQygk/s72-c/XP+inside+VPC+inside+Vista+inside+Xen.001.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-8942873381242351403 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/02/nesting-vmms-reloaded.html ---- - -Besides breaking the Intel's stuff, we have also been doing other things over at our lab. Thought I would share this cool screenshot of a Virtual PC running inside Xen. More precisely what you see on the pic is: Windows XP running inside Virtual PC, that runs inside Vista, which itself runs inside a Xen's HVM VM. Both the Virtual PC and Xen are using the Intel's hardware virtualization (VT-x is always used for HVM guests on Xen).

Our Nested Xen patch is part of a work done for a customer, so it is not going to be published. Besides it is currently a bit unstable ;) It's just a prototype that shows such a thing could be done.

\ No newline at end of file diff --git a/_posts/2009-02-19-attacking-intel-txt-paper-and-slides.html b/_posts/2009-02-19-attacking-intel-txt-paper-and-slides.html deleted file mode 100644 index 0c35932..0000000 --- a/_posts/2009-02-19-attacking-intel-txt-paper-and-slides.html +++ /dev/null @@ -1,18 +0,0 @@ ---- -layout: post -title: 'Attacking Intel TXT: paper and slides' -date: '2009-02-19T22:23:00.005+01:00' -author: Joanna Rutkowska -tags: -- attack -- tpm -- trusted execution technology -- trusted computing -- smm -- exploit -modified_time: '2009-03-19T22:23:04.772+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6448095799043943721 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/02/attacking-intel-txt-paper-and-slides.html ---- - -The new press release covering the basic details about our TXT attack is here.

The paper is here.

The slides converted to a PDF format are here. There is also an original version of slides in the Keynote format here for the Mac people. And for all the other people who don't use Mac, but still value the aesthetics (?!), I have also generated a QuickTime clickable movie out from the Keynote slides -- it can be found here, but it weighs 80MB.

Enjoy. \ No newline at end of file diff --git a/_posts/2009-03-13-independent-attack-discoveries.html b/_posts/2009-03-13-independent-attack-discoveries.html deleted file mode 100644 index 0149202..0000000 --- a/_posts/2009-03-13-independent-attack-discoveries.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Independent Attack Discoveries -date: '2009-03-13T13:22:00.004+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2009-03-19T22:18:53.049+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8073648126971577076 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/03/independent-attack-discoveries.html ---- - -Next week's Thursday, March 19th, 1600 UTC, we will publish a paper (+ exploits) on exploiting Intel® CPU cache mechanisms.

The attack allows for privilege escalation from Ring 0 to the SMM on many recent motherboards with Intel CPUs. Interestingly, the very same attack will be presented by another researcher, Loic Duflot, at the CanSecWest conference in Vancouver, Canada, on... Thursday 19th, 1600 UTC. BTW, this is a different SMM-targeting attack than the one we mentioned during our recent TXT talk and that is scheduled to be presented later this year.

Here's the full story (there is also a moral at the end) …

Just after our presentation at the Black Hat last month, we (i.e. Rafal and I) have been independently approached by some person (or two different persons — we haven't figured that out actually — there were some ca. 30 people willing to ask us questions after the talk, so it's hard to remember all the faces), who was very curious about our SMM attacks (whose details we haven't discussed, of course, because Intel is still working on a fix). This person(s) started asking various questions about the attacks and one of the questions, that was asked to both me and Rafal, was if the attack used caching. Later that day, during a private ITL dinner, one of us brought this issue, and we started thinking if it was indeed possible to perform an SMM attack via CPU caching. By the end of the dinner we have sketched out the attack, and later when we got back to Poland, Rafal implemented a working exploit with code execution in SMM in a matter of just a few hours. (I think I used way too many parenthesis in this paragraph).

So, being the good and responsible guys that we are, we immediately reported the new bug to Intel (actually talking to Intel's PSIRT is getting more and more routined for us in the recent months ;). And this is how we learnt that Loic came up with the same attack (back then there was no talk description at the conference website) — apparently he approached Intel about this back in October 2008, so 3-4 months before us — and also that he's planning to present it at the CanSecWest conference in March. So, we contacted Loic and agreed to do coordinated disclosure next Thursday.

Interestingly, however, none of us was even close to being the first discoverer of the underlying problem that our attacks exploit. In fact, the first mention of the possible attack using caching for compromising SMM has been discussed in certain documents authored as early as the end of 2005 (!) by nobody else than... Intel's own employees. Stay tuned for the details in our upcoming paper.

Conclusion

If there is a bug somewhere and if it stays unpatched for enough time, it is almost guaranteed that various people will (re)discover and exploit it, sooner or later. So, don't blame researchers that they find and publish information about bugs — they actually do a favor to our society. Remember the guy who asked us if our attack used caching? I bet he (or his associates) also have had exploits for this caching bug, but apparently didn't notify the vendor. Hmm, what they might have been doing with the exploit? When was the last time you scanned your system for SMM rootkits? ;)

Anyways, congrats to Loic for being the first one who wrote exploits for this bug. Also congrats to Intel employees who originally noticed the problem back in 2005. \ No newline at end of file diff --git a/_posts/2009-03-19-attacking-smm-memory-via-intel-cpu.html b/_posts/2009-03-19-attacking-smm-memory-via-intel-cpu.html deleted file mode 100644 index d4080c9..0000000 --- a/_posts/2009-03-19-attacking-smm-memory-via-intel-cpu.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Attacking SMM Memory via Intel® CPU Cache Poisoning -date: '2009-03-19T17:02:00.001+01:00' -author: Joanna Rutkowska -tags: -- attack -- smm -- exploit -modified_time: '2009-03-25T15:08:59.440+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7397577755549629314 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/03/attacking-smm-memory-via-intel-cpu.html ---- - -As promised, the paper and the proof of concept code has just been posted on the ITL website here.

A quote from the paper:
In this paper we have described practical exploitation of the CPU cache poisoning in order to read or write into (otherwise protected) SMRAM memory. We have implemented two working exploits: one for dumping the content of SMRAM and the other one for arbitrary code execution in SMRAM. This is the third attack on SMM memory our team has found within the last 10 months, affecting Intel-based systems. It seems that current state of firmware security, even in case of such reputable vendors as Intel, is quite unsatisfying.

The potential consequence of attacks on SMM might include SMM rootkits [9], hypervisor compromises [8], or OS kernel protection bypassing [2].
Don't worry, the shellcode we use in the exploit is totally harmless (have really no idea how some people concluded we were going to release an SMM rootkit today?) — it only increases an internal counter on every SMI and jumps back to the original handler. If you want something more fancy, AKA SMM rootkits, you might want to re-read Sherri's and Shawn's last year's Black Hat paper and try writing something they describe there.

The attack presented in the paper has been fixed on some systems according to Intel. We have however found out that even the relatively new boards, like e.g. Intel DQ35 are still vulnerable (the very recent Intel DQ45 doesn't seem to be vulnerable though). The exploit attached is for DQ35 board — the offsets would have to be changed to work on other boards (please do not ask how to do this).

Keep in mind this is a different SMM attack than the one we mentioned during our last month's Black Hat presentation on TXT bypassing (the VU#127284). We are planning to present that other attack at the upcoming Black Hat Vegas. Hopefully this will not be the only one thing that ITL will entertain you with in Vegas — Alex and Rafal are already working now on something even cooler (and even lower level) for the show, so cross your fingers!

And good luck to Loic with his presentation that is about to start just now... \ No newline at end of file diff --git a/_posts/2009-03-20-sky-is-falling.html b/_posts/2009-03-20-sky-is-falling.html deleted file mode 100644 index 8cdec2b..0000000 --- a/_posts/2009-03-20-sky-is-falling.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: The Sky Is Falling? -date: '2009-03-20T17:20:00.003+01:00' -author: Joanna Rutkowska -tags: -- philosophical -- fighting for a better world -modified_time: '2009-06-05T12:18:45.340+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6224623698776609952 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/03/sky-is-falling.html ---- - -A few reporters asked me if our recent paper on SMM attacking via CPU cache poisoning means the sky is really falling now?

Interestingly, not many people seem to have noticed that this is the 3rd attack against SMM our team has found in the last 10 months. OMG :o

But anyway, does the fact we can easily compromise the SMM today, and write SMM-based malware, does that mean the sky is falling for the average computer user?

No! The sky has actually fallen many years ago… Default users with admin privileges, monolithic kernels everywhere, most software unsigned and downloadable over plaintext HTTP — these are the main reasons we cannot trust our systems today. And those pathetic attempts to fix it, e.g. via restricting admin users on Vista, but still requiring full admin rights to install any piece of stupid software. Or selling people illusion of security via A/V programs, that cannot even protect themselves properly…

It's also funny how so many people focus on solving the security problems by "Security by Correctness" or "Security by Obscurity" approaches — patches, patches, NX and ASLR — all good, but it is not gonna work as an ultimate protection (if it could, it would worked out already).

On the other hand, there are some emerging technologies out there that could allow us to implement effective "Security by Isolation" approach. Such technologies as VT-x/AMD-V, VT-d/IOMMU or Intel TXT and TPM.

So we, at ITL, focus on analyzing those new technologies, even though almost nobody uses them today. Because those technologies could actually make the difference. Unlike A/V programs or Patch Tuesdays, those technologies can change the level of sophistication required for the attacker dramatically.

The attacks we focus on are important for those new technologies — e.g. today Intel TXT is pretty much useless without protection from SMM attacks. And currently there is no such protection, which sucks. SMM rootkits sound sexy, but, frankly, the bad guys are doing just fine using traditional kernel mode malware (due to the fact that A/V is not effective). Of course, SMM rootkits are just yet another annoyance for the traditional A/V programs, which is good, but they might not be the most important consequence of SMM attacks.

So, should the average Joe Dow care about our SMM attacks? Absolutely not! \ No newline at end of file diff --git a/_posts/2009-03-25-trusting-hardware.html b/_posts/2009-03-25-trusting-hardware.html deleted file mode 100644 index 34aef64..0000000 --- a/_posts/2009-03-25-trusting-hardware.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Trusting Hardware -date: '2009-03-25T14:37:00.008+01:00' -author: Joanna Rutkowska -tags: -- trusted computing -- philosophical -- backdoors -modified_time: '2009-06-05T12:19:15.291+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2606319367477937236 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/03/trusting-hardware.html ---- - -So, you're a decent paranoid person, running only open source software on your box: Linux, GNU, etc. You have the feeling you could, if you only wanted to, review every single line of code (of course you will probably never do this, but anyway). You might be even more paranoid and also try running an open source BIOS. You feel satisfied and cannot understand all those stupid people running closed source systems like e.g. Windows. Right?

But here's where you are stuck — you still must trust your hardware. Trust that your hardware vendor has not e.g. built in a backdoor into your network card micro-controller…

So, if we buy a laptop from vendor X, that might be based in some not-fully-democratic country, how do we know they didn't put backdoors there? And not only to spy on Americans, also to spy on their own citizens? When was the last time you reverse-engineered all the PCI devices on your motherboard?

Scared? Good!

Enters the game-changer: IOMMU (known as VT-d on Intel). With proper OS/VMM design, this technology can address the very problem of most of the hardware backdoors. A good example of a practical system that allows for that is Xen 3.3, which supports VT-d and allows you to move drivers into a separate, unprivileged driver domain(s). This way each PCI device can be limited to DMA only to the memory region occupied by its own driver.

The network card's microcontroller can still compromise the network card driver, but nothing else. Assuming we are using only encrypted communication, there is not much an attacker can gain by compromising this network card driver, besides doing a DoS. Similarly for the disk driver — if we use full disk encryption (which is a good idea anyway), there is not much an attacker can gain from compromising the low-level disk driver.

Obviously the design of such a system (especially used for desktop computing) is not trivial ans needs to be thoroughly thought out. But it is possible today(!), thanks to those new virtualization technologies.

It seems than, that we could protect ourselves against potentially malicious hardware. With one exception however… we still need to trust the CPU and also the memory controller (AKA northbridge AKA chipset), that implements that IOMMU.

On AMD systems, the memory controller has long been integrated into the processor. Also Intel's recent Nehalem processors integrate the memory controller on the same die.

This all means we need to trust only one vendor (Intel or AMD) and only one component, i.e. The Processor. But should we blindly trust them? After all it would be trivial for Intel or AMD to build in a backdoor into their processor. Even something as simple as:

if (rax == MAGIC_1 && rcx == MAGIC_2) jmp [rbx]

Just a few more gates in the CPU I guess (there are apparently already about 780 million gates on Core i7, so a few more should not make much difference), and no performance penalty. Exploitable remotely on most systems and any more complex program I guess. Yet, totally undetectable for anybody without an electron microscope (and tons of skills and knowledge).

And this is just the simplest example that comes to mind within just a few minutes. I'm sure one could come up with something even more universal and reliable. The fact is — if you are the CPU vendor, it is trivial for you to build in an effective backdoor.

It's funny how various people, e.g. European government institutions, are afraid of using closed source software, e.g. Windows, because they are afraid of Microsoft putting backdoors there. Yet, they are not concerned about using processors made by some other US companies. It is significantly more risky for Microsoft to put a backdoor into its software, where even a skilled teenager equipped with IDA Pro can find it, than it is for Intel or AMD, where effectively nobody can find it.

So, I wonder whether various government and large corporate customers from outside the US will start asking Intel and AMD to provide them with the exact blueprints of their processors. After all they already require Microsoft to provide them with the source code under an NDA, right? So, why not the "source code" for the processor?

Unfortunately there is nothing that could stop a processor vendor to provide its customers with a different blueprints than those that are used to actually "burn" the processors. So, the additional requirement would be needed that they also allow to audit their manufacturing process. Another solution would be to hire some group of independent researchers, equip them with an electron microscope and let them reverse engineer some randomly chosen processors… Hmmm, I even know a team that would love to do that ;)

A quick summary in case you get lost already:
  1. On most systems we are not protected against hardware backdoors, e.g. in the network card controller.
  2. New technologies, e.g. Intel VT-d, can allow to protect against potentially malicious hardware (requires specially designed OS, e.g. specially configured Xen)…
  3. … except for the potential backdoors in the processor.
  4. If we don't trust Microsoft, why should we trust Intel or AMD?
BTW, in May I will be speaking at the Confidence conference in Krakow, Poland. This is gonna be a keynote, so don't expect new attacks to be revealed, but rather some more philosophical stuff about trusted computing (why it is not evil) and problems like the one discussed today. See you there! \ No newline at end of file diff --git a/_posts/2009-05-28-thoughts-about-trusted-computing.html b/_posts/2009-05-28-thoughts-about-trusted-computing.html deleted file mode 100644 index 0047f30..0000000 --- a/_posts/2009-05-28-thoughts-about-trusted-computing.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Thoughts About Trusted Computing -date: '2009-05-28T00:58:00.004+02:00' -author: Joanna Rutkowska -tags: -- trusted computing -- philosophical -modified_time: '2009-08-01T19:36:41.267+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6453215149663280165 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/05/thoughts-about-trusted-computing.html ---- - -Here are the slides about Trusted Computing I used for my presentations at the EuSecWest today, and at the Confidence conference last week.

As this was supposed to be a keynote, the slides are much less technical then our other slides, and also there are no new attacks presented there. Still, I hope they might be useful as some sort of an "alternative" introduction to Trusted Computing :)

A cool presentation I saw today was about PCI-based backdoors by Christophe Devine and Guillaume Vissian. They basically took a general-purpose FPGA programmable PC-card (AKA PCMCIA), flashed it with an FPGA "program" that implemented a simple state machine. The purpose of the state machine was to wait until its DMA engine gets initialized and then to modify certain bytes in the host memory, that happened to be part of the winlogon.exe process (IIRC they changed XOR AL, AL into MOV AL, 1, or something like that, at the end of some password verification function inside the winlogon.exe process). The slides should be available soon on the conference website. I also hope they will publish all the source code needed to flash your own personal "winlogon unlocker".

The live demo was really impressive — they showed a winlogon screen, tried to login a few times with wrong passwords, of course all the attempts failed, then they inserted their magic, $300 worth, PC-card, and… 2 seconds later they could log in using any password they wanted.

While not necessary being a breakthrough, as everybody has known such things could be done for years, I think it is still important that somebody eventually implemented this, discussed the technical details (FPGA-related), and also showed how to implement it with a cheap generic "reflashable" hardware without using a soldering iron.

Of course I have also discussed in my presentation how to prevent PCI-based backdoors (like the one discussed here) using VT-d, but this defense is currently only available if you use Xen 3.3 or later, and also requires that you manually create driver domain partitions and come up with a reasonable scheme for assigning devices to driver domains. All in all 99.9% of users are not (and will not be anytime soon) protected against such attacks. Oh, wait, there is actually a relatively simple software-based workaround (besides putting a glue into your PC-card slot, which is not a very subtle one)… I wonder who else will find out :) \ No newline at end of file diff --git a/_posts/2009-06-02-more-thoughts-on-cpu-backdoors.html b/_posts/2009-06-02-more-thoughts-on-cpu-backdoors.html deleted file mode 100644 index 7f0569c..0000000 --- a/_posts/2009-06-02-more-thoughts-on-cpu-backdoors.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: More Thoughts on CPU backdoors -date: '2009-06-02T00:16:00.003+02:00' -author: Joanna Rutkowska -tags: -- philosophical -- backdoors -modified_time: '2009-08-25T11:58:39.136+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2058775943106512545 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/06/more-thoughts-on-cpu-backdoors.html ---- - -I've recently exchanged a few emails with Loic Duflot about CPU-based backdoors. It turned out that he recently wrote a paper about hypothetical CPU-backdoors and also implemented some proof-of-concept ones using QEMU (for he doesn't happen to own a private CPU production line). The paper can be bought here. (Loic is an academic, and so he must follow some of the strange customs in the academic world, one of them being that papers are not freely published, but rather being sold on a publisher website… Heck, even we, the ultimately commercialized researchers, still publish our papers and code for free).

Let me stress that what Loic writes about in the paper are only hypothetical backdoors, i.e. no actual backdoors have been found on any real CPU (ever, AFAIK!). What he does is he considers how Intel or AMD could implement a backdoor, and then he simulate this process by using QEMU and implementing those backdoors inside QEMU.

Loic also focuses on local privilege escalation backdoors only. You should however not underestimate a good local privilege escalation — such things could be used to break out of any virtual machine, like VMWare, or potentially even out of a software VMs like e.g. Java VM.

The backdoors Loic considers are somewhat similar in principle to the simple pseudo-code one-liner backdoor I used in my previous post about hardware backdoors, only more complicated in the actual implementation, as he took care about a few important details, that I naturally didn't concern. (BTW, the main message of my previous post about was how cool technology this VT-d is, being able to prevent PCI-based backdoors, and not about how doomed we are because of Intel- or AMD-induced potential backdoors).

Some people believe that processor backdoors do not exist in reality, because if they did, the competing CPU makers would be able to find them in each others' products, and later would likely cause a "leak" to the public about such backdoors (think: Black PR). Here people make an assumption that AMD or Intel is technically capable of reversing each others processors, which seems to be a natural consequence of them being able to produce them.

I don't think I fully agree with such an assumption though. Just the fact that you are capable of designing and producing a CPU, doesn't mean you can also reverse engineer it. Just the fact that Adobe can write a few hundred megabyte application, doesn't mean they are automatically capable of also reverse engineering similar applications of that size. Even if we assumed that it is technically feasible to use some electron microscope to scan and map all the electronic elements from the processor, there is still a problem of interpreting of how all those hundreds of millions of transistors actually work.

Anyway, a few more thoughts about properties of a hypothetical backdoors that Intel or AMD might use (be using).

First, I think that in such a backdoor scenario everything besides the "trigger" would be encrypted. The trigger is something that you must execute first, in order to activate the backdoor (e.g. the CMP instruction with particular, i.e. magic, values of some registers, say EAX, EBX, ECX, EDX). Only then the backdoor gets activated and e.g. the processor auto-magically escalates into Ring 0. Loic considers this in more detail in his paper. So, my point is that all the attacker's code that executes afterwards, think of it as of a shellcode for the backdoor, that is specific for the OS, is fetched by the processor in an encrypted form and decrypted only internally inside the CPU. That should be trivial to implement, while at the same time should complicate any potential forensic analysis afterwards — it would be highly non-trivial to understand what the backdoor actually have done.

Another crucial thing for a processor backdoor, I think, should be some sort of an anti-reply attack protection. Normally, if a smart admin had been recording all the network traffic, and also all the executables that ever got executed on the host, chances are that he or she would catch the triggering code and the shellcode (which might be encrypted, but still). So, no matter how subtle the trigger is, it is still quite possible that a curious admin will eventually find out that some tetris.exe somehow managed to breakout of a hardware VM and did something strange, e.g. installed a rootkit in a hypervisor (or some Java code somehow was able to send over all our DOCX files from our home directory).

Eventually the curious admin will find out that strange CPU instruction (the trigger) after which all the strange things had happened. Now, if the admin was able to take this code and replicate it, post it to Daily Dave, then, assuming his message would pass through the Moderator (Hi Dave), he would effectively compromise the processor vendor's reputation.

An anti-replay mechanism could ideally be some sort of a challenge-response protocol used in a trigger. So, instead having you always to put 0xdeadbeaf, 0xbabecafe, and 0x41414141 into EAX, EBX and EDX and execute some magic instruction (say CMP), you would have to put a magic that is a result of some crypto operation, taking current date and magic key as input:

Magic = MAGIC (Date, IntelSecretKey).

The obvious problem is how the processor can obtain current date? It would have to talk to the south-bridge at best, which is 1) nontrivial, and 2) observable on a bus, and 3) spoof'able.

A much better idea would be to equip a processor with some sort of an eeprom memory, say big enough to hold one 64-bit or maybe 128-bit value. Each processor would get a different value flashed there when leaving the factory. Now, in order to trigger the backdoor, the processor vendor (or backdoor operator, think: NSA) would have to do the following:

1) First execute some code that would read this unique value stored in eeprom for the particular target processor, and send this back to them,

2) Now, they could generate the actual magic for the trigger:

Magic = MAGIC (UniqeValueInEeprom, IntelSecretKey)

3) ...and send the actual code to execute the backdoor and shellcode, with the correct trigger embedded, based on the magic value.

Now, the point is that the processor will automatically increment the unique number stored in the eeprom, so the same backdoor-exploiting code would not work twice for the same processor (while at the same time it would be easy for NSA to send another exploit, as they know what the next value in the eeprom should be). Also, such a customized exploit would not work on any other CPU, as the assumption was that each CPU gets a different value at the factory, so again it would not be possible to replicate the attack and proved that the particular code has ever done something wrong.

So, the moment I learn that processors have built-in eeprom memory, I will start thinking seriously there are backdoors out there :)

One thing that bothers me with all those divagations about hypothetical backdoors in processors is that I find them pretty useless in at the end of the day. After all, by talking about those backdoors, and how they might be created, we do not make it any easier to protect against them, as there simply is no possible defense here. Also this doesn't make it any easier for us to build such backdoors (if we wanted to become the bad guys for a change). It might only be of an interest to Intel or AMD, or whatever else processor maker, but I somewhat feel they have already spent much more time thinking about it, and chances are they probably can only laugh at what we are saying here, seeing how unsophisticated our proposed backdoors are. So, my Dear Reader, I think you've been just wasting time reading this post ;) Sorry for tricking you into this and I hope to write something more practical next time :) \ No newline at end of file diff --git a/_posts/2009-06-09-quest-to-core.html b/_posts/2009-06-09-quest-to-core.html deleted file mode 100644 index 8f16b8b..0000000 --- a/_posts/2009-06-09-quest-to-core.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Quest to The Core -date: '2009-06-09T15:10:00.004+02:00' -author: Joanna Rutkowska -tags: -- company news -- attack -modified_time: '2009-08-25T11:58:49.731+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-360542347844086177 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/06/quest-to-core.html ---- - -If you think SMM rootkits or PCI backdoors is low-level, then you should certainly see our talks in Vegas — ITL is going to define what does the "low-level" adjective really mean at the end of the decade ;)

In case you haven't noticed it at the Black Hat website yet — Alex and Rafal will be giving two presentations in Vegas:

1) Introducing Ring -3 Rootkits (description)

2) Attacking Intel® BIOS (description)

Let me stress that we have been in touch with Intel for quite some time about the above attacks, and that Intel is planning to release appropriate fixes a few weeks before our presentations at Black Hat.

There is more than just this coming at this year's Black Hat — most notably we will also be debuting with our Virtualization (In)Security Training. I will write a separate post about this training (containing a detailed agenda) in the coming days, so stay tuned.

Quite exciting. \ No newline at end of file diff --git a/_posts/2009-06-12-virtualization-insecurity-training-in.html b/_posts/2009-06-12-virtualization-insecurity-training-in.html deleted file mode 100644 index 03a9b63..0000000 --- a/_posts/2009-06-12-virtualization-insecurity-training-in.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Virtualization (In)Security Training in Vegas -date: '2009-06-12T14:08:00.003+02:00' -author: Joanna Rutkowska -tags: -- xen hacking -- company news -modified_time: '2009-08-25T11:59:02.603+02:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/SjJF-ePDEUI/AAAAAAAAAEo/5ealWjYcCn4/s72-c/neurons.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-7377753647053577701 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/06/virtualization-insecurity-training-in.html ---- - -VM escapes, hypervisor compromises (via "classic" rootkits, as well as Bluepill-like rootkits), hypervisor protection strategies, SMM attacks, TXT bypassing, and more — these are some of the topics that will be covered by our brand new training on Virtualization (In)Security at the upcoming Black Hat USA.

The training offers quite a unique chance, I think, to absorb the results of 1+ year of the research done by our team within... just 2 days. This will be provided via detailed lectures and unique hands-on exercises.

Unlike our previous training on stealth malware (that will also be offered this year, BTW), this time we will offer attendees a bit of hope :) We will be stressing that some of the new hardware technologies (Intel TXT, VT, TPM), if used properly, have potential to dramatically increase security of our computer systems. Sure, we will be showing attacks against those technologies (e.g. TXT), but nevertheless we will be stressing that this is the proper way to go in the long run.

Interestingly, I'm not aware of any similar training of this kind, that would be covering the security issues related to virtualization systems and bare metal hypervisors. Hope we will not get into troubles with the Antitrust Commission for monopolizing this field ;)

The training brochure (something for your boss) is here.

The detailed agenda spanning 2 full days can be downloaded here.

The Black Hat signup page is here.

\ No newline at end of file diff --git a/_posts/2009-07-17-interview.html b/_posts/2009-07-17-interview.html deleted file mode 100644 index 97ac78f..0000000 --- a/_posts/2009-07-17-interview.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Interview -date: '2009-07-17T00:12:00.004+02:00' -author: Joanna Rutkowska -tags: -- general -modified_time: '2009-08-25T11:59:13.263+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4456369931211035223 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/07/interview.html ---- - -Alan Dang from Tom's Hardware did an interview with me. I talk there about quite a lot of things, many of which I would probably write about on this blog sooner or later (or already had), so I thought it might be of interest to the readers of this blog. \ No newline at end of file diff --git a/_posts/2009-07-30-black-hat-2009-slides.html b/_posts/2009-07-30-black-hat-2009-slides.html deleted file mode 100644 index bcad24b..0000000 --- a/_posts/2009-07-30-black-hat-2009-slides.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Black Hat 2009 Slides -date: '2009-07-30T23:18:00.006+02:00' -author: Joanna Rutkowska -tags: -- chipset -- BIOS -- attack -- smm -- exploit -modified_time: '2009-08-25T11:59:22.095+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-9064869513973571664 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/07/black-hat-2009-slides.html ---- - -The wait is over. The slides are here. The press release is here. Unless you're a chipset/BIOS engineer kind of person, I strongly recommend reading the press release first, before opening the slides.

So, the "Ring -3 Rootkit" presentation is about vPro/AMT chipset compromises. The "Attacking Intel BIOS" presentation is about exploiting a heap overflow in BIOS environment in order to bypass reflashing protection, that otherwise allows only Intel-signed updates to be flashed.

We will publish the code some time after get back from Vegas.

Enjoy.

ps. Let me remind my dear readers that all the files hosted on the ITL website are not digitally signed and are served over a plaintext connection (HTTP). In addition, the ITL's website is hosted on a 3rd party provider's server, on which we have totally no control (which is the reason why we don't buy an SSL certificate for the website). Never trust unsigned files that you download from the Internet. ITL cannot be liable for any damages caused by the files downloaded from our website, unless they are digitally signed. \ No newline at end of file diff --git a/_posts/2009-08-25-vegas-toys-part-i-ring-3-tools.html b/_posts/2009-08-25-vegas-toys-part-i-ring-3-tools.html deleted file mode 100644 index 77b4c28..0000000 --- a/_posts/2009-08-25-vegas-toys-part-i-ring-3-tools.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 'Vegas Toys (Part I): The Ring -3 Tools' -date: '2009-08-25T11:59:00.007+02:00' -author: Joanna Rutkowska -tags: -- rootkits -- chipset -- exploit -modified_time: '2009-10-15T22:00:04.114+02:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/SpO6Tov88rI/AAAAAAAAAFI/0RkGsL5rM28/s72-c/Ring+-3+Rootkit+White+Diagram.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-3052797530568154320 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/08/vegas-toys-part-i-ring-3-tools.html ---- - -We've just published the proof of concept code for the Alex's and Rafal's "Ring -3 Rootkits" talk, presented last month at the Black Hat conference in Vegas. You can download the code from our website here. It's highly recommended that one (re)reads the slides before playing with the code.

In short, the code demonstrates injection of an arbitrary ARC4 code into a vPro-compatible chipset AMT/ME memory using the chipset memory reclaiming attack. Check the README and the slides for more information.


The actual ARC4 code we distribute here is very simple: it sets a DMA write transaction to the host memory every ca. 15 seconds in order to write the "ITL" string at the predefined physical addresses (increased by 4 with every iteration). Of course one can do DMA read as well.


The ability to do DMA from the ARC4 code to/from the host memory is, in fact, all that is necessary to write a sophisticated rootkit or any sort of malware, from funny jokers to sophisticated secret sniffers. Your imagination (and good pattern searching) is the only limit here.

The OS, nor any software running on the host OS, cannot access our rootkit code, unless, of course, it used the same remapping attack we used to insert our code there :) But the rootkit might even cut off this way by locking down the remapping registers, so fixing the vulnerability on the fly, after exploiting it (of course it would be insane for any AV to use our remapping attack in order to scan ME space, but just for completeness;)

An OS might attempt to protect itself from DMA accesses from the rootkit in the chipset by carefully setting VT-d protections. Xen 3.3/3.4, for example, sets VT-d protections in such a way that our rootkit cannot access the Xen hypervisor memory. We can, however, access all the other parts of the system which includes all the domains memory (i.e. where all the interesting data are located). Still, it should be possible to modify Xen so that it set VT-d mappings in such a strict way, that the AMT code (and the AMT rootkit) could not access any useful information in any of the domains. This, in fact, would be a good idea anyway, as it would also prevent any sort of hardware-based backdoors (except for the backdoors in the CPU).

An AMT rootkit can, however, get around such a savvy OS because it can modify the OS's VT-d initialization code before it sets the VT-d protections. Alternatively, if the protections are set before the rootkit was activated, the rootkit can force the system to reboot and boot it from the AMT Virtual CDROM (In fact AMT has been designed to be able to do exactly that), which would contain rootkit agent code that would modify the OS/VMM to-be-loaded image, so that it doesn't setup VT-d properly.

Of course, the proper solution against such an attack would be to use e.g. Intel TXT to assure trusted boot of the system. In theory this should work. In practice, as you might recall, we have already shown how to bypass Intel TXT. This TXT bypass attack still works on most (all?) hardware, as there is still no STM available in the wild (all that is needed for the attack is to have a working SMM attack, and last month we showed 2 such attacks — see the slides for the BIOS talk).

Intel has released a patch a day before our presentation at Black Hat. This is a cumulative patch that is also targeting a few other, unrelated, problems, like e.g. the SMM caching attack (also reported by Loic), the SMM nvacpi attack, and the Q45 BIOS reflashing attack (for which the code will be also published shortly).

Some of you might remember that Intel has patched this very remapping bug last year, after our Xen 0wning Trilogy presentations, where we used the very same bug to get around Xen hypervisor protections. However, Intel forgot about one small detail — namely it was perfectly possible for malware to downgrade BIOS to the previous, pre-Black-Hat-2008 version, without any user consent (after all this old BIO file was also digitally signed by Intel). So, with just one additional reboot (but without a user intervention needed) malware could still use the old remapping bug, this time to get access to the AMT memory. The recent patch mentioned above solves this problem by displaying a prompt during reflash boot, if reflashing to an older version of BIOS. So now it requires user intervention (a physical presence). This "downgrade protection" works, however, only if we have administrator password enabled in BIOS.

We could get into the AMT memory on Q35, however, even if the downgrade attack was not possible. In that case we could use our BIOS reflashing exploit (the other Black Hat presentation).

However, this situation looks differently on Intel latest Q45 chipsets (that also have AMT). As explained in the presentation, we were unable to get access to the AMT memory on those chipsets, even though we can reflash the BIOS there, and consequently, even though we can get rid of all the chipset locks (e.g. the remapping locks). Still, the remapping doesn't seem to work for this one memory range, where the AMT code resides.

This suggest Intel added some additional hardware to the Q45 chipset (and other Series 4 chipsets) to prevent this very type of attacks. But we're not giving up on Q45 yet, and we will be trying other attacks, as soon as we recover from the holiday laziness ;)

Finally, the nice picture of the Q35 chipset (MCH), where our rootkit lives :) The ARC4 processor is somewhere inside...

\ No newline at end of file diff --git a/_posts/2009-08-26-pdf-signing-and-beyond.html b/_posts/2009-08-26-pdf-signing-and-beyond.html deleted file mode 100644 index ec24cad..0000000 --- a/_posts/2009-08-26-pdf-signing-and-beyond.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: PDF signing and beyond -date: '2009-08-26T21:48:00.004+02:00' -author: Joanna Rutkowska -tags: -- philosophical -- general -- fighting for a better world -modified_time: '2009-10-15T21:59:53.837+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3613638502091357780 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/08/pdf-signing-and-beyond.html ---- - -Today I got an advertising email from GlobalSign (where I previously bought a code signing certificate for Vista kernel drivers some years ago) highlighting their new (?) type of certificates for signing of Adobe PDF files. It made me curious, because, frankly, I've been recently more and more missing this feature. After a quick online research it turned out that this whole Adobe Certified Documents Services (CDS) seem to be nothing new, as apparently even Adobe Reader 6.0 had support for verifying those CDS certificates. The certificates are also available from other popular certification authorities like e.g. Entrust and Verisign, and a couple of others.

So, I immediately felt stupid that I haven't been aware of such a great feature, which apparently is out there for a few years now. Why I thought it was so great a feature? Consider the following scenario…

At our Invisible Things Lab resources page we offer a handful of files to download — slides and some proof of concept code. The website is served over a plaintext HTTP. This means that if you're downloading anything over a public WiFi (hotel, airport lounge, etc) you never know if the PDF you actually get has not been infected somewhere in the middle, e.g. by a guy in the lobby that is messing with the hotel WiFi.

So, one might argue that I should have paid a few hundred bucks and get an SSL certificate for my website and start serving it over HTTPS. But here's the problem — I, as zillions of other small businesses and individuals, host my website on some 5-dollar-a-month one-of-the-thousands hosting provider. I have zero knowledge about what people work there and if they can be trusted, and I also know nothing (and have zero impact) on how secure (or not, for that matter) the server is. (Same applies to my cell phone carrier, ISP, etc, BTW).

Now, the SSL certificate for the website "knows" nothing about how the files on my website should look like, in particular if they are compromised or not. All the SSL certificate does is to give assurance to the remote client that he or she downloaded the actual files that were on the server in the moment of downloading — whether they were the original ones authored by me, or perhaps maliciously modified by somebody who got access to the server.

So, the solution with an SSL certificate would work only if I trusted my web server, which could be assumed only if I run my own dedicated server. That, however, would be an overkill for a small company like ITL, especially that our business is not based on our web presence — in fact the website is maintained mainly for other researchers and students, who can easily download our papers and code from there, and also for the reporters so they can e.g. download a press release from there.

Surprisingly, the website has never been compromised, probably because it doesn't present an interesting target for any skilled person (or maybe exceptionally skilled people work at the hosting provider?). But I cannot know for sure, as I don't constantly monitor all the hashes of all the files, as this would require… well a dedicated server that would be running an SHA1 calculating script in a loop for 24/7 :)

Of course, zillions of other websites works this very same way and present the very same problems.

Now, ability to sign PDFs would be just a great solution here, because I could sign all those files with my certificate, and then all the people downloading stuff from ITL could know they are getting original PDFs that were created on one of the ITL members desktop computers, no matter how compromised the web server or the network connection is.

For the same reasons, I would welcome if others started doing the same, as currently I simply must assume every PDF I download from the net (and PDFs account for the majority of file downloads I do) to be potentially malicious. So, I always open them in my Red or Yellow VM (depending on the source of the download), and only if it "looks good" (very fuzzy term, I know), I might decide to move it to my host desktop (it's easier to work with PDFs on your host, and actually you should use your host desktop for something).

(Yes, I know, Kostya Kortchinsky, or Rafal, can sometimes escape from VMWare, but still I believe that today the best isolation I can get on a desktop, without sacrificing much convince, is via a type II hypervisor. It's horribly inelegant, but well, that's life).

So, I read some more about this Adobe CDS, being all excited about it, and ready to spend a few hundred euros on a certificate, only to realize that it doesn't look as good as I thought.

First disappointment comes from the fact that you must create a PDF using Adobe Acrobat software (not the Reader, but the commercial one). I've created all my PDFs using either Office (in the past) or iWork (today), and none of them seem to offer a way to digitally sign the PDF. I would like to get a simple tool, say pdfsign.exe, that I could use to sign any PDF I have, no matter how I generated it. Also, not surprisingly, the Mac native PDF viewer (Preview) doesn't seem to recognize the digital signature, and I bet some Linux PDF viewers do not as well.

Worst of all, even the Acrobat Reader 9, that I tested under Windows, and that correctly displayed all the CDS information, does one unbelievably stupid thing — it parses and renders the whole PDF before displaying the signature info. So, if you downloaded a malicious PDF, Acrobat Reader will happily open it and parse, without asking you a question of whether you would like to open it (as it is perhaps unsigned). At least I was unable to find an option that would force it to do that. So, if this PDF contained an exploit for the reader, it surely would get executed. Compare this with the (correct) behavior of Vista UAC where it presents the executable signature details before executing it.

You can see how your software works with Adobe PDF signatures, e.g. by looking at this exemplary file signed by GlobalSign.

So, Adobe CDS, in the form they are today, seem to be pretty useless, as far as protection from potentially malicious PDFs is considered (they surely have other positive applications, e.g. to certify about authenticity of e.g. a diploma).

But wouldn't it be great to have such a file signing mechanism globally adopted and not only for PDFs, but for any sort of files, including ZIPs, tgz's, heck, even plain text files? And have our main OSes generically recognize those signatures and display unified prompts of whether we want to allow an application to to open the file or not? Perhaps, in some situations, we could even define policies for specific applications. This seems easy to do from the technical point of view — we just need to "hook" (oh, God, did I say "hook"?) high-level OS API's like e.g. open() or CreateFile().

What about PGP and possibility of using this for signing any sort of files? Well, we use PGP a lot at ITL, but mainly for securing peer-to-peer communication (e.g. between us and our clients). There really is no good way to publish one's PGP key — the concept of Web of Trust might be good for some closed groups of people, but not for publishing files "to the world". And, of course, the first thing that an attacker who subverted PDFs on our website will do is to also subvert the PGP key displayed on the website. I also tried once to publish a PGP key to a key server, but got discouraged immediately after I noticed it didn't use SSL for submission. BTW, anybody knows if the key servers today use SSL? If not, how the trust is established? Maybe email clients, e.g. Thunderbird, come with built in PGP keys for select key servers?

So, I guess that was the main point of writing this post — to express how madly I would welcome a generic, OS-based, non-obligatory, signature verification for files, based on PKI :)

Ah, before a dozen of people jumps to the comment box to tell me that digital signatures do not assure non-maliciousness of anything — please don't do that, because I actually know that. In fact, it is not possible to assure non-maliciousness of pretty much anything, especially without strictly defining an ethical system we would like to use first. What the signatures provide is the liability, so that I know who to sue, in case my naked holiday pictures got leaked to the public because of some malicious PDF exploiting my system. In that case I can sue either the actual person who signed the PDF (if this person is identifiable) or the certification authority who issued the certificate to a wrong (unidentifiable) person. \ No newline at end of file diff --git a/_posts/2009-09-02-about-apples-security-foundations-or.html b/_posts/2009-09-02-about-apples-security-foundations-or.html deleted file mode 100644 index ff6eb54..0000000 --- a/_posts/2009-09-02-about-apples-security-foundations-or.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: About Apple’s Security Foundations, Or Lack Of Thereof... -date: '2009-09-02T16:19:00.004+02:00' -author: Joanna Rutkowska -tags: -- general -- fighting for a better world -modified_time: '2009-10-15T22:00:21.812+02:00' -thumbnail: http://1.bp.blogspot.com/_Ti3q3Hdvels/Sp5_8M68juI/AAAAAAAAAFQ/-_lxhA_Yg6o/s72-c/thunderbird+installer+on+vista.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-8958558851864832778 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/09/about-apples-security-foundations-or.html ---- - -Every once in a while it’s healthy to reinstall your system... I know, I know, it’s almost a heresy to say that, but that’s reality in the world where our systems are totally unverifiable. In fact I don’t even attempt to verify if my Mac laptop has been compromised in any way (most system files are not signed anyway). But sometimes, you got this feeling that something might be wrong and you decide to reinstall to start your (digital) life all over again :)

So, every time I (re)install a Mac-based system, I end up cursing horribly at Apple’s architects. Why? Because in the Apple World they seem to totally ignore the concept of files integrity, to such extent that it’s virtually impossible to get any assurance that the programs I install are in any way authentic (i.e. not tampered by some 3rd party, e.g. by somebody controlling my Internet connection).

Take any Apple installer package, e.g. Thunderbird. In most cases an installer package on Mac is a .dmg file, that represents an installation disk image. Now, when you open such a file under Mac, the OS will never display any information about if this file is somehow signed (e.g. by who) or not. In fact, I’m pretty sure it’s never signed. What you end up with, is a .dmg file that you just downloaded over plaintext HTTP and you have absolutely no way of verifying if it is the original file the vendor really published. And you’re just about to grant admin privileges to the installer program that is inside this file -- after all it’s an installer, so must got root privileges, right (well, not quite maybe)? Beautiful...

Interestingly, this very same Thunderbird installer, but for Windows, is correctly signed, and Windows, correctly, displays that information (together with the ability to examine the certificate) and allows the user to make a choice of whether to allow it to run or not.



Sure, the certificate doesn’t guarantee that Mozilla didn’t put a nasty backdoor in there, nor that the file was not compromised due to Mozilla’s internal server compromise. Or that the certificate (the private key) wasn’t somehow stolen from Mozilla, or that the issuing authority didn’t make a mistake and maybe issued this certificate to some random guy, who just happened to be named Mozilla.

But the certificate provides liability. If it indeed turns out that this very Thunderbird installer was somehow malicious, I could take this signed file to the court and sue either Mozilla, or the certification authority for all the damages it might have done to me. Without the certificate I cannot do that, because I (and nobody) cannot know if the file was tampered while being downloaded (e.g. malicious ISP) or maybe because my system was already compromised.

But in case of Apple, we have no such choice -- we need to take the risk every time we download a program from the Internet. We must bet the security of our whole system, that at this very moment nobody is tampering with out (unsecured) HTTP connection, and also that nobody compromised the vendor’s Web Server, and, of course, we hope that the vendor didn’t put any malicious code into its product (as we could not sue them for it).

So that sucks. That sucks terribly! Without ability to check the integrity of programs we want to install, we cannot build any solid foundations. It’s funny how people divagate whether Apple implemented ASLR correctly in Snow Leopard, or not? Or whether NX is bypassable. It’s meaningless to dive into such advanced topics, if we cannot even assure that at the day 0 our system is clean. We need to start building our systems from the ground up, and not starting from the roof! Ability to assure the software we install is not tampered seems like a reasonable very first step. (Sure it could be compromised 5 minutes later, and to protect against this we should have other mechanisms, like e.g. mentioned above ASLR and NX).

And Apple should not blame the vendors for such a situation (“Vendors would never pay $300 for a certificate”, blah, blah), as it is just enough to have a look at the Windows versions of the same products, and that most of them do have signed installers (gee, even open-source TrueCrypt, has a signed installer for Windows!).

One should say that a few vendors, seeing this problem on Mac, do publish PGP signatures for their installation files. This includes e.g. PGP Desktop for Mac, KeePassX, TrueCrypt for Mac, and a few others. But these are just exceptions and I wonder how many users will be disciplined (and savvy) enough to correctly verify those PGP signatures (in general it requires you to download the vendor keys many months before, keep it in your ring, to minimize possibility that somebody alters both the installer files and the keys you download). Some other vendors offer pseudo-integrity by displaying MD5/SHA1 sums on their websites. That would make some sense only if the website on which the hashes are displayed was itself SSL-protected (still the file signature is a better option), as otherwise we can be sure that the attacker that is tampering with the installer file, will also take care about adjusting the hash on the website... But of course this never is the case -- have a look e.g. at the VMWare download page for the Mac Fusion (one need to register first). Very smart, VMWare! (Needles to say, the VMWare Workstation installer for Windows is properly signed).

BTW, anybody checked if the Apple updates are digitally signed somehow?

All I wrote here in this post is just trivial. It should be just obvious for every decently educated software engineer. Believe me it’s really is much more fun for me to write about things like new attacks on chipsets or virtualization. But I have this little hope that maybe somebody at Apple will read this little post and fix their OS. Because I really like Apple products for their aesthetics... \ No newline at end of file diff --git a/_posts/2009-09-22-intel-security-summit-slides.html b/_posts/2009-09-22-intel-security-summit-slides.html deleted file mode 100644 index 214c769..0000000 --- a/_posts/2009-09-22-intel-security-summit-slides.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 'Intel Security Summit: the slides' -date: '2009-09-22T16:55:00.005+02:00' -author: Joanna Rutkowska -tags: -- philosophical -- general -- conferences -modified_time: '2009-10-15T22:02:03.973+02:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/SrjsKTA0I0I/AAAAAAAAAFY/530BI2suM5Y/s72-c/Fotolia_6441375_XS.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-7770784580268995591 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/09/intel-security-summit-slides.html ---- - -Last week I was invited to Hillsboro to speak at the Intel's internal conference on security. My presentation title was "A Quest To The Core: Thoughts on present and future attacks on system core technologies", and my goal was to somehow make a quick summary of the recent research our team has done over the last 12 months or so, and explain why we're so keen on hacking the low-level system components, while all the rest of the world is excited about browser and flash player bugs.

The slides (converted to PDF) can be found here. As you will see, I decided to remove most of the slides from the "Future" chapter. One reason for that was that we didn't want to hint Loic our competition as to some of our new toys we're working on;) The other reason was that, I think, the value of presenting only thoughts about attacks, i.e. unproven thoughts, or, should I even say, feelings about future attacks, has little research value, and while I can understand such information being important to Intel, I don't see how others could benefit from them.

I must say it was nice and interesting to meet in person with various Intel architects, i.e. the people that actually design and create our basic "universe" we all operate in. You can always change the OS (or even write your own!), but still you must stick to the rules, or "laws", of the platform (unless you can break them ;)

\ No newline at end of file diff --git a/_posts/2009-10-16-evil-maid-goes-after-truecrypt.html b/_posts/2009-10-16-evil-maid-goes-after-truecrypt.html deleted file mode 100644 index c26d3c0..0000000 --- a/_posts/2009-10-16-evil-maid-goes-after-truecrypt.html +++ /dev/null @@ -1,18 +0,0 @@ ---- -layout: post -title: Evil Maid goes after TrueCrypt! -date: '2009-10-16T00:30:00.005+02:00' -author: Joanna Rutkowska -tags: -- disk encryption -- attack -- tpm -- trusted computing -- fighting for a better world -modified_time: '2009-11-03T01:02:54.209+01:00' -thumbnail: http://2.bp.blogspot.com/_Ti3q3Hdvels/Stdj6EwsmvI/AAAAAAAAAFg/eVbBLzSlq-E/s72-c/evil+maid.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-1384385046456881063 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html ---- - -From time to time it’s good to take a break from all the ultra-low-level stuff, like e.g. chipset or TXT hacking, and do something simple, yet still important. Recently Alex Tereshkin and I got some spare time and we implemented the Evil Maid Attack against TrueCrypt system disk encryption in a form of a small bootable USB stick image that allows to perform the attack in an easy “plug-and-play” way. The whole infection process takes about 1 minute, and it’s well suited to be used by hotel maids.

The Attack
Let’s quickly recap the Evil Maid Attack. The scenario we consider is when somebody left an encrypted laptop e.g. in a hotel room. Let’s assume the laptop uses full disk encryption like e.g. this provided by TrueCrypt or PGP Whole Disk Encryption.

Many people believe, including some well known security experts, that it is advisable to fully power down your laptop when you use full disk encryption in order to prevent attacks via FireWire/PCMCIA or ”Coldboot” attacks.

So, let’s assume we have a reasonably paranoid user, that uses full disk encryption on his or her laptop, and also powers it down every time they leave it alone in a hotel room, or somewhere else.

Now, this is where our Evil Maid stick comes into play. All the attacker needs to do is to sneak into the user’s hotel room and boot the laptop from the Evil Maid USB Stick. After some 1-2 minutes, the target laptop’s gets infected with Evil Maid Sniffer that will record the disk encryption passphrase when the user enters it next time. As any smart user might have guessed already, this part is ideally suited to be performed by hotel maids, or people pretending to be them.

So, after our victim gets back to the hotel room and powers up his or her laptop, the passphrase will be recorded and e.g. stored somewhere on the disk, or maybe transmitted over the network (not implemented in current version).

Now we can safely steal/confiscate the user’s laptop, as we know how to decrypt it. End of story.

Quick Start
Download the USB image here. In order to “burn” the Evil Maid use the following commands on Linux (you need to be root to do dd):

dd if=evilmaidusb.img of=/dev/sdX

Where /dev/sdX should be replaced with the device representing your USB stick, e.g. /dev/sdb. Please be careful, as choosing a wrong device might result in damaging your hard disk or other media! Also, make sure to use the device representing the whole disk (e.g. /dev/sdb), rather than a disk partition (e.g. /dev/sdb1).

On Windows you would need to get a dd-like program, e.g. this one, and the command would look more or less like this one (depending on the actual dd implementation you use):

dd if=evilmaidusb.img of=\\?\Device\HarddiskX\Partition0 bs=1M

where HarddiskX should be replaced with the actual device the represents your stick.

After preparing the Evil Maid USB stick, you’re ready to test it against some TrueCrypt-encrypted laptop (more technically: a laptop that uses TrueCrypt system disk encryption). Just boot the laptop from the stick, confirm you want to run the tool (press ‘E’) and the TrueCrypt loader on your laptop should be infected.

Now, Evil Maid will be logging the passphrases provided during the boot time. To retrieve the recorded passphrase just boot again from the Evil Maid USB -- it should detect that the target is already infected and display the sniffed password.

The current implementation of Evil Maid always stores the last passphrase entered, assuming this is the correct one, in case the user entered the passphrase incorrectly at earlier attempts.

NOTE: It’s probably illegal to use Evil Maid to obtain password from other people without their consent. You should always obtain permission from other people before testing Evil Maid against their laptops!

CAUTION: The provided USB image and source code should be considered proof-of-concept only. Use this code at your own risk, and never run it against a production system. Invisible Things Lab cannot be held responsible for any potential damages this code or its derivates might cause.

How the Evil Maid USB works
The provided implementation is extremely simple. It first reads the first 63 sectors of the primary disk (/dev/sda) and checks (looking at the first sector) if the code there looks like a valid TrueCrypt loader. If it does, the rest of the code is unpacked (using gzip) and hooked. Evil Maid hooks the TC’s function that asks user for the passphrase, so that the hook records whatever passphrase is provided to this function. We also take care about adjusting some fields in the MBR, like the boot loader size and its checksum. After the hooking is done, the loader is packed again and written back to the disk.

You can get the source code for the Evil Maid infector here.

Possible Workarounds
So, how should we protect against such Evil Maid attacks? There are a few approaches...

1. Protect your laptop when you leave it alone
Several months ago I had a discussion with one of the TrueCrypt developers about possible means of preventing the Evil Maid Attack, perhaps using TPM (see below). Our dialog went like this (reproduced here with permission from the TrueCrypt developer):

TrueCrypt Developer: We generally disregard "janitor" attacks since they inherently make the machine untrusted. We never consider the feasibility of hardware attacks; we simply have to assume the worst. After an attacker has "worked" with your hardware, you have to stop using it for sensitive data. It is impossible for TPM to prevent hardware attacks (for example, using hardware key loggers, which are readily available to average Joe users in computer shops, etc.)

Joanna Rutkowska: And how can you determine that the attacker have or have not "worked" with your hardware? Do you carry your laptop with you all the time?

TrueCrypt Developer: Given the scope of our product, how the user ensures physical security is not our problem. Anyway, to answer your question (as a side note), you could use e.g. a proper safety case with a proper lock (or, when you cannot have it with you, store it in a good strongbox).

Joanna Rutkowska: If I could arrange for a proper lock or an impenetrable strongbox, then why in the world should I need encryption?

TrueCrypt Developer: Your question was: "And how can you determine that the attacker has or has not worked with your hardware?" My answer was a good safety case or strongbox with a good lock. If you use it, then you will notice that the attacker has accessed your notebook inside (as the case or strongbox will be damaged and it cannot be replaced because you had the correct key with you). If the safety case or strongbox can be opened without getting damaged & unusable, then it's not a good safety case or strongbox. ;-)

That's a fair point, but this means that for the security of our data we must relay on the infeasibility to open our strongbox lock in a "clean" way, i.e. without visually damaging it. Plus it means we need to carry a good strongbox with us to any travel we go. I think we need a better solution...

Note that TrueCrypt authors do mention the possibility of physical attacks in the documentation:
If an attacker can physically access the computer hardware and you use it after the attacker has physically accessed it, then TrueCrypt may become unable to secure data on the computer. This is because the attacker may modify the hardware or attach a malicious hardware component to it (such as a hardware keystroke logger) that will capture the password or encryption key (e.g. when you mount a TrueCrypt volume) or otherwise compromise the security of the computer.
However, they do not explicitly warn users of a possibility of something as simple and cheap as the Evil Maid Attack. Sure, they write "or otherwise compromise the security of the computer", which does indeed cover e.g. the Evil Maid Attack, but my bet is that very few users would realize what it really means. The examples of physical attacks given in the documentation, e.g. modifying the hardware or attaching a malicious hardware, is something that most users would disregard as too expensive an attack to be afraid of. But note that our Evil Maid attack is an example of a “physical” attack, that doesn’t require any hardware modification and is extremely cheap.

Of course it is a valid point, that if we allow a possibility of a physical attack, then the attacker can e.g. install a hardware keylogger. But doing that is really not so easy as we discuss in the next paragraph. On the other hand, spending two minutes to boot the machine from an Evil Maid USB stick is just trivial and is very cheap (the price of the USB stick, plus the tip for the maid).

2. The Trusted Computing Approach
As explained a few months ago on this blog, a reasonably good solution against Evil Maid attack seems to be to take advantage of either static or dynamic root of trust offered by TPM. The first approach (SRTM) is what has been implemented in Vista Bitlocker. However Bitlocker doesn’t try to authenticate to the user (e.g. via displaying a custom picture shot by the user, with the picture decrypted using a key unsealed from a TPM), so it’s still possible to create a similar attack against Bitlocker, but with a bit different user experience. Namely the Evil Maid for Bitlocker would have to display a fake Bitlocker prompt (that could be identical to the real Bitlocker prompt), but after obtaining a correct password from the user Evil Maid would not be able to pass the execution to the real Bitlocker code, as the SRTM chain will be broken. Instead, Evil Maid would have to pretend that the password was wrong, uninstall itself, and then reboot the platform. Thus, a Bitlocker user that is confident that he or she entered the correct password, but the OS didn’t boot correctly, should destroy the laptop.

The dynamic root of trust approach (DRTM) is possible thanks to Intel TXT technology, but currently there is no full disk encryption software that would make use of it. One can try to implement it using Intel’s tboot and some Linux disk encryption, e.g. LUKS.

Please also note that even if we assume somebody “cracked” the TPM chip (e.g. using an electron microscope, or NSA backdoor), that doesn’t mean this person can automatically get access to the encrypted disk contents. This is not the case, as the TPM is used only for ensuring trusted boot. After cracking the TPM, the attacker would still have to mount an Evil Maid attack in order to obtain the passphrase or key. Without TPM this attack is always possible.

Are those trusted computing-based approaches 100% foolproof? Of course not. As signalized in the previous paragraph, if an attacker was able to mount a hardware-based keylogger into your laptop (which is non-trivial, but possible), then the attacker would be able to capture your passphrase regardless of the trusted boot. A user can prevent such an attack by using two-factor authentication (RSA challenge-response implemented in a USB token) or e.g. one-time passwords, so that there is no benefit for the attacker to capture the keystrokes. But the attacker might go to the extreme and e.g. replace the DRAM, or even the CPU with malicious DRAM or CPU that would sniff and store the decryption key for later access. We’re talking here about attack that very few entities can probably afford (think NSA), but nevertheless they are theoretically possible. (Note that an attack with inserting a malicious PCI device that would try to sniff the key using DMA can be prevented using TXT+VT-d technology).

However, just because the NSA can theoretically replace your CPU with a malicious one, doesn’t mean TPM-based solutions are useless. As for the great majority of other people that do not happen to be on the Terrorist Top 10, these represent a reasonable solution that could prevent Evil Maid attacks, and, when combined with a proper two-factor authentication, also simple hardware based attacks, e.g. keylogger, cameras, remote keystroke sniffing using laser, etc. I really cannot think of a more reasonable solution here.

3. The Poor Man’s Solution
Personally I would love to see TrueCrypt implementing TPM-based trusted boot for its loader, but, well, what can I do? Keep bothering TrueCrypt developers with Evil Maid attacks and hope they will eventually consider implementing TPM support...

So, in the meantime we have come up with a temporary poor man’s solution that we use at our lab. We call it Disk Hasher. It’s a bootable Linux-based USB stick that can be configured in quite a flexible way to calculate hashes of selected disk sectors and partitions. The correct hashes are stored also on the stick (of course everything is encrypted with a custom laptop-specific passphrase). We use this stick to verify the unencrypted portions of our laptops (typically the first 63 sectors of sda, and also the whole /boot partition in case of Linux-based laptops where we use LUKS/dm-crypt).

Of course there are many problems with such a solution. E.g. somebody who can get access to my Disk Hasher USB (e.g. when I’m in a swimming pool), can infect it in such a way that it would report correct hashes, even though the disk of my laptop would be “evilmaided”...

Another problem with Disk Hasher solution is that it only looks at the disk, but cannot validate e.g. the BIOS. So if the attacker found a way to bypass the BIOS reflashing protection on my laptop, then he or she can install a rootkit there that would sniff my passphrase or the decryption key (in case I used one time passwords).

Nevertheless, our Disk Hasher stick seems like a reasonable solution and we use it often internally at ITL to validate our laptops. In fact this is the most we can do, if we want to use TrueCrypt, PGP WDE, or LUKS/dm-crypt.

FAQ

Q: Is this Evil Maid Attack some l33t new h4ck?
Nope, the concept behind the Evil Maid Attack is neither new, nor l33t in any way.

Q: So, why did you write it?
Because we believe it demonstrates an important problem, and we would like more attention to be paid in the industry to solving it.

Q: I’m using two-factor authentication, am I protected against EM?
While a two-factor authentication or one time passwords are generally a good idea (e.g. they can prevent various keylogger attacks), they alone do not provide protection from Evil Maid-like attacks, because the attacker might modify his or her sniffer to look for the final decryption key (that would be calculated after the 2-factor authentication completes).

Q: How is Evil Maid different from Stoned-Bootkit?
The Stoned Bootkit, released a few months ago by an individual describing himself as “Software Dev. Guru in Vienna”, is also claimed to be capable of "bypassing TrueCrypt", which we take to mean a capability to sniff TC's passphrases or keys. Still, the biggest difference between Stoned Bootkit and Evil Maid USB is that in case of our attack you don’t need to start the victim's OS in order to install Evil Maid, all you need to do is to boot from a USB stick, wait about 1 minute for the minimal Linux to start, and then press ‘E’, wait some 2 more seconds, and you’re done. With the Stoned Bootkit, according to the author’s description, you need to get admin access to the target OS in order to install it, so you either need to know the Windows admin password first, or use some exploit to get the installer executing on the target OS. Alternatively, you can install it from a bootable Windows CD, but this, according to the author, works only against unencrypted volumes, so no use in case of TrueCrypt compromise.

Q: I've disabled boot from USB in BIOS and my BIOS is password protected, am I protected against EM?
No. Taking out your HDD, hooking it up to a USB enclosure case and later installing it back to your laptop increases the attack time by some 5-15 minutes at most. A maid has to carry her own laptop to do this though.

Q: What about using a HDD with built-in hardware-based encryption?
We haven’t tested such encryption systems, so we don’t know. There are many open questions here: how is the passphrase obtained from the user? Using software stored on the disk or in the BIOS? If on the disk, is this portion of disk made read-only? If so, does it mean it is non-updatable? Even if it is truly read-only, if the attacker can reflash the BIOS, then he or she can install a passphrase sniffer there in the BIOS. Of course that would make the attack non-trivial and much more expensive than the original Evil Maid USB we presented here.

Q: Which TrueCrypt versions are supported by the current Evil Maid USB?
We have tested our Evil Maid USB against TrueCrypt versions 6.0a - 6.2a (the latest version currently available). Of course, if the “shape” of the TrueCrypt loader changed dramatically in the future, then Evil Maid USB would require updating.

Q: Why did you choose TrueCrypt and not some other product?
Because we believe TrueCrypt is a great product, we use it often in our lab, and we would love to see it getting some better protection against such attacks.

Q: Why there is no TPM support in TrueCrypt?
The TrueCrypt Foundation published official generalized response to TPM-related feature requests here.

Acknowledgments
Thanks to the ennead@truecrypt.org for all the polemics we had which allowed me to better gather my thoughts on the topic. The same thanks to Alex and Rafal, for all the polemics I have had with them (it's customary for ITL to spend a lot of time finding bugs in each other's reasoning). \ No newline at end of file diff --git a/_posts/2009-12-21-another-txt-attack.html b/_posts/2009-12-21-another-txt-attack.html deleted file mode 100644 index e712b5c..0000000 --- a/_posts/2009-12-21-another-txt-attack.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Another TXT Attack -date: '2009-12-21T19:11:00.005+01:00' -author: Joanna Rutkowska -tags: -- attack -- trusted execution technology -- trusted computing -- exploit -modified_time: '2010-01-16T12:25:46.578+01:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/Sy-7Sx0fLlI/AAAAAAAAAGA/MvXTpW6ZTTQ/s72-c/broken+chain.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-7396711639241642204 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2009/12/another-txt-attack.html ---- - -Earlier this year our team has presented an attack against Intel TXT that exploited a design problem with SMM mode being over privileged on PC platforms and able to interfere with the SENTER instruction. The Intel response was two-fold: to patch the SMM implementation bugs we used for the attack (this patch was for both the NVACPI SMM attacks, as well as for the SMM caching attack), and also to start (intensify?) working on STM specification, that is, we heard, planned to be published sometime in the near future. STM is a thin hypervisor concept that is supposed to provide protection against (potentially) malicious SMMs.

Today we present a totally different attack that allows an attacker to trick the SENTER instruction into misconfiguring the VT-d engine, so that it doesn’t protect the newly loaded hypervisor or kernel. This attack exploits an implementation flaw in a SINIT AC module. This new attack also allows for full TXT circumvention, using a software-only attack. This attack doesn't require any SMM bugs to succeed and is totally independent from the previous one.

The press release is here.

The full paper is here.

The advisory published by Intel today can be found here.

Enjoy. \ No newline at end of file diff --git a/_posts/2010-01-16-priorities.html b/_posts/2010-01-16-priorities.html deleted file mode 100644 index cb73e46..0000000 --- a/_posts/2010-01-16-priorities.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Priorities -date: '2010-01-16T12:25:00.004+01:00' -author: Joanna Rutkowska -tags: -- general -- fighting for a better world -modified_time: '2010-01-19T12:00:41.155+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4462141036719440454 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/01/priorities.html ---- - -It’s interesting how many people don’t realize what are the priorities in computer security... There are many fields to secure: server security, web applications security, network security, and finally desktop security. Over the last years I met SO many people that always expressed surprise why I would like to focus on desktop systems security? They usually argue that today, as everybody knows, it is the Network that is what computing is all about and that we should focus on securing infrastructure, and forget about the desktops, which are always to be insecure. The network is the computer, as somebody said.

What those people forget about, is that it is always the desktop that ultimately gets access to all the user’s secretes -- all the passwords, all the keys, all the corporate documents, all the nude holiday pictures, all the secret love letters, all the credit card numbers, and many more.

However secure were all the services (remote servers and network protocols) that we use, if our desktop gets compromised it’s all lost. The recent incident with Google is just yet another example of that. Our desktop systems are the most crucial piece of the whole puzzle.

It’s funny how many people think that by using some thin client solution on their desktops they can solve the problem. Of course they cannot! Just the fact that your OS executes on a server, rather then on your hardware, doesn’t make it any less prone to all the attacks that were otherwise possible when the software executed on your system.

The attempts to secure desktops have been failing for so many years. While recently there is some attempt to minimize likelihood of remote attacks via Web browsers (or generally to focus on application security), this is still just the tip of the iceberg -- there are so many other attack avenue that none of the popular OSes even tries to address, that I consider myself a brave person (not to say stupid) that I actually use my laptop everyday and keep some sensitive information on it ;)

Ok, so that’s a nice piece of complaining you say, but what are we, at ITL, gonna do about it? Well, we just gonna sit and patiently wait for better OSes to appear some day... Oh, hell, we won’t!

Happy New Year :)

<please ignore>
9933 F096 8820 0E23 1AF4 078D 8BDB D97D BDEA 9E9D
</>
 \ No newline at end of file diff --git a/_posts/2010-04-07-introducing-qubes-os.html b/_posts/2010-04-07-introducing-qubes-os.html deleted file mode 100644 index 8592242..0000000 --- a/_posts/2010-04-07-introducing-qubes-os.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Introducing Qubes OS -date: '2010-04-07T12:58:00.008+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2010-04-07T18:26:47.527+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2192095913677180808 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/04/introducing-qubes-os.html ---- - -For the last 6 months we have been busy with a new project: Qubes. Qubes is an open source OS based on Xen, X, and Linux, designed to provide strong isolation for desktop computing. The link to the project website is at the end of the post.

The system is currently in the alpha stage, but if you're determined it's actually usable. For example I have switched to Qubes around a month ago, and two weeks ago I even decided to wipe and reinstall my Mac Book, which used to be my primary laptop previously. Now I use my old Mac Book only for making the slides (Apple Keynote really has no competition) and Web page for Qubes :) And I use Qubes for pretty much all the other daily tasks, from work, shopping, banking, random browsing, to Qubes development itself (it takes part in the "qubes" AppVM).

Just remember to make backups regularly if you decided to use Qubes for anything else than testing and development.

So, enough of introduction, you will find lots of details (including a 40-page PDF describing the system architecture) at the Qubes project website. Enjoy!

Update 7-Apr-2010 15:56 CEST: The server seems to be overloaded a bit by the traffic... If you are planning to install the OS, I guess it would be wise to postpone downloading the installation packages until later this week, when the first wave of visitors goes away.

Update 7-Apr-2010 16:31 CEST: The Wiki doesn't work due to lack of free memory... Talking to my provider about buying some more RAM. Sorry for the inconvenience.

Update 7-Apr-2010 18:28 CEST: The server has been brought offline for RAM upgrade. Should be back online in some 15 minutes...

http://qubes-os.org

\ No newline at end of file diff --git a/_posts/2010-04-30-remotely-attacking-network-cards-or-why.html b/_posts/2010-04-30-remotely-attacking-network-cards-or-why.html deleted file mode 100644 index ccfc329..0000000 --- a/_posts/2010-04-30-remotely-attacking-network-cards-or-why.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Remotely Attacking Network Cards (or why we do need VT-d and TXT) -date: '2010-04-30T14:03:00.005+02:00' -author: Joanna Rutkowska -tags: -- attack -- tpm -- trusted execution technology -- trusted computing -- fighting for a better world -modified_time: '2010-05-13T14:26:11.485+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2572700386184621224 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/04/remotely-attacking-network-cards-or-why.html ---- - -I've finally found some time to study Loic Duflot's and Yves-Alexis Perez's recent presentation from the last month on remotely attacking network cards. You can get the slides here.

In short, they're exploiting a buffer overflow in the network card's firmware by sending malicious packets to the card, and then they gain full control over the card's firmware, so they can e.g. issue DMA to/from the host memory, effectively fully controlling the host (that's another example of "Ring -3 rootkit" I would say). The buffer overflow is in some exotic management protocol (that I think is disabled by default, but that's irrelevant) implemented by the NIC's firmware (the NIC has its own RISC processor, and memory, and stack, which they overflow, etc.).

I like this research very much, because it demonstrates several important things:

First, it shows that it is definitely a good idea to isolate/sandbox all the OS networking code using IOMMU/VT-d. And this is exactly what we do in Qubes.

Second, the attack provides a real-world example of why Static Root for Trust Measurement (SRTM) is inferior to Dynamic RTM (DRTM), e.g. Intel TXT. To understand why, let's make the following assumptions:
1) The OS/VMM properly uses IOMMU to isolate the network card(s), just like e.g. Qubes does.
2) Once the attacker got control over the NIC firmware, the attacker can also modify the persistent storage (EEPROM) where this firmware is kept. This has been confirmed by Loic in a private email exchange.
3) The system implements trusted boot via SRTM, i.e. using just BIOS and TPM, without Intel TXT.

Now, the attacker can modify the firmware in the EEPROM and this will allow the attacker to survive the platform reboot. The card's firmware will start executing early in the boot process, definitely before the OS/VMM gets loaded. Now, the compromised NIC, because it is capable of doing DMA to the host memory, can compromise the image of the VMM in a short time window between the time it got measured and loaded by the (trusted) OS loader, e.g. Trusted GRUB, but still before the time VMM had a chance to setup proper IOMMU/VT-d protections for itself.

Of course, in practice, it might be tricky for the compromised NIC firmware to precisely know this time window when it should send a compromising DMA write request. If the DMA was issued too early, then the trusted OS loader would calculate a wrong hash and put a wrong value into a PCR register, which would later prevent the system from completing the boot, and prevent the attack. If the DMA was issued too late, the IOMMU/VT-d protections would already be in-place, and the attack would again be unsuccessful. But, hey, much harder obstacles have been worked around by smart exploit writes in the past, so don't comfort yourself that the attack is hard. If it's possible, it means this technology is flawed, period.

And this is where DRTM, AKA Intel TXT, shows its advantage over simple SRTM. When you load a hypervisor using TXT, the SENTER instruction would first apply the VT-d protections around the hypervsior image, then do the measurements, and only then load it, with VT-d protections still in-place.

The above is the theory. A few months ago we demonstrated an attack against this scheme, but the attack was exploiting a flaw in the TXT implementation, not in its design, so it didn't render TXT useless as a technology.

A much bigger problem with Intel TXT is, that Intel still has done nothing to prevent SMM-based attacks against TXT. This is what we demonstrated about 1.5 years(!) ago. Our research stressed that TXT without protection from SMM is essentially useless. Intel then promised to come up with a spec on how to write an STM, and how TXT should work with STM (when to measure/load it, etc), but nothing has been released by Intel for all this time AFAIK...

Now, without STM (which is supposed to provide protection from potentially compromised SMM), the TXT cannot really prevent Loic and friends from owning the system, even if it uses such a securely designed OS as Qubes. This is because Loic would be able to modify e.g. the MBR while the system boots (thanks to DMA ability of the infected NIC firmware), and then attack an SMM from this MBR (I can bet lots of money Loic & co. would easily find a few other SMM exploits in any recent BIOS if they only wanted to), and then having infected the SMM, they will be able to compromise TXT-loaded hypervisor, and finally compromise the whole system.

I know there are some people from various governments reading this blog. If you really want to have secure systems, consider pushing on Intel to finally do something about the SMM-based attacks against TXT. Beware, Intel will try to tell you that, using TXT LCP you can seal your secrets to only "trusted" SMM images and would try to convince you it's a way to prevent SMM attacks on TXT. It is not. Only true SMM sandboxing is a proper way to address this problem.

Anyway, congrats to Loic and colleagues for yet another very interesting and meaningful system-level research! \ No newline at end of file diff --git a/_posts/2010-05-01-evolution.html b/_posts/2010-05-01-evolution.html deleted file mode 100644 index cf77a7b..0000000 --- a/_posts/2010-05-01-evolution.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Evolution -date: '2010-05-01T15:45:00.005+02:00' -author: Joanna Rutkowska -tags: -- company news -modified_time: '2010-05-13T14:26:25.690+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4492075276448270781 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/05/evolution.html ---- - -If you have been following my research over the last several years (even in the days before ITL), you will undoubtedly notice how much I have changed the profile over that time...

Several years ago, myself and Alex Tereshkin (who later became ITL employee #1), were known mostly as rootkit researchers. It was back in the days when the word "rootkit" was not as much well known as it is today (It became well known sometime in the late 2005, and I remember when I was applying for a US Visa that year, the immigration officer in the Warsaw embassy asked me what I did professionally and when I replied that I was a security researcher specializing in rootkits, he was very happy to tell me that he just read about those "rootkits" somewhere, although he was not very much worried about them, because he was a Mac user...)

But then, in the coming years, we decided to explore other areas, like virtualization, trusted computing, chipset security, and even touched on the CPU security briefly. Many valuable contributions in those areas have come from Rafal Wojtczuk, who joined our team some two years ago.

And then, finally, we became ready to actually build something meaningful. Not just yet another nonsense trivial-to-break "security product", but something that have had a potential to really improve user's security. And so, the Qubes project idea has been born, and soon it became ITL's highest priority project.

So, these days we don't do any reverse engineering or malware analysis any more. We'd rather design systems so they be immune to rootkits by design (e.g. by significant TCB reduction), rather then analyze each and every new rootkit sample caught in the wild and try to come up with a detector for it.

Of course, this all doesn't mean we're giving up on our offensive research. There is still a chance you will hear about some new attacks from us. But this would surely be limited only to the attacks that we consider relevant in an environment that is already designed with security in mind, like Qubes :) So, e.g. an attack against VT-d, or some CPU exploit, or a Xen exploit, might be extremely interesting. But don't expect to see any research on how to e.g. compromise Windows 7 or Mac kernel or break out of their primitive sandboxes -- these systems are so badly designed from a security standpoint, that coming up with a yet-another attack against them makes little sense from a scientific point of view.

Naturally, I'm all excited about this all: that I've been exploring new areas, and that my work has eventually started becoming meaningful. But that is, of course, only mine subjective opinion. Specifically, this turned out not be the case for Alex, who simply enjoys reverse engineering and compiler hacking just for the sake of doing it (Alex did some excellent job on metamorphic code generators, that are years ahead of what you can read at public conferences). Unfortunately, with the current new course we took at ITL, Alex started getting less and less chances to apply his skills, and faced a decision whether to stay at ITL and do other things, i.e. other than reversing or compiler hacking, or to quit and continue doing what he has always liked to do.

The reader has probably figured out by now that Alex decided to quit ITL. I fully understand his decision and wish him all the best in his new adventures!

You should still be able to reach Alex using his old ITL's email address (alex@), or directly via his new email: alex.tereshkin at gmail.com. \ No newline at end of file diff --git a/_posts/2010-05-03-on-formally-verified-microkernels-and.html b/_posts/2010-05-03-on-formally-verified-microkernels-and.html deleted file mode 100644 index 8a0598e..0000000 --- a/_posts/2010-05-03-on-formally-verified-microkernels-and.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: On Formally Verified Microkernels (and on attacking them) -date: '2010-05-03T16:11:00.005+02:00' -author: Joanna Rutkowska -tags: -- formal verification -- attack -- trusted computing -- philosophical -modified_time: '2010-06-02T00:16:33.712+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3538836128867543324 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/05/on-formally-verified-microkernels-and.html ---- - -Update May 14th, 2010: Gerwin Klein, a project lead for L4.verified, has posted some insightful comments. Also it's worth reading their website here that clearly explains what assumptions they make, and what they really prove, and what they don't.

You must have heard about it before: formally verified microkernels that offer 100% security... Why don't we use such a microkernel in Qubes then? (The difference between a micro-kernel and a type I hypervisor is blurry. Especially in case of a type I hypervisor used for running para-virtualized VMs, such as Xen used in Qubes. So I would call Xen a micro-kernel in this case, although it can also run fully-virtualized VMs, in which case it should be called a hypervisor I think.)

In order to formally prove some property of any piece of code, you need to first assume certain things. One such thing is the correctness of a compiler, so that you can be sure that all the properties you proved for the source code, still hold true for the binary generated from this source code. But let's say it's a feasible assumption -- we do have mature compilers indeed.

Another important assumption you need, and this is especially important in proving kernels/microkernels/hypervisors, is the model of the hardware your kernel interacts with. Not necessarily all the hardware, but at least the CPU (e.g. MMU, mode transitions, etc) and the Chipset.

While the CPUs are rather well understood today, and their architecture (we're talking IA32 here) doesn't change so dramatically from season to season. The chipsets, however, are a whole different story. If you take a spec for any modern chipset, let's say only the MCH part, the one closer to the processor (on Core i5/i7 even integrated on the same die), there are virtually hundreds of configuration registers there. Those registers are used for all sorts of different purposes -- they configure DRAM parameters, PCIe bridges, various system memory map characteristics (e.g. the memory reclaiming feature), access to the infamous SMM memory, and finally VT-d and TXT configuration.

So, how are all those details modeled in microkernels formal verification process? Well, as far as I'm aware, they are not! They are simply ignored. The nice way of saying this in academic papers is to say that "we trust the hardware". This, however, might be incorrectly understood by readers to mean "we don't consider physical attacks". But this is not equal! And I will give a practical example in a moment.

I can bet that even the chipset manufactures (think e.g. Intel) do not have formal models for their chipsets (again, I will give a good example to support this thesis below).

But why are the chipsets so important? Perhaps they are configured "safe by default" on power on, so even if we don't model all the configuration registers, and their effects on the system, and if we won't be playing with them, maybe it's safe to assume all will be fine then?

Well, it might be that way, if we could have secure microkernels without IOMMU/VT-d and without some trusted boot mechanism.

But we need IOMMU. Without IOMMU there is no security benefit of having a microkernel vs. having a good-old monolithic kernel. Let me repeat this statement again: there is no point in building a microkernel-based system, if we don't correctly use IOMMU to sandbox all the drivers.

Now, setting up IOMMU/VT-d permissions require programming the chipset's registers, and is by no means a trivial task (see the the Intel VT-d spec to get an impression, if you don't believe me). Correctly setting up IOMMU is one of the most security-critical tasks to be done by a hypervisor/microkernel, and so it would be logical to expect that they also formally prove that this part is done flawlessly...

The next thing is the trusted boot. I will argue that without proper trusted boot implementation, the system cannot be made secure. And I'm not talking about physical attacks, like Evil Maid. I'm talking about true, remote, software attacks. If you haven't read it already, please go back and read my very recent post on "Remotely Attacking Network Cards". Building on Loic's and Yves-Alexis' recent research, I describe there a scenario how we could take their attack further to compromise even such a securely designed system as Qubes. And this could be possible, because of a flaw in TXT implementation. And, indeed, we demonstrated an attack on Intel Trusted Execution Technology that exploits one such flaw before.

Let's quickly sketch the whole attack in points:

  1. The attacker attacks a flaw in the network card processing code (Loic and Yves-Alexis)

  2. The attacker replaces the NIC's firmware in EEPROM to survive the reboot (Loic and Yves-Alexis)

  3. The new firmware attacks the system trusted boot via a flaw in Intel TXT (ITL)

    • If the system uses SRTM instead, it's even easier -- see the previous post (ITL)

    • If you have new SINIT module that patched our attack, there is still an avenue to attack TXT via SMM (ITL)

  4. The microkernel/hypervisor gets compromised with a rootkit and the attacker gets full control over the system:o

And this is the practical example I mentioned above. I'm sure readers understand that this is just one example, of what could go wrong on the hardware level (and be reachable to a software-only attacker). Don't ignore hardware security! Even for software attacks!

A good question to ask is: would a system with a formally verified microkernel also be vulnerable to such an attack? And the answer is yes! Yes, unless we could model and prove correctness of the whole chipset and the CPU. But nobody can do that today, because it is impossible to build such a model. If it was, I'm pretty sure Intel would already have such a model and they would not release an SINIT module with this stupid implementation bug we found and exploited in our attack.

So, we see an example of a practical attack that could be used to fully compromise a well designed system, even if it had a formally verified microkernel/hypervisor. Compromise it remotely, over the network!

So, are all those whole microkernel/hypervisor formal verification attempts just a waste of time? Are they only good for academics so that they could write more papers for conferences? Or for some companies to use them in marketing?

Perhaps the formal verification of system software will never be able to catch up with the pace of hardware development... By the time people will learn how to build models (and how to solve them) for hardware used today, the hardware manufactures, in the meantime, will present a few new generations of the hardware. For which the academics will need another 5 years to catch up, and so on.

Perhaps the industry will take a different approach. Perhaps in the coming years we will get hardware that would allow us to create untrusted hypervisors/kernels that would not be able to read/write usermode pages (Hey Howard;)? This is currently not possible with the hardware we have, but, hey, why would a hypervisor need access to the Firefox pages?

And how this all will affect Qubes? Well, the Qubes project is not about building a hypervisor or a microkernel. Qubes is about how to take a secure hypervisor/microkernel, and how to build the rest of the system in a secure, and easy to use, way, using the isolation properties that this hypervisor/microkernel is expected to provide. So, whatever kernels we will have in the future (better formally verified, e.g. including the hardware in the model), or based on some exciting new hardware features, still Qubes architecture would make perfect sense, I think. \ No newline at end of file diff --git a/_posts/2010-06-01-disposable-vms.html b/_posts/2010-06-01-disposable-vms.html deleted file mode 100644 index 566f537..0000000 --- a/_posts/2010-06-01-disposable-vms.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Disposable VMs -date: '2010-06-01T23:41:00.004+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2010-06-18T15:41:16.836+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7974469624652215569 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/06/disposable-vms.html ---- - -While we're still busy with some last few tickets left for Qubes Alpha 2 milestone, Rafal has already started working on a new feature for Qubes Beta 1: on Disposable VMs. I think this is really gonna be a killer feature, and I wanted to say a few words about it.

Disposable VMs will be very lightweight VMs that can be created and booted in a very short time, say < 1s, with a sole purpose of hosting only one application, e.g. a PDF viewer, or a Media Player.

To understand why Disposable VMs are important, imagine the following situation -- you receive an email from a customer that contains a PDF attachment, say an invoice or a contract. Obviously you're opening and reading the message in an email client running in your "work" AppVM (or "work-email" AppVM, if you're paranoid), just because it is a work-related correspondence, arriving at your professional email address (for many reasons it is good to use different email addresses for job-related activities and for personal life).

However, chances of somebody compromising your email client by just sending you a maliciously crafted message that would exploit your body or subject parsers are very small, if you have disabled full HTML parser for message bodies (which I think most security-concious people do anyway). Perhaps a more effective attack vector would be for somebody to 0wn your email server first, and then try to exploit IMAP/POP/SMTP protocol parser in your email client. But hey, in that case, they already would get access to all your emails on the corporate server, without exploiting your email client (well, they could however gain access to your PGP keys this way -- if this bothers you, you might want to use smartcards for PGP keys). There is also a possibility to do a Man-In-The-Middle attack and try to exploit SSL protocol early parsers, but this could be prevented using a separate VPN AppVM in Qubes.

But now you would like to open this PDF that a customer just sent you. It's quite reasonable to be afraid that the PDF might be malicious and might try to exploit your PDF viewer, and then try to steal your emails or other things you keep in the "work" AppVM (or "work-email" AppVM). It doesn't matter if you trust the sender, as the sender's OS might very well be compromised by some malware and might be infecting all outgoing PDFs without the user consent.

You could try opening the PDF in one of your non-sensitive VMs, e.g. the "random" VM that you use for causal Web browsing, to make sure that even if the PDF is malicious, that it won't get access to any sensitive data. But what if the PDF is not malicious, and what if it contains some confidential data? In that case you might throw the baby out with the bath water (your "random" VM might have been already compromised and now it would be able to steal the secrets from your PDF file).

A disposable VM is an ideal solution here. You create a clean, disposable VM, just for the purpose of viewing the PDF. Then, once you're done, you just throw it away. If the PDF was malicious it could done harm only to its own disposable VM, that doesn't contain anything except... this very PDF. At the same time, the disposable VM is always started in a clean state, so there is no way somebody could steal the document. Only the document can steal itself :)

That all sounds easy, but to make it practical we need a very efficient implementation of disposable VMs, and a good system integration, so the experience was seamless to the user. E.g. the user should only be required to right-click on a file and choose "Open in a Disposable VM", and Qubes should take care about everything else: creating the VM, starting it, copying the file to the VM, and starting a MIME-associated application for this type of file (e.g. PDF) in the VM. And this all in time below 1s!

Basic support for Disposable VMs is planned for Beta 1, which is scheduled sometime at the end of the summer holidays. But I can tell that's just the beginning. The ultimate goal, from the user's point of view, would be to make Qubes OS to look and behave just like a regular mainstream OS like Linux, or Windows, or even Mac, but still with all the strong security that Qubes architecture provides, deployed behind the scene. Seamless support for Disposable VM is one of the first steps to achieve this goal.

Special credits go to Matt Piotrowski, who just left Berkeley University, and whose recently published thesis was a direct inspiration to implement disposable VMs in Qubes. While we did mention "one-time" VMs in our architecture document back in January (see chapter 4.6), it really was Matt's paper that convinced me we should really have them in Qubes. Virtics, a proof-of-concept implementation written by Matt, shares lots of similarities with Qubes, like e.g. architecture and implementation of the GUI virtualiztion. There are also differences though, and I refer readers to the Matt's paper for more details. \ No newline at end of file diff --git a/_posts/2010-07-01-qubes-alpha-2-released.html b/_posts/2010-07-01-qubes-alpha-2-released.html deleted file mode 100644 index fdcc091..0000000 --- a/_posts/2010-07-01-qubes-alpha-2-released.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes Alpha 2 released! -date: '2010-07-01T16:16:00.004+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2010-07-09T18:20:27.132+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3468198659527144871 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/07/qubes-alpha-2-released.html ---- - -The Alpha 2 is out!
New screenshots are here :) \ No newline at end of file diff --git a/_posts/2010-08-17-skeletons-hidden-in-linux-closet.html b/_posts/2010-08-17-skeletons-hidden-in-linux-closet.html deleted file mode 100644 index 8ebfb9c..0000000 --- a/_posts/2010-08-17-skeletons-hidden-in-linux-closet.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: 'Skeletons Hidden in the Linux Closet: r00ting your Linux Desktop for Fun and - Profit' -date: '2010-08-17T17:18:00.005+02:00' -author: Joanna Rutkowska -tags: -- attack -modified_time: '2010-09-02T10:37:50.107+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2413818648032561083 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/08/skeletons-hidden-in-linux-closet.html ---- - -A couple of months ago, while working on Qubes GUI virtualization, Rafal has come up with an interesting privilege escalation attack on Linux (a user-to-root escalation), that exploits a bug in... well, actually it doesn't exploit any concrete bug, which makes it so much more interesting.

The attack allows a (unpriviliged) user process that has access to the X server (so, any GUI application) to unconditionally escalate to root (but again, it doesn't take advantage of any bug in the X server!). In other words: any GUI application (think e.g. sandboxed PDF viewer), if compromised (e.g. via malicious PDF document) can bypass all the Linux fancy security mechanisms, and escalate to root, and compromise the whole system. The attack allows even to escape from the SELinux's "sandbox -X" jail. To make it worse, the attack has been possible for at least several years, most likely since the introduction of kernel 2.6.

You can find the details of the attack, as well as the discussion of possible solutions, including the one that has eventually been implemented, in the Rafal's paper.

One important aspect the attack demonstrates, is how difficult it is to bring security to a desktop platform, where one of the biggest challenges is to let applications talk to the GUI layer (e.g. X server in case of Linux), which usually involves a very fat GUI protocol (think X protocol, or Win32 GUI API) and a very complex GUI server, but at the same time keep things secure. This was one of the key priories for us when designing Qubes OS architecture. (So, we believe Qubes is much more secure than other sandboxing mechanisms, such as BSD jails, or SELinux-based sandboxes, because it not only eliminates kernel-level exploits, but also dramatically slims down GUI-level attacks).

The kernel-level "patch" has been implemented last week by Linus Torvalds, and pushed upstream into recent stable kernels. RedHat has also released an advisory for this attack, where they rated its severity as "high".

ps. Congrats to Brad Spengler for some good guessing :) \ No newline at end of file diff --git a/_posts/2010-08-19-ms-dos-security-model.html b/_posts/2010-08-19-ms-dos-security-model.html deleted file mode 100644 index 784a509..0000000 --- a/_posts/2010-08-19-ms-dos-security-model.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: The MS-DOS Security Model -date: '2010-08-19T21:55:00.004+02:00' -author: Joanna Rutkowska -tags: -- os security -- general -- fighting for a better world -modified_time: '2010-09-02T10:38:00.774+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-787574069472938268 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/08/ms-dos-security-model.html ---- - -Back in the '80s, there was an operating system called MS-DOS. This ancient OS, some readers might not even remember it today, had a very simple security model: every application had access to all the user files and other applications.

Today, over two decades later, overwhelming majority of people still use the very same security model... Why? Because on any modern, mainstream OS, be that Linux, Mac, or Windows, all the user applications still have full access to all the user's files, and can manipulate all the other user's applications.

Does it mean we haven't progressed anywhere from the MS-DOS age? Not quite. Modern OSes do have various anti-exploitation mechanisms, such as ASLR, NX, guard pages (well, Linux has it since last week at least), and even some more.

But in my opinion there has been too much focus on anti-exploitation, and on bug finding, (and on patching, of course), while almost nothing has been done on the OS architecture level.

Does anybody know why Linux Desktops offer ability to create different user accounts? What a stupid question, I hear you saying - different accounts allow to run some applications isolated from user's other applications! Really? No! The X server, by design, allows any GUI application to mess with all the other GUI applications being displayed by the same X server (on the same desktop). So, what good it is to have a "random_web_browsing" user, if the Firefox run under this user account would still be able to sniff or inject keystrokes to all my other GUI applications, take screenshots of them, etc...?

[Yes, I know, the user accounts allows also to theoretically share a single desktop computer among more than one physical users (also known as: people), but, come on, these days it's that a single person has many computers, and not the other way around.]

One might argue that the progress in the anti-exploitation, and also safe languages, would make it nearly impossible to e.g. exploit a Web browser in the next few years, so there would be no need to have a "random_web_browsing" user in the first place. But, we need isolation not only to protect ourselves when somebody exploits one of our application (e.g. a Web Browser, or a PDF viewer), but also, and perhaps most importantly, to protect from maliciously written applications.

Take summer holiday example: imagine you're a scuba diver - now, being also a decently geeky person, no doubt you will want to have some dive log manager application to store the history of your dives on a computer. There are a dozen of such applications on the web, so all you need to do is to pick one (you know, the one with the nicest screenshots), and... well you need to install it on your laptop now. But, hey, why this little, made by nobody-knows-who, dive application should be given unlimited access to all your personal files, work email, bank account, and god-know-what-else-you-keep-on-your-laptop? Anti-exploitation technology would do exactly nothing to prevent your files in this case.

Aha, it would be so nice if we could just create a user "diving", and run the app under this account. In the future, you could throw in some advanced deco planning application into the same account, still separated from all the other applications.

But, sorry, that would not work, because the X server doesn't provide isolation on the GUI-level. So, again, why should anybody bother creating any additional user accounts on a Linux Desktop?

Windows Vista made a little step forward in this area by introducing integrity levels, that, at least theoretically, were supposed to prevent GUI applications from messing with each other. But they didn't scale well (IIRC there were just 3 or 4 integrity levels available), and it still isn't really clear if Microsoft treats them seriously.

So, why do we have user accounts on Linux Desktops and Macs is beyond me (I guess Mac's X server doesn't implement any GUI-level isolation either - if I'm wrong, please point me out to the appropriate reference)?

And we haven't even touched the problems that might arise from the attacker exploiting a bug in the (over-complex) GUI server/API, or in the (big fat) kernel (with hundreds of drivers). In order for those attacks to become really interesting (like the Rafal's attack we presented yesterday), the user would have to already be using e.g. different X servers (and switch between them using Ctrl-Shift-Fn), or some sandboxing mechanisms, such as SELinux sandbox, or, in case of Vista, a scheme similar to this one. \ No newline at end of file diff --git a/_posts/2010-09-02-qubes-qubes-pro-and-future.html b/_posts/2010-09-02-qubes-qubes-pro-and-future.html deleted file mode 100644 index 00b3710..0000000 --- a/_posts/2010-09-02-qubes-qubes-pro-and-future.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Qubes, Qubes Pro, and the Future... -date: '2010-09-02T10:38:00.005+02:00' -author: Joanna Rutkowska -tags: -- company news -- qubes -- conferences -modified_time: '2010-09-02T12:28:46.891+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8797973337920093538 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/09/qubes-qubes-pro-and-future.html ---- - -The work on Qubes OS has been extremely exciting and also very challenging for us. While most of the work we have been doing so far relates to solving various technical, under-the-hood challenges, the more important goals in the long-term are related more to mitigating the so called "human factor", i.e. making the system not only easy to use, but tolerant to user absentmindedness. This includes e.g. ensuring the user uses a correct AppVM (e.g. do the banking in the "banking" AppVM, and not in the "random web browsing" AppVM, and also not the other way around: don't do random surfing in the "banking" AppVM), and generally making the whole isolation between AppVMs as seamless as possible, but without sacrificing the security at the same time.

This is becoming very important, as the technical level of security in Qubes is already very high, and so the "human factor" might easily become a low hanging fruit for the attacker. (In contrast to other OSes)

But for Qubes to become something more than just an interesting OS for Linux geeks and security enthusiasts, it is also critical to have better application support. Right now Qubes lets users run Linux apps, because each AppVM is Linux-based. But, and let's not be afraid to admit this: Linux sucks when it comes to application support! (Take Open Office as an example - it not only looks like MS Office 97, but is also terribly user-unfriendly, especially their presentation program, the Impress. Why is it so difficult to make it look and behave more like Apple Keynote?)

There is only one way to provide better application support to Qubes: make it support Windows-based, or Mac-based, AppVMs. Just imagine that: being able to run most of your Windows (or Mac) applications, but at the same time benefit from the Qubes strong isolation and seamless integration on one common desktop...

In order to implement support for Windows-based AppVMs (or alternatively Mac-based AppVM) we would need to engage significant resources (5+ very skilled developers, working full time for 1+ year), and so we're currently looking for an investor that would be able to provide funding for such an endeavor. The idea is to create a dedicated spin-off company that would focus entirely on Qubes and Qubes Pro, and in the future will make a profit from selling Qubes Pro licenses. Qubes Pro will become a commercial product, still based on the open source Qubes, but adding support for Windows-based or Mac-based AppVMs. I would be happy to discuss the details and business plan via email with interested potential investors.

Speaking about the future of Qubes: next week I will speak at the European Trusted Infrastructure Summer School, where I will talk about some general stuff like why we need secure desktop systems and why trusted computing might be a way to go, but will also dive a little bit into some new things we plan for Qubes 2.0, such as storage domain and split I/O graphics model. The conference features some very reputable speakers in system-level security field, such as David Grawrock (the father of Intel TXT and TPM), and Loic Duflot (our venerable competitor in the filed of offensive system-level research), so I consider a honour to deliver an opening keynote there (Check the agenda here).

I will have my Qubes laptop with me, of course, so if anybody is interested to see Qubes OS live (including Disposable VMs!), I would be happy to do a quick demo on the spot. \ No newline at end of file diff --git a/_posts/2010-09-09-untrusting-your-gui-subsystem.html b/_posts/2010-09-09-untrusting-your-gui-subsystem.html deleted file mode 100644 index a05c95c..0000000 --- a/_posts/2010-09-09-untrusting-your-gui-subsystem.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: (Un)Trusting your GUI Subsystem -date: '2010-09-09T18:21:00.002+02:00' -author: Joanna Rutkowska -tags: -- os security -- trusted computing -- general -- qubes -modified_time: '2010-09-09T18:37:57.159+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1857218549417302829 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/09/untrusting-your-gui-subsystem.html ---- - -Why do we need secure desktop systems? Why support from hardware is necessary to build secure desktop OSes? Does virtualization make things more, or less complex? Why Dynamic RTM (Intel TXT) is better than Static RTM? Can we have untrusted GUI domain/subsystem?

I tried to cover those questions in my recent keynote at ETISS, and you can grab the slides here.

Particularly, the slide #18 presents the idealistic view of an OS that could be achieved through the use of hardware virtualization and trusted boot technologies. It might look very similar to many other pictures of virtualized systems one can see these days, but what makes it special is that all the dark gray boxes represent untrusted domains (so, their compromise is not security-critical, except for the potential of a denial-of-service).

No OS currently implements this architecture, even Qubes. We still have Storage and GUI subsystem in Dom0 (so they are both trusted), although we already know (we think) how to implement the untrusted storage domain (this is described in detail in the arch spec), and the main reason we don't have it now is that TXT market adoption is so poor, that very few people could make use of it.

The GUI subsystem is, however, a much bigger challenge. When we think about, it should really feel impossible to have an untrusted GUI subsystem, because the GUI subsystem really "sees" all the pixmaps that are to be displayed to the user, so also all the confidential emails, documents, etc. The GUI is different in nature than the networking subsystem, where we can use encrypted protocols to prevent the netvm from sniffing or meaningfully intercepting the application-generated traffic, or the storage subsystem, where we can use fs-encryption and trusted boot technologies to keep the storage domain off from reading or modifying the files used by apps in a meaningful ways. We cannot really encrypt the pixmaps (in the apps, or AppVMs), because for this to work we would need to have graphics cards that would be able to do the decryption and key exchange (note how this is different from the case of an untrusted storage domain, where there is no need for internal hardware encryption!), and the idea of putting, essentially an HTTPS webserver on your GPU is doubtful at best, because it would essentially move the target from the GUI domain to the GPU, and there is really no reason why lots-of-code in the GPU were any harder to attack than lots-of-code in the GUI domain...

So we came out recently with an idea of a Split I/O model that is also presented in my slides, where we separate the user input (keyboard, mouse), and keep it still in dom0 (trusted domain), from the output (GUI, audio), which is moved into an untrusted GUI domain. We obviously need to make sure that the GUI domain cannot "talk" to other domains, to make sure it cannot "leak out" the secrets that it "sees" while processing the various pixmaps. For this we need to have the hypervisor ensure that all the inter-domain shared pages mapped into the GUI domain are read-only for the GUI domain, and this would imply that we need the GUI protocol, exposed by the GUI domain to other AppVMs, to be unidirectional.

There are more challenges though, e.g. how to keep the bandwith of timing covert channels, such as those through the CPU caches, between the GUI domain and other AppVMs on a reasonably low level (please note the distinction between a covert channel, which require cooperation of two domains, and a side-channel, which requires just one domain to be malicious - the latter are much more of a theoretical problem, and are of a concern only in some very high security military systems, while the former are easy to implement in practice usually, and present a practical problem in this very scenario).

Another problem, that was immediately pointed out by the ETISS audience, is that an attacker, who compromised the GUI domain, can manipulate the pixmaps that are being processed in the GUI subsystem to present false picture to the user (remember, the attacker should have no way to send them out anywhere). This includes attacks such as button relabeling ("OK" becomes "Cancel" and the other way around), content manipulation ("$1,000,000" instead of "$100", and vice-versa), security labels spoofing ("red"-labeled windows becoming "green"-labeled), and so on. It's an open question how practical these attacks are, at least when we consider automated attacks, as they require ability to extract some semantics from the pixmaps (where is the button, where is the decoration), as well as understanding the user's actions, intentions, and behavior (just automatically relabeling my Friefox label to "green" would be a poor attack, as I would immediately realize something is going wrong). Nevertheless this is a problem, and I'm not sure how this could be solved with the current hardware architecture.

But do we really need untrusted GUI domain? That depends. Currently in Qubes the GUI subsystem is located in dom0, and thus it is fully trusted, and this also means that a potential compromise of the GUI subsystem is considered fatal. We try to make an attack on GUI as hard as possible, and this is the reason we have designed and implemented special, very simple GUI protocol that is exposed to other AppVMs (instead of e.g. using the X protocol or VNC). But if we wanted to add some more "features", such as 3D hardware acceleration for the apps (3D acceleration is already available to the Window Manager in Qubes, but not for the apps), then we would not be able to keep the GUI protocol so simple anymore, and this might result in introducing exploitable fatal bugs. So, in that case it would be great to have untrusted GUI domain, because we would be able to provide feature-rich GUI protocols, with all the OpenGL-ish like things, without worrying that somebody might exploit the GUI backend. We would also not need to worry about putting all the various 3rd party software in the GUI domain, such as KDE, Xorg, and various 3rd party GPU drivers, like e.g. NVIDIA's closed source ones, and that some of it might be malicious.

So, generally, yes, we would like to have untrusted GUI domain - we can live without it, but then we will not have all the fancy 3D acceleration for games, and also need to carefully choose and verify the GUI-related software (which is lots of software).

But perhaps in the next 5 years everybody will have a computer with a few dozens of cores, and also the CPU-to-DRAM bandwidth will be orders of magnitude faster than today, and so there will be no longer a need to offload graphic intensive work to a specialized GPU, because one of our 64 cores will happily do the work? Wouldn't that be a nicer architecture, also for many other reasons (e.g. better utilization of power/circuit real estate)? In that case nobody will need OpenGL, and so there will be no need for a richer GUI protocol than what is already implemented in Qubes...

It's quite exciting to see what will happen (and what we will come up for Qubes) :)

BTW, some people might confuse X server de-privileging efforts, i.e. making the X server run without root privileges, which is being done in some Linux distros and BSDs, with what had been described in this article, namely making the GUI subsystem untrusted. Please note that a de-priviliged X server doesn't really solve any major security problems related to GUI subsystem, as whoever controls ("0wns") the X server (depriviliged or not) can steal or manipulate all the data that this X server is processing/displaying. Apparently there are some reasons why people want to run Xorg as non-root, but in case of typical desktop OSes this provides little security benefit (unless you want to run a few X servers with different user accounts, and on different vt's, which most people would never do anyway). \ No newline at end of file diff --git a/_posts/2010-09-13-on-thin-clients-security.html b/_posts/2010-09-13-on-thin-clients-security.html deleted file mode 100644 index 745ce9b..0000000 --- a/_posts/2010-09-13-on-thin-clients-security.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: On Thin Clients Security -date: '2010-09-13T16:35:00.006+02:00' -author: Joanna Rutkowska -tags: -- os security -- general -modified_time: '2010-12-06T18:23:25.754+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1723680013954760533 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/09/on-thin-clients-security.html ---- - -I'm constantly being asked about it, and so I thought I would write a handy blog post, so I could just referrer to it in the future, when yet anther person asks me if I think the use of Thin Clients is a game-changer to desktop security...

It is not! Thin Clients do not improve your desktop security in any way, and that's because:

  1. You still run a regular full-blown OS, such as Widows and all the regular applications, such as those buggy PDF readers, Web browsers, etc - it's just you run them all on some corporate server, rather on your laptop. The fact that you run the OS on the corporate server, doesn't make it any less prone to compromises, compared to if you run it locally on your laptop.


  2. A compromise of your laptop, even if it's just a dump terminal, is still fatal! This is because if your laptop's kernel (or MBR, or BIOS, or some PCI device's firmware, or GPU) is compromised, the attacker can intercept/steal/spoof all the data that you work on remotely, because it is still your laptop that processes the input (keystrokes, mouse events) and output (pixels). So, an Evil Maid attack on your laptop when you use it as a Thin Client, would be just as devastating, as it is otherwise (and don't fool yourselves that crypto tokens can help)

We really need secure end-user systems, even if we just want to use them as dump terminals only! There is really no way we could skip this step (and e.g. focus only on infrastructure, or services security). \ No newline at end of file diff --git a/_posts/2010-09-28-itl-is-hiring.html b/_posts/2010-09-28-itl-is-hiring.html deleted file mode 100644 index 1e3d8f1..0000000 --- a/_posts/2010-09-28-itl-is-hiring.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: ITL is hiring! -date: '2010-09-28T13:55:00.007+02:00' -author: Joanna Rutkowska -tags: -- company news -- qubes -modified_time: '2010-09-28T14:55:22.519+02:00' -thumbnail: http://4.bp.blogspot.com/_Ti3q3Hdvels/TKHbgfsTIKI/AAAAAAAAAGY/x5QFRMysCTE/s72-c/academia_vs_business.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-7242870861005515935 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/09/itl-is-hiring.html ---- - -We're looking to hire one or two full time developers, who will be working on the open source version of Qubes OS, with the primary task of advancing it from Alpha to Beta stage, and then finally to a production quality version.

We're looking to hire developers, not necessarily security researchers! Specifically we expect the following from candidates:
  • Many years of experience with Linux/GNU development, including system-level and kernel-level Linux development, documented by the actual projects,
  • Familiarity with virtualization technologies, and specifically with Xen hypervisor,
  • Basic understanding of the Qubes architecture and excitement about the project :)
  • Product-oriented approach (polishing, testing, packaging, understanding of user needs),
  • Good communication skills in written English
In return we offer the following benefits:
  • Decent, full-time salary,
  • Opportunity to be part of a renown security team,
  • Opportunity to work on an exciting product,
  • Work on a GPLed project with all the benefits it gives to the developer (visibility, rights to the code)
If you're interested in joining our team, please send a message to joanna at invisiblethingslab.com.

Please do not send typical resumes: don't write about schools you finished, certificates you obtained, driving license, scuba trainings, etc. We are only interested in a short bio (keep it below 100 words please), and links to your past or current projects. Include your geographic location.

While it would be great if you were based in Warsaw (or somewhere in Poland), as it would allow for regular face-to-face meetings, this is not a critical factor. ITL doesn't have a physical office, and everybody work from their apartments, so there is no need to relocate to Warsaw, in case you happened to be based somewhere else.

\ No newline at end of file diff --git a/_posts/2010-10-06-qubes-alpha-3.html b/_posts/2010-10-06-qubes-alpha-3.html deleted file mode 100644 index 5b2296a..0000000 --- a/_posts/2010-10-06-qubes-alpha-3.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Qubes Alpha 3! -date: '2010-10-06T16:00:00.003+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2010-10-06T16:29:07.797+02:00' -thumbnail: http://3.bp.blogspot.com/_Ti3q3Hdvels/TKpR7rgoq4I/AAAAAAAAAGw/ARa_TKsWL1E/s72-c/disposablevm.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-9214464405081236892 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/10/qubes-alpha-3.html ---- - -We have just uploaded the new packages for the Qubes Alpha 3 milestone. A lot of under the hood work went into this release, including:
  • Redesigned networking and NetVM support (for VT-d system)
  • Reasonably stable S3 sleep support (suspend-to-RAM), that works even with a NetVM!
  • Improved GUI virtualization (all known bugs fixed finally!)
Disposable VMs are really a killer feature IMO. The screenshot below shows the user's experience:

The user righ-clicks on a PDF file, chooses "Open in Disposable VM", and then waits 1... 2... 3... 4 seconds (assuming a reasonably modern laptop) and the document automagically opens in a fresh new Disposable VM. If you make some changes to the document (e.g. if it was a PDF form, and you edited it), those changes will propagate back to the original file in the original AppVM.

So, within 4-5 seconds, Qubes creates a new VM, boots it up (actually refreshes from a savefile), copies the file in question to the VM, and finally opens the application that is a registered MIME handler for this type of documents, e.g. a PDF viewer. We're pretty confident this time could be further decreased down to some 2 seconds, or maybe even less. This is planned for some later Beta release.

Dynamic memory balancing allows to better utilize system physical memory by moving it between running AppVMs in realtime, according to the VM's real needs. This allows to run more VMs, compared to a scheme with static memory allocation, and also dramatically eliminates system hiccups, that otherwise occur often in a static scheme when one of the VMs is short of memory and initiates swapping.

The screenshot above shows the memory usage on my 6GB laptop when writing this blog post. As you can see I can easily run a dozen of AppVMs (most users will not need that many, but I'm a bit more paranoid I guess ;) and could probably even start a few more if there was such a need (e.g. open some Disposable VMs). Of course, this all depends on the actual type of workload the user runs in each VM - most of my AppVMs run just one or two applications, usually a Web browser (Firefox), but some, e.g. the work, and personal AppVMs run much more memory-hungry applications such as Open Office, or Picasa Photo Browser. I very rarely see more than 1 GB of memory allocated to a single VM, though. Generally speaking, the new memory management in Qubes works pretty nice.

Currently, the biggest slow-down factor for Qubes is somehow poor disk performance, most likely caused by the joint impact of the Xen backend, Linux dm, and kcryptd (we use the simplest possible Xen block backend for security reasons, will move to more sophisticated backends when we introduce untrusted storage domain in Qubes 2.0).

Now, most of the under-the-hood work for Qubes 1.0 seems to be complete, and now it time for all the polishing of the user experience, which will be the main focus of the upcoming Beta development. Just reminding that we're currently looking to hire developers for this effort.

The Installation instructions can be found here. Enjoy! \ No newline at end of file diff --git a/_posts/2010-12-06-update-on-qubes.html b/_posts/2010-12-06-update-on-qubes.html deleted file mode 100644 index a9b5271..0000000 --- a/_posts/2010-12-06-update-on-qubes.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Update on Qubes -date: '2010-12-06T18:23:00.004+01:00' -author: Joanna Rutkowska -tags: -- company news -- qubes -modified_time: '2011-01-04T22:52:31.593+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1897900981379908689 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2010/12/update-on-qubes.html ---- - -It's been a bit quiet on the Qubes development front for the last 2 months. The reason for this was that Rafal and myself got fully engaged in a new commercial research project. After all, we do need to make money somehow, so that we could later spend them on funding Qubes development :)

But this new engagement is actually closely related to what we do with Qubes (i.e. how new hardware technologies allow to build more secure OSes), so it's not like we're abandoning Qubes, as the experience we get with this research project will surely be useful for us when designing and implementing the Qubes 2.0 architecture.

In order to continue with Qubes, we've decided to hire some Linux programmers, while Rafal and I will continue with our research project over the coming months. We've decided to start a cooperation with another Polish computer outfit, TLS Technologies, who specializes in advanced systems design and implementation.

There are a couple of people people from TLS engaged in Qubes, and you will soon "meet" them on qubes-devel, in our wiki, and of course, you will see their contributions in our git repos.

The plan is to have Beta 1 released sometime in January 20102011. The two important features that will be implemented first, and that will make it into Beta 1 (apart for the long-awaited installer) are: Firewall VMs, and support for templates for service VMs. Stay tuned for more details soon!

If everything goes smoothly, then we should expect Qubes 1.0 sometime at the end of Q1 2011... \ No newline at end of file diff --git a/_posts/2011-03-08-my-documents-got-loststolen-offtopic.html b/_posts/2011-03-08-my-documents-got-loststolen-offtopic.html deleted file mode 100644 index 0b24ece..0000000 --- a/_posts/2011-03-08-my-documents-got-loststolen-offtopic.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: My documents got lost/stolen [offtopic] -date: '2011-03-08T14:40:00.007+01:00' -author: Joanna Rutkowska -tags: -- personal -modified_time: '2011-03-13T12:11:55.942+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3724428542352438428 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/03/my-documents-got-loststolen-offtopic.html ---- - -I just realized yesterday that my wallet has disappeared, with all my credit cards, Polish ID card, and driver's license inside. Most likely somebody stole it. No strange transactions have been observed on my credit card accounts yet, but these are generally not much of a concern, thanks to credit card insurance. What is more troubling, is that perhaps some other woman is currently using my stolen ID and the driver's license doing nasty things on my account.

Apparently there is little one can do in Poland (EU?) in order to invalidate a stolen ID card. While there is an inter-bank Polish-wide database of stolen ID cards, it is being used only by banks, so it can only prevent other people from applying for small loans (for bigger loans, one would need more documents). But there are so many other things one could do, such as renting a car (and then committing a crime with it), signing up a deal with a mobile carrier (and then committing a cyber crime using this phone, or just making a really huge bill), or perhaps buying an SSL cert...

With apparently no better option left, I decided to write this blog post -- hopefully somebody will find it, e.g. before issuing a Class 2 SSL cert to the fake Joanna Rutkowska.

Here are the numbers of my lost/stolen documents:
  • AFS739530
  • **********5058
Luckily I have had my ID details written down somewhere, and the driver's license number I extracted from my Hertz profile.

A scene at a police department in Warsaw:
  • Hi, I would like to report my wallet being lost or stolen...
  • Madam, was your wallet stolen, or have you lost it?
  • Officer, how could I possibly know this...? If I lost it, do you really think I would remember the very moment of losing it?
  • Madam, you must be sure whether it was a crime or not!
  • ...
A scene on the hotline, calling my mobile provider (note that I decided to use the word stolen this time):
  • Hi, my documents have been stolen -- I would like that you indicate my ID card as invalid in your system (that you hopefully share with other telcom operators)..
  • You should report such an incident to the police, Madam...
  • Right, but I guess that neither you, nor any other mobile provides in Poland will consult a Police database before signing up a contract with a strange person who might be using my stolen documents, correct?
  • Oh, but we will not sign a contract with a strange person who uses your documents! Only with you!
  • And how would you know it was not me, if that person was similarly aged and looking, and was using my stolen ID and driver's license?
  • ...
\ No newline at end of file diff --git a/_posts/2011-03-13-partitioning-my-digital-life-into.html b/_posts/2011-03-13-partitioning-my-digital-life-into.html deleted file mode 100644 index 66cddc9..0000000 --- a/_posts/2011-03-13-partitioning-my-digital-life-into.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: Partitioning my digital life into security domains -date: '2011-03-13T12:11:00.007+01:00' -author: Joanna Rutkowska -tags: -- os security -- general -- qubes -modified_time: '2013-02-21T15:44:07.572+01:00' -thumbnail: http://1.bp.blogspot.com/-IJVsMCGYQak/TXypnudUSjI/AAAAAAAAAHQ/o0OUQhixsPs/s72-c/qubes%2Bpartitioning%2B-%2Bno%2Bflows.jpg -blogger_id: tag:blogger.com,1999:blog-24586388.post-6127135461889249331 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/03/partitioning-my-digital-life-into.html ---- - -The diagram below illustrates how I have decomposed my digital life into security domains. This is a quite sophisticated scheme and most users would probably want something simpler, but I think it's still interesting to discuss it. The domains are implemented as lightweight AppVMs on Qubes OS. The diagram also shows what type of networking connectivity each domain is allowed.



Let's discuss this diagram bit by bit. The three basic domains are work (the green label), personal (the yellow label), and red (for doing all the untrusted, insensitive things) – these are marked on the diagram with bold frames.

A quick digression on domain labels (colors) – in Qubes OS each domain, apart form having a distinct name, is also assigned a label, which basically is one of the several per-defined colors. These colors, which are used for drawing window decorations by the trusted Window Manager (color frames), are supposed to be user friendly, easy noticeable, indicators of how trusted a given window is. It's totally up to the user how he or she interprets these colors. For me, it has been somehow obvious to associate the red color with something that is untrusted and dangerous (the “red light” -- stop! danger!), green with something that is safe and trusted, while yellow and orange with something in the middle. I have also extended this scheme, to also include blue, and black, which I interpret as indicating progressively more trusted domains than green, with black being something ultimately trusted.

Back to my domains: the work domain is where I have access to my work email, where I keep my work PGP keys, where I prepare reports, slides, papers, etc. I also keep various contracts and NDAs here (yes, these are PDFs, but received from trusted parties via encrypted and signed email – otherwise I open them in Disposable VMs). The work domain has only network access to my work email server (SMTP/IMAP4 over SSL), and nothing more.

For other work-related tasks that require some Web access, such as editing Qubes Wiki, or accepting LinkedIn invites, or downloading cool pictures from fotolia.com for my presentations, or specs and manuals from intel.com, for all this I use work-pub domain, which I have assigned the yellow label, meaning I consider it only somehow trusted, and I would certainly never put my PGP keys there, or any work-related confidential information.

The personal domain is where all my non-work related stuff, such as personal email and calendar, holiday photos, videos, etc, are held. It doesn't really have access to the Web, but if I was into social networking I would then probably allow HTTPS to something like Facebook.
Being somehow on the paranoid side, I also have a special very-personal domain, which I use for the communication with my partner when I'm away from home. We use PGP, of course, and I have a separate PGP keys for this purpose. While we don't discuss any secret and sensitive stuff there, we still prefer to keep our intimate conversations private.

I use shopping for accessing all the internet e-commerce sites. Basically what defines this domain is access to my credit card numbers and my personal address (for shipping). Because I don't really have a dedicated “corporate” credit card, I do all the shopping in this domain, from groceries, through sports equipment, on hotel/plane reservations ending. If I had separate business credit cards, then I would probably split my shopping domain into personal-shopping and work-shopping. I also have banking domain, which I use only for managing my bank account (which again combines both my personal and company accounts).

I also have a few specialized work-related domains, that I rarely use. The work-admin domain is used to manage almost all of the ITL servers, such as our webserver, Qubes repo & wiki servers, email server and DNS management, etc. This domain is allowed only SSH traffic to those server, and HTTPS to a few Web-based management servers. The work-blog is used to manage this very blog you're reading now. The reason why it is separate from work-admin or work, is because I'm over paranoid, and because I fear that if somebody compromises the blogger service, and subsequently exploits a bug in my browser that I use for editing my blog, than I don't want this person to be able to also get admin access to all the ITL servers. 

Similarly, if somebody somehow compromised e.g. the Amazon Web Management Console, and then exploited my browser in work-admin, then I would like at least to retain access to my blog. If I used twitter, I would probably also manage it from this work-blog domain, unless it was a personal twitter account, in which case I would run it from personal.

The qubes-dev domain is used for all the Qubes development, merging other developers' branches (after I verify signatures on their tags, of course!), building RPMs/ISOs (yes, Qubes Beta 1 will ship as a DVD ISO!), and finally signing them. Because the signing keys are there, this domain is very sensitive. This domain is allowed only SSH network access to our Qubes git server. Again, even if somebody compromised this Git server, it still would not be a big problem for us, because we sign and verify all the tags in each others repos (unless somebody could also modify the SSH/Git daemons running there so that they subsequently exploit a hypothetical bug in my git client software when I connect to the server).

I also decided to keep all the accounting-related stuff in a separate domain – whenever I get an invoice I copy it to the accounting domain. The rationale for this is that I trust those PDFs much less than I trust the PDFs I keep in my work domain.

Once a year I move the old stuff from my work domain, such as old email spools, old contracts and NDAs, to the work-archives domain. This is to minimize the potential impact of the potential attack on my work domain (my work domain could be attacked e.g. by exploiting a hypothetical bug in Thunderbird's protocol handshake using a MITM attack, or a hypothetical bug in GPG).

The vault domain is an ultimately trusted one where I generate and keep all my passwords (using keepass) and master GPG keys. Of course, this vault domain has no networking access. Most of those passwords, such as the email server access password is also kept in the specific domains which uses them, such as the work domain, and more specifically in the Thunderbird client (there is absolutely no point in not allowing e.g. Thunderbird to remember the password – if it got compromised it would just steal it the next time I manually enter it)

And finally, there is the previously mentioned red domain (I have tried to call it junk or random in the past, but I think red is still a better name after all). The red domain is totally untrusted – if it gets compromised, I don't care – I would just recreate it within seconds. I don't even back it up! Basically I do there everything that doesn't fit into other domains, and which doesn't require me to provide any sensitive information. I don't differentiate between work-related and personal-related surfing even – I don't care about anonymity for all those tasks I do there. If I was concerned about anonymity, I would create a separate anonymous domain, and proxy all the traffic through a tor proxy from there.

Now, this all looks nice and easy ;) but there is one thing that complicates the above picture...

Data flows between the domains

The diagram below shows the same domains, but additionally with arrows symbolizing typical data flows between them.


You can see that most of the usual data flows are from more trusted domains to less trusted domains – e.g. copy and pasting a URL that I receive via email in my work domain, so that I could open it in my untrusted browser in red, or moving invoices from my work domain (where I receive them via email) to the accounting domain.

But there are, unfortunately, also some transfers from less trusted domains to more trusted ones. One example is copy and pasting an interesting URL that I just stumbled upon when surfing in the red domain, and that I would like to share with a college at work, or a friend, and so I need to copy and paste it to my email client in either work (colleague) or personal (friend) domain.

Now, copying data from less trusted domains to more trusted ones presents a significant problem. While one could think that pasting an URL into Thunderbird email editor is a pretty harmless operation, it's still is an untrusted input – and we don't really know what the red domain really pasted into its local clipboard, and so what we will paste into the work domain's Thunderbird email editor (perhaps 64kB of some junk that will overflow some undo buffer in the editor?). And even more scary is the example with copying the cool-looking graphics file from the Web into my work domain so that I could use it in my presentation slides (e.g. an xkcd . Attacks originating through malicious JPEGs or other graphics format, and exploiting bugs in rendering code have been known for more than a decade.

But this problem – how to handle data flows from less trusted systems to more trusted ones – is not easily solvable in practice, unfortunately...
Some people who design and build high-security systems for use by military and government takes a somehow opposite approach – they say they are not concerned about less-trusted-to-more-trusted data transfers as long as they could assure there is no way to perform a transfer in the opposite direction. 

So, if we could build a system that guarantees that a more trusted domain can never transfer data to a less trusted domain (even if both of those domains are compromised!), then they are happy to allow one-way “up transfers”. In practice this means we need to eliminate all the covert channels between two cooperating domains. The word cooperating is a key word here, and which makes this whole idea not practical at all, IMHO.

Elimination of the covert channels between cooperating domains is indeed required in this scheme, because the assumption is that the data transfer from the less trusted domain could have indeed compromised the more trusted domain. But this, at least, should not result in any data leak back to the originating domain, and later to the less-classified network, which this less-trusted domain is presumably connected to. One of the assumptions here is that the user of such a system is connected to more than one, isolated networks. Even in that case, elimination of all the covert channels between domains (or at least minimizing their bandwith to something unusable – what is unusable, really?) is a big challenge, and can probably only could be done when we're ready to significantly sacrifice the system's performance (smart scheduling tricks are needed to minimize temporal covert channels).

I would like to make it clear that we are not interested in eliminating cooperative covert channels between domains in Qubes any time in the near future, and perhaps in the long term as well. I just don't believe into such approach, and I also don't like that this approach does nothing to preserve the integrity of the more-trusted domain – it only focuses on the isolation aspect. So, perhaps the attacker might not be able to leak secrets back to the less trusted domain, but he or she can do everything else in this more trusted domain. What good is isolation, if we don't maintain integrity?

An alternative solution to handling the less-trusted-to-more-trusted data transfers, is to have trusted “converters” or “verifiers” that could handle specific file types, such as JPEGs, and ensure we get a non-malicious file in the destination domain. While this might remind the bad-old A/V technology, it is something different. Here, the trusted converters would likely be some programs written in a safe language, running in another trusted domain, rather than a big ugly A/V with a huge database of signatures of “bad” patterns of what might appear in a JPEG file. The obvious problem with such an approach is that somebody must write those converters, and write them for all file types that we wish to allow to be transferred to more trusted domains. Perhaps doable in the longer-term, and perhaps we will do it in some future version of Qubes...

Right now we are ignoring this problem, and we say that all less-trusted-to-more-trusted transfers are to be done on the user's own risk :) You're welcome to submit trusted converters for your favorite file type(s) in the meantime!


Copying files between domains


Speaking of copying files between domains, there is another security catch here. If we imagined two physically separated machines that share no common network resources, the only way to move files between those two air-gaped machines would be via something like a USB stick or a CDROM or DVD disc. But inserting a USB drive or CDROM into a machine triggers a whole lot of actions: from parsing device-provided information, loading required drivers (for USB), parsing the driver's partition table, mounting and finally parsing the filesystem. Each of this stage requires the machine's OS to perform a lot of untrusted input processing, and the potential attack space here is quite large. So, even if we could limit ourselves to copy only harmless files between machines/domains (perhaps they were somehow verified by a trusted party in-between, as discussed above), still there is a huge opportunity that the originating domain could compromise the target domain.

In Qubes Alpha we have been using a similar file copy mechanism, using a virtual stick for file copy between domains. In Qubes Beta 1 we will provide a new scheme based on same shared memory channel that we use for GUI virtualization – the technical details of this solution will be available soon in our wiki. The most sensitive element in this new scheme is the un-cpio-like utility that runs in the target domain and unpacks the incoming blob into the pre-defined directory tree (e.g. /home/user/incoming/from-{domainname}/). We believe we can write pretty safe un-cpio-like utility, in contrast to secure all the previously mentioned elements (USB device parsing, partition parsing, fs parsing). The Qubes Beta 1 is planned to be released at the end of March, BTW.

Partitioning enforcement and easy of use

For any security partitioning scheme to make sense in real life, it is necessary to have some enforcement mechanism that would ensure that the user doesn't mistakenly bypass it. Specifically for this purpose we have come up with special, previously-mentioned firewalling support in Qubes Beta 1, that I will cover in a separate article soon.

Anther thing is to make the partitioning easy to use. For instance, I would like to be able to setup a hint in the policy, that when I click on an URL in an email I received in my work domain that it should be automatically opened in the red domain's default Web browser. Currently we don't do that in Qubes, but we're thinking about doing it in the near future.

Summary

Partitioning one's digital life into security domains is certainly not an easy process and requires some thinking. This process is also very user-specific. The partitioning scheme that I've come up for myself is quite sophisticated, and most people would probably want something much simpler. In case of corporate deployments, the scheme would be designed by CIO or IT admins, and enforced on users automatically. Much bigger problem are home and small business users, who would need to come up with the partitioning themselves. Perhaps in future versions of Qubes we will provide some ready to use templates for select "typical" groups of users. \ No newline at end of file diff --git a/_posts/2011-04-12-qubes-beta-1-has-been-released.html b/_posts/2011-04-12-qubes-beta-1-has-been-released.html deleted file mode 100644 index 8673820..0000000 --- a/_posts/2011-04-12-qubes-beta-1-has-been-released.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes Beta 1 has been released! -date: '2011-04-12T08:49:00.001+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2011-04-25T23:05:12.416+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1742367838131028779 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/04/qubes-beta-1-has-been-released.html ---- - -I'm very proud to announce that we have just released Qubes Beta 1! Some new features that have come into this release include:
  • Installer (finally!),
  • Improved template sharing mechanism: service VMs can now be based on a common template, and you can now easily create many net- and proxy- VMs; template upgrades now don't require shutting down all the VMs;
  • Standalone VMs, convenient for development, as well as for installing the least trusted software,
  • Built in, easy to use firewall VM(s),
  • Seamless integration of virtualized tray icons (check the screen shots!)
  • Redesigned file-copy between domains (easier, more secure),
  • Default template based on Fedora 14 (x64)
... and many other improvements and bug fixes!

To download the installation ISO go to this page.

You can also install Qubes on an external USB disk - this might be a convenient option if you want to just try it out, without the need to "sacrifice" your laptop.

This release is very stable, but we feel that it still requires some more polish, mostly with regards to user interface. We're planning to release at least one more beta, in about 2 months, where we will focus mostly on UI improvements, and also on upgrading Xen and kernel in Dom0 to allow for better hardware support.

The final Qubes 1.0 is planned after the summer holidays. Once we reach this milestone, further work will likely fork into two branches:
  • The "commercial branch" which will focus on adding various extensions on top of Qubes 1. One specific commercial extension that we think would be a killer is support for Windows-based domains (AppVMs),
  • The "open source branch" that will continue on implementing even more revolutionary architecture and features, such as untrusted storage domains, safe GPU multiplexing, trusted boot, etc. In the end this should lead to Qubes 2.0 sometime in 2012 or 2013.
Cross your fingers! \ No newline at end of file diff --git a/_posts/2011-04-16-why-us-password-revolution-wont-work.html b/_posts/2011-04-16-why-us-password-revolution-wont-work.html deleted file mode 100644 index e9cc2b8..0000000 --- a/_posts/2011-04-16-why-us-password-revolution-wont-work.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Why the US "password revolution" won't work -date: '2011-04-16T14:29:00.001+02:00' -author: Joanna Rutkowska -tags: -- os security -- trusted computing -- general -modified_time: '2011-07-24T12:07:34.903+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3884781202259282494 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/04/why-us-password-revolution-wont-work.html ---- - -So, I've been reading this article this morning on how the US "private and public" institutions are going to revolutionize the way we authenticate on the web. The "ground breaking" idea, also illustrated on this NIST animation, is to use 3rd party authorities that would first verify your identity somehow ("Can we see your id?", "What is your Mam's maiden name?", etc), and then would issue you some kind of a token that you would later use for authentication on the web. A token would be e.g. a smart card, or a USB stick (probably they just mean a smart card with USB connector, whatever), or even a "phone application".

The idea is that the user will not have to "remember" all those passwords for all the various websites, which apparently is a problem in practice, because most users never heard about password manager apps, and so they actually try to remember all those passwords, or even try to use the same one all over the place. Using one password for more than one website is obviously wrong and people should be told not to do that. But an easy way to solve this is to just get people to use password managers.

But the key problem that they try to solve, which is identity theft, is just not gonna be solved by this "password revolution". This is because if somebody has compromised my laptop, then it really doesn't matter if I use passwords, or smart cards, or whatever other multi-factor authentication mechanism -- none of them will help if the attacker controls my operating system.

Most people cannot just get it -- this is because they lack understanding of how computers and operating systems work. They don't understand that the operating system can impersonate the user at will! This is because the operating system fully controls the keyboard, the mouse, and the screen.

So, imagine you use your super-secure smart card token for authentication to your bank. So, before you log into your bank account, and perhaps before you make any transaction on the banking website, you must insert your smart card somewhere (e.g. into smart card reader, or into USB port, etc). Before you insert your token, no one can impersonate you on the bank website. So far, so good! But then, once you inserted your token, it's all lost! The compromised OS could have saved your PIN to this card when you used it previously (even if you configured it not to do so!) and now,  immediately, it could use the inserted card to authenticate as you to the bank and start issuing transactions on your behalf. And you won't even notice this all, because in the meantime it will show you a faked screen of your banking account. After all, it fully controls the screen.

The bottom line is that we cannot secure our digital lives, if our client operating systems could not be secured first. And today, the operating systems we use on our laptops, such as Windows, or Mac, or Ubuntu, are just trivial to be compromised by the attackers. After all, if that wasn't true we wouldn't have all those problems with identity theft. But introduction of tokens won't make our operating systems any more secure!

What we need instead are technologies that allow to build next-generation trusted operating systems. Technologies such as Intel TXT or VT-d. And we need OS vendors to actually start using them.

You can say I'm biased, because of our work on Qubes OS. But then, consider this -- perhaps we would never invest so much money and resources into this project, if we believed there are other ways to bring security to our digital life. \ No newline at end of file diff --git a/_posts/2011-04-23-linux-security-circus-on-gui-isolation.html b/_posts/2011-04-23-linux-security-circus-on-gui-isolation.html deleted file mode 100644 index cabed3a..0000000 --- a/_posts/2011-04-23-linux-security-circus-on-gui-isolation.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: 'The Linux Security Circus: On GUI isolation' -date: '2011-04-23T16:52:00.008+02:00' -author: Joanna Rutkowska -tags: -- os security -- general -modified_time: '2011-04-25T23:04:59.505+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-1548152289459004392 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-on-gui-isolation.html ---- - -
There certainly is one thing that most Linux users don't realize about their Linux systems... this is the lack of GUI-level isolation, and how it essentially nullifies all the desktop security. I wrote about it a few times, I spoke about it a few times, yet I still come across people who don't realize it all the time.

So, let me stress this one more time: if you have two GUI applications, e.g. an OpenOffice Word Processor, and a stupid Tetris game, both of which granted access to your screen (your X server), then there is no isolation between those two apps. Even if they run as different user accounts! Even if they are somehow sandboxed by SELinux or whatever! None, zero, null, nil!

The X server architecture, designed long time ago by some happy hippies who just thought all the people apps are good and non-malicious, simply allows any GUI application to control any other one. No bugs, no exploits, no tricks, are required. This is all by design. One application can sniff or inject keystrokes to another one, can take snapshots of the screen occupied by windows belonging to another one, etc.

If you don't believe me, I suggest you do a simple experiment. Open a terminal window, as normal user, and run xinput list, which is a standard diagnostic program for Xorg (on Fedora you will likely need to install it first: yum install xorg-x11-apps):

$ xinput list

It will show you all the pointer and keyboard devices that your Xorg knows about. Note the ID of the device listed as “AT keyboard” and then run (as normal user!):

$ xinput test id

It should now start displaying the scancodes for all the keys you press on the keyboard. If it doesn't, it means you used a wrong device ID.

Now, for the best, start another terminal window, and switch to root (e.g. using su, or sudo). Notice how the xinput running as user is able to sniff all your keystrokes, including root password (for su), and then all the keystrokes you enter in your root session. Start some GUI app as root, or as different user, again notice how your xinput can sniff all the keystrokes you enter to this other app!

Yes, I can understand what is happening in your mind and heart right now... Don't worry, others have also passed through it. Feel free to hate me, throw out insults at me, etc. I don't mind, really (I just won't moderate them). When you calm down, continue reading.

In Qubes the above problem doesn't exist, because each domain (each AppVM) has it own local, isolated, dummy X server. The main X server, that runs in Dom0 and that handles the real display is never exposed to any of the AppVMs directly (AppVMs cannot connect to it via the X protocol). For details see this technical overview.

You can repeat the same experiment in Qubes. You just need to use the ID of the “qubesdev” device, as shown by xinput list (should be 7). Run the xinput in one of your domains, e.g. in the “red” one. Because we actually use the same device for both mouse and keystrokes, you should now see both the key scancodes, as well as all the mouse events. Notice how your xinput is able to sniff all the events that are destined for other apps belonging to the same domain where you run xinput, and how it is unable to sniff anything targeted to other domains, or Dom0.

BTW, Windows is the only one mainstream OS I'm aware of, that actually attempts to implement some form of GUI-level isolation, starting from Windows Vista. See e.g. this ancient article I wrote in the days when I used Vista at my primary laptop. Of course, it's still easy to bypass this isolation, because of the huge interface that is exposed to each GUI client (that also includes GPU API). Nevertheless, they at least attempt to prevent this at the architecture level.
\ No newline at end of file diff --git a/_posts/2011-05-13-following-white-rabbit-software-attacks.html b/_posts/2011-05-13-following-white-rabbit-software-attacks.html deleted file mode 100644 index de66f50..0000000 --- a/_posts/2011-05-13-following-white-rabbit-software-attacks.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: 'Following the White Rabbit: Software Attacks Against Intel VT-d' -date: '2011-05-13T19:04:00.001+02:00' -author: Joanna Rutkowska -tags: -- os security -- attack -- trusted computing -- exploit -modified_time: '2011-07-24T12:08:06.132+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5608264528014721919 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/05/following-white-rabbit-software-attacks.html ---- - -Today we publish a new paper which is a result of our several month long in-depth evaluation of Intel VT-d technology. To quote the abstract:
We discuss three software attacks that might allow for escaping from a VT-d-protected driver domain in a virtualization system. We then focus on one of those attacks, and demonstrate practical and reliable code execution exploit against a Xen system. Finally, we discuss how new hardware from Intel offers a potential for protection against our attacks in the form of Interrupt Remapping (for client systems available only on the very latest Sandy Bridge processors). But we also discuss how this protection could be circumvented on a Xen system under certain circumstances...

I think the attack is likely the most complex and surprising out of all the things we have presented so far. Parts of it are even funny (if you share our weird sense of humor), such as the use of ICMP ping to generate MSIs. The paper also covers the vendors' response. You can download the paper here. \ No newline at end of file diff --git a/_posts/2011-05-21-app-oriented-ui-model-and-its-security.html b/_posts/2011-05-21-app-oriented-ui-model-and-its-security.html deleted file mode 100644 index c537648..0000000 --- a/_posts/2011-05-21-app-oriented-ui-model-and-its-security.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: The App-oriented UI Model and its Security Implications -date: '2011-05-21T20:17:00.001+02:00' -author: Joanna Rutkowska -tags: -- os security -- philosophical -- general -- qubes -modified_time: '2011-07-24T12:08:19.636+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7354555212668635236 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/05/app-oriented-ui-model-and-its-security.html ---- - -
Most of the desktop OSes today, such as Windows or Mac, expose and encourage a File-oriented UI model. You pick a file in the file manager, click it, and then the file manager automagically determines the best app to handle the file, starts the app, and passes the file to it.

Back in the MS-DOS days we used a different model: an app-oriented model – you started an app first, e.g. Word Perfect, or Lotus 1-2-3, and then you opened a file from within the app (Norton Commander and similar programs somehow changed that later).

Interestingly this very same app-oriented model is now becoming popular again thanks to systems such as iOS and Android. There is no such thing as a global File Explorer or Finder on an iPad. Only the apps. One must first pick an app, and then it's the application's responsibility to expose an option for opening one of your “files”, if the app supports it (e.g. the calendar or task list apps would always open your default calendar or task list without asking for anything).

I actually like this app-oriented model a lot! It's much less confusing to the user. Just think about all those attacks in the past where an attacker could prepare a file with some innocently-looking extension but which in fact was an MZ executable. Or how many times people are not even aware which app they use! One might argue that user should not be distracted by such “unimportant” things as what app he or she uses for her work, but I disagree. Apparently Apple, and millions of iPhone and iPad users, disagree too.

But the main reason why I like this app-oriented model is because it just fits greatly into the Security by Isolation philosophy.

Just think about it: if it's possible to get users to consciously select an app, and we now know it is possible thanks to the millions of app-oriented devices sold, then it should be not much more difficult to get them to also consciously select the domain or area, such as “work”, or “personal”, which they wish to use. Just imagine that instead of one “Mail” app, you would have two apps (and two icons): “Mail Work”, and “Mail Personal”.

There are some technicalities here – such as e.g. how to isolate apps between each other? Do we need to build another layer of isolation in a form of VMs to isolate “Mail Work” from “Mail Personal”, or should the (new) OSes and the (new) APIs be designed in such a way, that they were thin and secure, and allow for very good isolation between processes without using virtualization?

In Qubes we must use this additional layer of abstraction (virtualization), because we want to use Linux apps (and in the future also Windows apps), and they require huge POSIX/X API (and Win32 API) to work correctly. And those APIs are not easily isolate-able. So we use VMs as “API providers”. Same with isolating networking drivers and stacks – we need Linux kernel API to get those drivers and stacks running, so that's why we use a Linux-based “NetVM” for isolating networking. For this reason we expect users to explicitly define domains, such as “work”, “personal”, etc. This is because we cannot afford to run every single app in a separate AppVM (more precisely we cannot afford to create a working copy of this huge POSIX/X API for each app).

But we could very well imagine a well constructed API for apps that would just be easily isolate-able (I'm not saying iOS or Android has such an API), and so there would be no need to define domains explicitly. Still, we would need a possibility to define more than one instance of each app – such as the previously mentioned “Mail Work” and “Mail Personal”.


The app-oriented model seems to be the future. And so seems the Security by Isolation philosophy!
\ No newline at end of file diff --git a/_posts/2011-05-28-untrusting-cloud.html b/_posts/2011-05-28-untrusting-cloud.html deleted file mode 100644 index e738f2c..0000000 --- a/_posts/2011-05-28-untrusting-cloud.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: (Un)Trusting the Cloud -date: '2011-05-28T14:56:00.003+02:00' -author: Joanna Rutkowska -tags: -- cloud -- philosophical -- general -- fighting for a better world -modified_time: '2011-07-24T12:08:31.948+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2297606500415169677 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/05/untrusting-cloud.html ---- - -
Everybody loves The Cloud these days, and it is not hard to understand why. When every person owns computers (devices), the cloud is really hard to beat when it comes to syncing all your digital life back and forth between all those devices, and also sharing with your family members, friends, and colleagues at work. From task lists, through calendars, through health & fitness data, to work-related documents. And I'm not even mentioning all the unencrypted email that is out there.

One doesn't need to be especially smart or security conscious to realize how much this might be a threat to security and privacy. How much easier would it be to attack somebody's laptop if I knew precisely in which hotel and when he or she is planning to stay? How much more expensive would my health and life insurance be, if they could get a look at my health and fitness progress? Etc.

But we're willing to sacrifice our privacy and security in exchange for easy of syncing and sharing of our data. We decide to trust The Cloud. What specifically does that mean?

First, it means we trust the particular cloud-based service vendor, such as the provides of our training monitoring app and service. We trust that this vendor is: 1) non-malicious and ethical, and so is not going to sell our private data to some other entity, e.g. insurance company, and 2) that the software written by this vendor is somehow secure, so it would not be easy for an attacker to break into their cloud service and download all the user's data (and then sell to health insurance companies).

Next, we trust the cloud infrastructure provider, such as Amazon EC2. We trust that the cloud provider is 1) non-malicious and ethical, and that they won't really read the memory of the virtual machine on which the previously mentioned cloud-service is running (and won't make it available to a local government officials, e.g. in China), and 2) that they secured their infrastructure properly (e.g. it wouldn't be easy for one customer to “escape” from a VM and read all the memory of the VMs belonging to other customers).

Finally we trust all the infrastructure that is in the middle between us and the service provider, such as e.g. the networking protocols, are safe to use (e.g. we trust all the engineers working in any of the ISP we use won't sniff/spoof our communication, e.g. by using some fake or quasi-fake SSL certs).

So, that's a hell of a lot of trusting! And the stake is high. Do we really need to make such a sacrifice? Do we really need to hand in all our private data to all those organizations? Of course we don't!

First, notice that in majority of cases, the cloud is only used basically as a on-line storage. No processing, just dump storage. Indeed, what kind of server-side processing does your task list or calender require? Or your freestyle swimming results? Or your conference slides? None.

And we know for very long how to safely keep secrets on untrusted storage, don't we? This is achieved via encryption (and digital signatures for integrity/authenticity). So, the idea is very simple: let's encrypt all the data before we send them to the cloud. The point here is, the encryption must be done by the app that is running on our client device. Not in the cloud, of course.

Ok, so let's say I have my calendar records encrypted in the cloud, how do I share it with my other devices and other people, such as my partner and colleagues at work? Very simple – you encrypt each record with a random symmetric key and then, for every other device or person who you want to grant access to your calendar you make the symmetric key available to this person, by encrypting it with their public key (if you're paranoid, you can even verify fingerprints using some out-band communication channel, such as phone, to ensure the cloud/service provider didn't do MITM attack on you). What if you want to share only some events (or some details) with some group of people (e.g. only your availability info)? Very simple – just encrypt those records you want to share in non-full access with some other symmetric key and publish only this key to those people/devices you want to grant such non-full access.

Implementing the above would require writing new end-user apps, or plugins for existing apps (such as Outlook), so that they do encryption/decryption/signing/verification before sending the data out to the cloud. But what stops the malicious vendor from offering apps that would be leaking out our secrets, e.g. the keys? Well, nothing actually. But this time, the vendor would need to explicitly build in some kind of backdoor into the app. The same could be done with any other vendor, and any other, non-cloud-based app. After all, how do we know that MS Word, which is not cloud-based yet, is not sending out fragments of our texts to Agent Smith? Note how different this is from a situation when the vendor already owns all our data, unencrypted, brought legitimately to their servers, and all they need to do is to read them from their own disks. No need to plant and distribute any backdoors!

In practice few vendors would be risking their reputation and would be willing to build in a backdoor into an app that is then made available to customers. Because every backdoor in such client-exposed code will sooner or later be found (You would really not believe what great lengths all those young people aimed with disassembler and debugger would go to, to win an economy class ticket to the middle of desert in the hottest summer season, just to be able to deliver a presentation on how evil/stupid a company X is ;).

One problem is, however, with accessing our encrypted cloud over a Web Browser. In contrast to apps, the web browser content is much less identifiable. An app can have a digital signature – everybody know its an App v 1.1, published by X. As explained above it would be rather stupid for X to plant a backdoor into such an app. But a Web-delivered Javascript is much more tentative, and it's very possible for X to e.g. deliver various versions of scripts to different customers. Digital signature on client-side scripts, paired with ability to whitelist allowed client-side-scripts, would likely solve this problem.

So, why we still haven't got client-side-encrypted cloud-services? The question is rhetorical, of course. Most vendors actually loves the idea of having unlimited access to their customers data. Do you think Google would be happy to give up an opportunity to data mine all your data? This might affect their ad business, health research, or just Secret Plan To 0wn The World. After our dead body, I can almost hear them yelling! After all they have just came up with Chrome OS to bring even more data into their data mining machine...

To sum it up, there is no technical reason we must entrust all those people with our most private data. Sooner or later somebody will start selling client-side-encrypted cloud services, and I would be the first person to sign up for it. Hopefully it will happen sooner than later (to late?).

This post also hopefully shows, again, one more aspect – that we can, relatively easy, move most of the IT infrastructure out of the “TCB” (Trusted Computing Base, used as metaphor here). In other words, we can design our systems and services so that we don't need to trust a whole lot of things, including servers and the networking infrastructure (except for its reliability, but not for its security). But, there always remains one element that we must trust – these are our client devices. If they are compromised, the attacker can steal everything.

Strangely most people still don't get it, or get it backwards. Just the fact that “information is not stored on the iPad but kept safe on the corporate network”, doesn't change anything! Really. If the attacker owns your iPad, then she also can do anything that the legitimate user could do from this iPad. So if you could get to the company's secret trade data from your iPad's Receiver, so would be able to do the malware/attacker.
\ No newline at end of file diff --git a/_posts/2011-06-01-usb-security-challenges.html b/_posts/2011-06-01-usb-security-challenges.html deleted file mode 100644 index 3eb31f0..0000000 --- a/_posts/2011-06-01-usb-security-challenges.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: USB Security Challenges -date: '2011-06-01T01:25:00.001+02:00' -author: Joanna Rutkowska -tags: -- os security -- challanges -- secure architecture -- usb -- qubes -modified_time: '2011-07-24T12:08:42.903+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8736093765434856111 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/06/usb-security-challenges.html ---- - -
When we think about “USB Security” there are lots of things that come to mind...

First there are all the physical attacks that could be conducted with the help of USB devices. These are generally not so interesting, because if one includes physical attacks in the threat model, then it really opens up lots of possibilities of various attacks, and generally a physical attacker always wins. Still, there are a few very cheap and easy physical attacks that one would like to avoid, or make harder, such as the Evil Maid Attacks or the Cold Boot Attacks. Strictly speaking these are not problems inherent to USB itself, but rather with lack of Trusted Boot, or OS not cleaning properly secrets from memory upon shutdown. They are just made simple thanks to bootable USB sticks.

Much more interesting USB-related physical attacks are those that take advantage of the specifics of the USB standard. One example here would be a malicious USB device that exposes intentionally malformed info about itself in order to exploit a potential flaw in a USB Host Controller driver that processes this info upon each new USB device connect. Or a malicious USB device that would trick the OS (Windows at least) into downloading a known buggy USB driver (or even an intentionally malicious driver, legally submitted to WHQL by the attacker) and then exploit the driver.

Another class of physical attacks made possible by the USB specification are malicious USB devices that pretend to be a keyboard or mouse. The input devices, such as keyboard, are actually the most security sensitive devices, because an attacker who controls the keyboard can do everything the user can do, which basically means: can do everything, at least with regards to the user's data.

Finally, the USB, as the names stands, is a bus interconnect, which means all the USB devices sharing the same USB controller are capable of sniffing and spoofing signals on the bus. This is one of the key differences between USB and PCI Express standards, where the latter uses a peer-to-peer interconnect architecture.

Ok, so these all above were physical attacks. Let's now look at, much more fatal, software attacks.

The infamous class of attacks exploiting various autorun or auto-preview behaviors is the most known example, but also the easiest, at least in theory, to protect against.

Much more interesting are software attacks that attempt to exploit potential flaws in the USB stacks – similarly like the physical attacks mentioned above, just that this time not requiring any hardware-level modifications to the USB device. Exposing a malformed partition table is a great example of such an attack. Even if we have all the autorun mechanisms disabled, still, when we're inserting a storage medium the OS always attempts to parse the partition table in order to e.g. create devices symbolizing each partition/volume (e.g. /dev/sdbX devices).

Now, this is really a problematic attack, because the malformed partition table can be written onto a fully legitimate USB stick by malware. Imagine e.g. you have two physically separated machines (air-gapped), belonging to two different security domains, and you want to transfer files from one to another. You insert the USB stick into the first machine, copy files, and then insert the stick to the second machine. If the first machine was compromised, it could have altered the partition table on the USB stick, and now when this stick is inserted into the other machine its malformed partition table might exploit a buffer overflow in the code used by the second OS to parse the stick's partition information. Air-gapped systems, huh? We avoid this attack vector in Qubes by using a special inter-domain file copy mechanism that doesn't require any metadata parsing.

A variation of the above attack would be to expose a malicious file system metadata, but this time the target OS would have to actually mount the partition for the attack to work (and, of course, there would have to be bugs in the OS file system parsing code, although these  seem to be quite common on most OSes).

Having quickly summarized the USB security-related threats, let's now think about how we could design an OS to mitigate most of those attacks, and at the very least the software-based attacks. This is, in fact, precisely the challenge we've been facing in Qubes, so the divagations below necessarily focus mostly on the Qubes architecture.

First we should realize that USB devices, unlike PCI Express devices, cannot be independently delegated to different domains (VMs). This is because IOMMU technologies, such as Intel VT-d, operate only on PCIe device granularity. This means we can only delegate a whole USB controller to a domain, including all of the USB devices connected to this controller/hub.

Imagine now two internal devices, both connected via internal USB bus: a keyboard, and a 3G wireless modem. Chances are high that you will have those two devices connected to the same USB controller – usually one controller is used for all the internal devices, like those I just mentioned, plus camera, fingerprint reader, etc, and the other controller is used for all the externally visible USB connectors (at least this is true for modern systems: Intel Series 5 chipsets and newer).

We would like to be able to delegate the 3G modem to the NetVM (an untrusted domain on Qubes where all the networking drivers and stacks are kept; it's considered untrusted because its compromise is equivalent to a compromise of a WiFi network or home router, or some other router, and any reasonable person always assumes that the network is compromised, and deals with that using crypto, such as SSL or SSH). But assigning the USB controller, to which the 3G modem is connected to, to the NetVM, would also assign the USB keyboard to the NetVM! And this is precisely what we don't want to do, because control over the keyboard is equivalent to the control over the whole system!

Currently, in Qubes Beta 1, we keep all the USB controllers assigned to Dom0. This, however, causes two annoyances:

First, the user cannot use any of the USB-connected networking devices, such as 3G modems (because there is no networking in Dom0).

Second, if somebody connects a USB disk and later delegates it to some domain (this could easily be done via block-attach mechanism, supported by the same backend that handles storage virtualization for domains), and this domain turns out to be compromised, it might alter e.g. the stick's partition table and later attack Dom0 as explained above.

We can eliminate the second problem by modifying the Dom0's kernel to not parse the partition table of any removable devices automatically, and instead expect some kind of explicit consent from user to actually do that (we still must allow to mount USB disks in Dom0 to allow easy backups of all domains at once).

To allow the use of USB-connected networking devices in NetVM, we could use a PVUSB backend that can virtualize single USB devices without moving the whole USB controller to the domain. But that would require introducing a whole lot of new code to Dom0 – code that would be directly reachable from VMs (in other words that would be processing lots of untrusted input coming from untrusted domains).

So another option is to delegate all the non-security-critical USB controllers, i.e. those controllers that don't have any security-sensitive USB devices connected, such as keyboard, to a dedicated “USB” domain, and later share the USB devices via PVUSB backend from this USB domain. This time, the extra PVUSB backend runs in the USB domain, not in Dom0, so we don't worry that much about potential bugs in this backend. Of course, this way you cannot delegate the USB controller to which the keyboard, and potentially also other security-critical devices, such as camera, are connected to, which in practice rules out the integrated3G modem. Fortunately many modern laptops do not use USB-connected keyboard and touchpad (they use PS/2-connected keyboards instead), and the face camera can be easily disabled with a piece of sticker (although that sucks, because it means we cannot really use the camera).

With this approach (a dedicated USB domain) you can now delegate your 3G modem to the NetVM, and other USB devices, such as removable disks to other domains, e.g. for file exchange. This seems the most reasonable setup, although it requires that either 1) your laptop doesn't have USB-connected keyboard, or 2) you don't use internal USB devices connected to the same controller that your USB keyboard/touchpad from other domains than Dom0 (in practice: no 3G modem in NetVM).

As we can see proper handling of USB devices is quite a challenge for OS architects. It might have been much less of a challenge if the engineers designing the USB, chipsets, and motherboards were a bit more security-conscious. Even such simple practice as never mixing security critical devices (keyboard, touchpad, camera, fingerprint reader), with non-security ones (3G modem), onto the same USB controller, would help tremendously. Or ability to somehow dynamically configure their connectivity, e.g. in BIOS?
\ No newline at end of file diff --git a/_posts/2011-06-03-from-slides-to-silicon-in-3-years.html b/_posts/2011-06-03-from-slides-to-silicon-in-3-years.html deleted file mode 100644 index af87804..0000000 --- a/_posts/2011-06-03-from-slides-to-silicon-in-3-years.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: From Slides to Silicon in 3 years! -date: '2011-06-03T17:16:00.003+02:00' -author: Joanna Rutkowska -tags: -- general -- fighting for a better world -modified_time: '2011-07-24T12:08:54.874+02:00' -thumbnail: http://2.bp.blogspot.com/-UUqClGOWD3w/Tej5DuLF_GI/AAAAAAAAAIE/qBrKYYHJi8M/s72-c/slide97 -blogger_id: tag:blogger.com,1999:blog-24586388.post-3206816702689101078 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/06/from-slides-to-silicon-in-3-years.html ---- - -
Remember our Xen 0wning Trilogy at Black Hat in summer 2008, specifically the presentation on Detecting & Preventing the Xen Hypervisor Subversions?

One of the things we were discussing there was a proposal to include an additional restriction to Intel processors that would disallow execution of usermode pages from within supervisor mode (ring0). Such a feature, we argued, apart from obviously making many ring3-to-ring0 exploits much harder, including the very Xen heap overflow exploit we presented in the slides, would also bring us closer to efficient runtime code integrity checkers for kernels and hypervisors, as discussed in the slides.


Slide #97, Detecting and Preventing Xen Hypervisor Subversions, Black Hat USA, July, 2008

Fast forward 3 years. On June 1st, 2011, an Intel engineer is submitting a patch for Xen to support a mysterious new processor feature called SMEP (Supervisor Mode Execution Protection). He writes the feature is not yet documented in SDM, but soon will be. In fact, the May 2011 update of Intel SDM already contains the details:

Intel SDM, vol. 3a, May 2011, source: intel.com

Some other people spotted this feature earlier, because of another patch submitted by another Intel engineer to Linux kernel a few weeks ago. Here's a good write up by Dan Rosenberg discussing how this patch makes writing Linux kernel exploits harder, and how it's still possible to write them.

The SMEP feature still doesn't seem to be present in the processors available on the market, including the latest Sand Bridge processors, but there's no question it's coming, now that the feature made it into SDM.

It is quite rewarding to see your idea implemented in a processor... I guess this is how physicists feel when they introduce a new particle as part of a new quantum model, and later discover evidences to support the existence of this very particle in the wild...
\ No newline at end of file diff --git a/_posts/2011-06-10-my-sstic-2011-slides.html b/_posts/2011-06-10-my-sstic-2011-slides.html deleted file mode 100644 index fd9a757..0000000 --- a/_posts/2011-06-10-my-sstic-2011-slides.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: My SSTIC 2011 slides -date: '2011-06-10T15:02:00.002+02:00' -author: Joanna Rutkowska -tags: -- conferences -modified_time: '2011-07-24T12:09:17.985+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7155368799305734593 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/06/my-sstic-2011-slides.html ---- - -A few days ago I had a privilege to give an opening keynote at the SSTIC conference in Rennes, France, which is believed by many to be the most important security conference in France. You can find my slides here.

SSTIC seems to be a very interesting conference indeed, with a strong emphasis on system-level security, which is quite unusual these days where most conferences focus on networking, apps, and web-apps. What a pity all those interestingly-looking talks have been encoded in an obscure language used only by some 3% of the population of the planet...

Anyway, it was a pleasure to talk to some ANSSI people I met before the conference (one of the organizers of the event) who really seemed to understand well the challenges we face with building secure operating systems, and generally seemed well versed in the topic. Perhaps some other nations should learn from France, instead of proposing ridiculous and superficial means that can't really solve any real problem. \ No newline at end of file diff --git a/_posts/2011-08-30-interview-about-qubes-os.html b/_posts/2011-08-30-interview-about-qubes-os.html deleted file mode 100644 index d0b58c8..0000000 --- a/_posts/2011-08-30-interview-about-qubes-os.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Interview about Qubes OS -date: '2011-08-30T23:06:00.001+02:00' -author: Joanna Rutkowska -tags: -- general -- qubes -modified_time: '2011-09-28T16:37:08.233+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6490495664553004297 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/08/interview-about-qubes-os.html ---- - -Here is a recent interview with me for Tom's Hardware, where I talk about Qubes, why virtualization alone does not automatically bring much security, and why we need it for secure systems anyway, and all that kind of stuff. Nothing really new, but still might be of interest to some readers.

As for Qubes Beta 2 release -- it really is coming, but we've faced recently some very nasty, race-condition-related problems with new Xen (we bravely switched to Xen 4.1 in Beta 2) that seem to occur on machines with very fast SSDs and we're currently trying to see if we can solve them, or should we instead revert back to Xen 3.4 that we used previously in Beta 1. Except for that, Beta 2 is mostly ready, so we should be releasing it within coming weeks. \ No newline at end of file diff --git a/_posts/2011-09-07-anti-evil-maid.html b/_posts/2011-09-07-anti-evil-maid.html deleted file mode 100644 index bdbe54c..0000000 --- a/_posts/2011-09-07-anti-evil-maid.html +++ /dev/null @@ -1,17 +0,0 @@ ---- -layout: post -title: Anti Evil Maid -date: '2011-09-07T23:56:00.004+02:00' -author: Joanna Rutkowska -tags: -- saving-the-world-afterhours -- disk encryption -- tpm -- trusted execution technology -- trusted computing -modified_time: '2012-03-28T11:09:32.908+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-5170759851138703204 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/09/anti-evil-maid.html ---- - -
Anti Evil Maid is an implementation of a TPM-based static trusted boot with a primary goal to prevent Evil Maid attacks.

The adjective trusted, in trusted boot, means that the goal of the mechanism is to somehow attest to a user that only desired (trusted) components have been loaded and executed during the system boot. It's a common mistake to confuse it with what is sometimes called secure boot, whose purpure is to prevent any unauthorized component from executing. Secure boot is problematic to implement in practice, because there must be a way to tell which components are authorized for execution. This might be done using digital signatures and some kind of CA infrastructure, but this gets us into problems such as who should run the CA, what should be the policy for issuing certificates, etc.

The adjective static means that the whole chain of trust is anchored in a special code that executes before all other code on the platform, and which is kept in a non re-flashable memory, whose sole purpure is to make the initial measurement of the next component that is going to be executed, which is the BIOS code. This special code, also known as Core Root of Trust for Measurement (CRTM), might be part of the BIOS (but kept on a special read-only memory, or implemented by some other entity that executes before the BIOS reset vector, such as e.g. Intel ME or the processor microcode even. Once measured, the BIOS code is executed, and it is now its turn to measures the platform configuration, Option ROM code, and MBR. Then the loader (stored in the MBR), such as Trusted GRUB, takes over and measures its own next stages (other than the MBR sector), and the hypervisor, kernel, and initramfs images that are to be loaded, together with their configuration (e.g. kernel arguments).

As explained above, trusted boot can only retrospectively tell the user whether correct (trusted) software has booted or not, but cannot prevent any software from executing. But how can it communicate anything reliably to the user, if it might have just been compromised? This is possible thanks to the TPM unseal operation that releases secrets to software only if correct software has booted (as indicated by correct hashes in select PCR registers).

So the idea is that if a user can see correct secret message (or perhaps a photo) being displayed on the screen, then it means that correct software must have booted, or otherwise the TPM would not release (unseal) the secret. Of course we assume the adversary had no other way to sniff this secret and couldn't simply hardcode it into the Evil Maid – more on this later.

Another way to look at it is to realize that Anti Evil Maid is all about authenticating machine to the user, as opposed to the usual case of authenticating the user to the machine/OS (login and password, decryption key, token, etc). We proceed with booting the machine and entering sensitive information, only after we get confidence it is still our trusted machine and not some compromised one.

Installing Anti Evil Maid

Anti Evil Maid should work for any Linux system that uses dracut/initramfs, which includes Qubes, Fedora and probably many other distros. You can find the Anti Evil Maid source code in a git repository here. You can also download a tarball with sources and prebuilt rpm packages from here (they all should be signed with the Qubes signing key). Qubes Beta 2, that is coming soon, will have those RPMs already per-installed.

To install Anti Evil Maid, follow the instructions in the README file.

Some Practical considerations

If you decided to use no password for your TPM SRK key (so, you passed '-z' to tpm_takeownership, see the README), then you should definitely install Anti Evil Maid on a removable USB stick. Otherwise, if you installed it on your disk boot partition, the attacker would be able to just boot your computer and note down the secret passphrase that will be displayed on the screen. Then the attacker can compromise your BIOS/MBR/kernel images however she likes, and just hardcode the secret passphrase to make it look like if your system was fine.

If you decided to use custom TPM SRK password (so, you did not pass -z to tpm_takeownership), then you can install Anti Evil Maid onto your regular boot partition. The attacker would not be able to see your secret passphrase without knowing the SRK password. Now, the attacker can try another Evil Maid attack to steal this password, but this attack is easy to spot and prevent (see the discussion in the next section).

However, there is still a good argument to install Anti Evil Maid on a separate USB stick rather than on your built-in disk boot partition. This is because you can use Anti Evil Maid as a provider of a keyfile to your LUKS disk encryption (as an additional file unsealable by the TPM). This way you could also stop adversary that is able to sniff your keystrokes (e.g. using hidden camera, or electromagnetic leak), and capture your disk decryption passphrase (see the discussion in the next section).

In any case it probably would be a good idea to make a backup stick that you might want to use in case you lose or somehow damage your primary stick. In that case you should have a way to figure out if your system has been compromised in the meantime or not. Use another stick, with another passphrase, and keep it in a vault for this occasion.

Finally, be aware that, depending on which PCRs you decided to seal your secrets to, you might be unable to see the secret even after you changed some minor thing in your BIOS config, such as e.g. the order of boot devices. Every time you change something in your system that affects the boot process, you would need to reseal your secrets to new PCR values as described in the installation instructions.

Attacks prevented by Anti Evil Maid

The classic Evil Maid attack is fully prevented.

If the attacker is able to steal your Anti Evil Maid stick, and the attacker gets access to your computer, then the attacker would be able to learn your secret passphrase by just booting from the stolen stick. This is not fatal, because user should get alarmed seeing that the stick has been stolen, and use the backup stick to verify the system (with a different secret messages, of course), and later create a new stick for every day use with a new secret message.

A variation of the above attack is when the attacker silently copies the content of the stick, so that the user cannot realize that someone got access to the stick. Attacker then uses the copied stick to boot the user's computer and this way can learn the secret passphrase. Now, the attacker can infect the computer with Evil Maid, and can also bypass Anti Evil Maid verification by just hardcoding the secret message into Evil Maid. So, even though TPM would know that incorrect software has booted, and even though it would not unseal the secret, the user would have no way of knowing this (as the secret would still be displayed on screen).

In order to protect against this attack, one might want to use a non-default SRK password – see the installation instructions. Now an extra SRK password would be needed to unseal any secret from the TPM (in addition to PCRs being correct). So the attacker, who doesn't know the SRK password, is now not able to see the secret message and cannot prepare the Evil Maid Attack (doesn't know what secret passphrase to hardcode there).

The attacker might want to perform an additional Evil Maid attack targeted at capturing this SRK password, e.g. by infecting the user's stick. This, however, could be immediately detected by the user, because the user would see that after entering the correct SRK password, there was no correct secret passphrase displayed. The user should then assume the stick got compromised together with the SRK password, and should start the machine from the backup stick, verify that the backup secret is correct, and then create new AEM stick for daily usage.

If an attacker is able to capture the user's keystrokes (hidden camera, electromagnetic leaks), the attacker doesn't need Evil Maid attack anymore, and so doesn't need to bother with compromising the system boot anymore. This is because the attacker can just sniff the disk decryption password, and then steal the laptop and will get full access to all user data.

In order to prevent such a “keystroke sniffing” attack, one can use an additional sealed secret on the Anti Evil Maid stick that would be used as a keyfile for LUKS (in addition to passphrase). In this case the knowledge of the sniffed LUKS passphrase would not be enough for the attacker to decrypt the disk. This has not been implemented, although would be a simple modification to dracut-antievilmaid module. If you decided to use this approach, don't forget to also create a backup passphrase that doesn't need a keyfile, so that you don't lock yourself from access to your data in case you lose your stick, or upgrade your BIOS, or something! You have been warned, anyway.

Attacks that are still possible

An adversary that is able to both: sniff your keystrokes (hidden camera, electromagnetic leak) and is also able to copy/steal/seize your Anti Evil Maid stick, can not be stopped. If a non-democratic government is your adversary, perhaps because you're a freedom fighter in one of those dark countries, then you likely cannot ignore this type of attacks. The only thing you can do, I think, is to use some kind of easy-to-destroy USB stick for keeping Anti Evil Maid. A digestible USB stick, anyone?

Another type of attack that is not addressed by Anti Evil Maid is an attack that works by removing the “gears” from your laptop (the motherboard and disk at the very least), putting there a fake board with a transmitter that connects back to the attacker's system via some radio link and proxies all the keyboard/screen events and USB ports back to the original “gears” that execute now under supervision of the attacker. Another way of thinking about this attack is as if we took the motherboard and disk away, but kept all the cables connecting them with the laptop's keyboard, screen, and other ports, such as USB (yes, very long cables). The attacker then waits until the user boots the machine, passes the machine-to-user authentications (however sophisticated it was), and finally enters the disk decryption key. In practice I wouldn't worry that much about such an attack, but just mentioning it here for completeness.

Finally, if our adversary is able to extract secret keys from the TPM somehow, e.g. using electron microscope, or via some secret backdoor in the TPM, or alternatively is able to install some hardware device on the motherboard that would be performing TPM reset without resetting the platform, then such an attacker would be able to install Evil Maid program and avoid its detection by SRTM. Still, this doesn't automatically give access to the user data, as the attacker would need to obtain the decryption key first (e.g. using Evil Maid attack).

Implementation Specific Attacks

In the discussion above we assumed that the trusted boot has been correctly implemented. This might not be true, especially in case of the BIOS. In that case we would be talking about attacks against a particular implementation of your BIOS (or TrustedGRUB), and not against Anti Evil Maid approach.

One typical problem might be related to how CRTM is implemented – if it is kept in a regular BIOS reflashable memory, than the attacker who can find a way to reflash the BIOS (which might be trivial in case your BIOS doesn't check digital signatures on updates) would be able to install Evil Maid in the BIOS but pretend that all hashes are correct, because the attacker controls the root of trust.

Another possible implementation problem might be similar to the attack we used some years ago to reflash a secure Intel BIOS (that verified digital signatures on updates) by presenting a malformed input to the BIOS that caused a buffer overflow and allowed to execute arbitrary code within the BIOS. For such an attack to work, however, the BIOS should not measure the input that is used as an attack vector. I think this was the situation with the logo picture that was used in our attack. Otherwise, even if there was a buffer overflow, the chain of trust would be broken and thus the attack detected. In other words, the possibility of such an attack seems to be rather slim in practice.

What about Intel TXT?

Intel TXT takes an alternative approach to trusted boot. It relies on a Dynamic instead of Static Root of Trust for Measurement (DRTM vs. SRTM), which is implemented by the SENTER instruction and special dynamic PCR registers that can be set to zero only by SENTER. Intel TXT doesn't rely anymore on the BIOS or CRTM. This offers a huge advantage that one doesn't need to trust the BIOS, nor the boot loader, and yet can still perform a trusted boot. Amazing, huh?

Unfortunately, this amazing property doesn't hold in practice. As we have demonstrated almost 3 years ago (!), it is not really true that Intel TXT can remove the BIOS away from the chain of trust. This is because Intel TXT is prone to attacks through a compromised SMM, and anybody who managed to compromise the BIOS would be trivially able to also compromise the SMM (because it is the BIOS that is supposed to provide the SMI handler).

Thus, if one compares SRTM with Intel TXT, then the conclusion is that Intel TXT cannot be more secure than SRTM. This is because if an attacker can compromise the BIOS, then the attacker can also bypass Intel TXT (via a SMM attack). On the other hand, a BIOS compromise alone doesn't automatically allow to bypass SRTM, as it has been discussed in a paragraph above.

It really is a pity, because otherwise Intel TXT would be just a great technology. Shame on you Intel, really!

Alternative approaches to mitigate Evil Maid Attacks

Various people suggested other methods to prevent Evil Maid attacks, so lets quickly recap and discuss some of them...

The most straight forward approach suggested by most people, has been to disable booting from external devices in BIOS, together with locking the BIOS setup with an admin password.

There are two problems with such an approach. First, all the BIOSes have a long history of so called default passwords (AKA maintenance passwords). You don't want to rely on the lack of BIOS default passwords when protecting your sensitive data, do you?

Second, even if your BIOS doesn't have a backdoor (maintenance password), it is still possible to just take your disk away and connect to another laptop and infect its boot partition.

Another suggested approach has been to keep your boot partition on a separate USB stick. This solution obviously doesn't take into account the fact that the attacker might install Evil Maid into your BIOS. Many consumer laptop BIOSes do not require digital signatures on BIOS firmware updates (my Sony Vaio Z, a rather high-end machine, is among them), making it simple to install Evil Maid there (the most trivial attack is to make the BIOS always boot from the HDD instead of whatever other device the user wanted to boot from).

Finally, some people pointed out that many modern laptops comes with SATA disks that offer ability to “lock” the disk so that it could only be used with a specific SATA controller. Using this, combined with setting your BIOS to only boot from your internal disk, plus locking access to BIOS setup, should provide reasonable protection. This solution, of course, doesn't solve the problem of a potential maintenance password in your BIOS. Also being skeptical and paranoid as I am, I would not trust this mechanism to be really robust – I would expect it would be fairly simple to unlock the disk so that it could be paired with another, unauthorized controller, and that this probably is a matter of NOP-ing a few instructions in the controller firmware... In fact it seems like you can buy software to unlock this mechanism for some $50... And apparently (and not very surprisingly) some drives seems to continue on the 'default passwords' tradition.

FAQ 

Q: Bitlocker implemented this already several years ago, right?
A: No.

Q: But, two-factor authentication can also be used to prevent Evil Maid, right?
A: No.

Q: Does it make any sense to use Anti Evil Maid without a full disk encryption?
A: No.

Q: Are you going to answer 'no' for each question I ask?
A: No.

Q: Why there are no negative indicators (e.g. a big scary warning) when the unseal process fails?
A: The lack of negative indicators is intentional. The user should keep in mind that if somebody compromised their computer, then the attacker would be able to display whatever she wants on the screen, and especially to skip displaying of any warning messages. The only thing the attacker would not be able to display would be the secret message. Thus, it would make no sense to use negative indicators, as they would likely not work in case of a real attack. One solution here would be to use the unsealed secret as a keyfile for disk encryption (as discussed above), which would make it impossible to decrypt the user disk (and so generally proceed with the boot) without successfully unsealing the secret from the TPM. \ No newline at end of file diff --git a/_posts/2011-09-19-qubes-beta-2-released.html b/_posts/2011-09-19-qubes-beta-2-released.html deleted file mode 100644 index ef4c3e2..0000000 --- a/_posts/2011-09-19-qubes-beta-2-released.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes Beta 2 Released! -date: '2011-09-19T12:52:00.000+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2012-03-28T11:09:04.941+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8898720712342300501 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/09/qubes-beta-2-released.html ---- - -I'm proud to announce that we have just released Qubes Beta 2! You can view installation instructions and download the ISO here.

We faced quite a few serious problems with this release that were caused by an upgrade to Xen 4.1 (from Xen 3.4) that we used in Beta 1. But finally we managed to solve all those problems and all in all I'm very happy with this release. It includes many performance optimizations compared to Beta 1 (CPU- and memory-wise) and also many bugfixes.

We also introduced a couple of new features:
  • Generic mechanism for inter-domain services with a centralized policy enforcement (more)
  • Network-less update mechanism for Dom0 (more)
  • VM management improvements: easy device assignment for driver domains, dynamic netvm switching, flexible VM kernel configuration, etc (see the new qvm-prefs utility)
  • Easy management of appmenus (shortcuts in the Start Menu)
  • Update to Xen 4.1 that offers, among other things, better VT-d support and more lightweight management stack (we have ported Qubes to use the new xl now, instead of the slow and heavy xend), and also to 2.6.38-xenlinux kernel for Dom0, and to 3.0.4 pvops kernel for VMs (better hardware compatibility, better power management)
I will write some more posts shortly that would present in detail some of the new features and what cool things one could do with them.

We have also created a dedicated wiki page that enumerates all the security-critical code for Qubes OS. We hope this page would be useful for security researchers that might attempt to find weaknesses in Qubes OS either in our code or in the 3rd party code that we rely on (Xen hypervisor, select Xen backends). Whether your motives are noble (gaining immortal fame, helping create a secure client OS), or not (proving ITL wrong), we would appreciate your efforts! And you might even get a job at ITL.

Speaking of which, I'm happy to announce that Marek Marczykowski, who has effectively become the key Qubes developer over the past few months, has now officially joined ITL :) \ No newline at end of file diff --git a/_posts/2011-09-28-playing-with-qubes-networking-for-fun.html b/_posts/2011-09-28-playing-with-qubes-networking-for-fun.html deleted file mode 100644 index 2eb4b51..0000000 --- a/_posts/2011-09-28-playing-with-qubes-networking-for-fun.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Playing with Qubes Networking for Fun and Profit -date: '2011-09-28T16:36:00.002+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2013-02-21T15:48:49.775+01:00' -thumbnail: http://3.bp.blogspot.com/-HGvCszJ422w/ToMeJm16CMI/AAAAAAAAAJA/CdX1Y-Ct_uc/s72-c/qubes-default-net-config.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-2682693250711953422 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/09/playing-with-qubes-networking-for-fun.html ---- - -Today, I would like to showcase some of the cool things that one can do with the Qubes networking infrastructure, specifically with all the new features that have been brought by the just released Qubes Beta 2. This will cover the use of multiple Net VMs for creating isolated networks, the use of a Proxy VM for creating a transparent Tor Proxy VM, as well as demonstration of how to use a Standalone VM with manually assigned devices, to create a “WiFi pen-testing” VM, which surely represents the “for fun” aspect of this post.

Qubes Networking Intro

From the networking point of view there are three types of VMs in Qubes:

  • Net VMs, that have networking devices assigned to them, such as e.g. a WiFi or Ethernet card. Each Net VM contains a Xen network backend that is used to provide networking to all VMs that are connected to this Net VM.
  • Regular VMs (AppVMs) that use the networking provided by Net VMs (so they have Xen network frontends that provide virtual interfaces that are backed by the backend in the corresponding Net VM.
  • Proxy VMs that combine both of the above: to Net VMs they look like regular AppVMs, because they are consumers of the networking they provide, but to other AppVMs they act as if they were Net VMs themselves, allowing other VMs to connect to them. Of course the Proxy VMs do not have directly assigned networking devices – they use the networking provided by the Net VM that they connect to. One can chain many Proxy VMs, as we will see below.

The virtual interfaces in client VMs are called ethX, and are provided by the xen_netfront kernel module, and the corresponding interfaces in the Net/Proxy VM are called vifX.Y and are created by the xen_netback module.

Each Net and Proxy VM implements NAT, specifically masquerading, for all the connected VMs. Additionally to this SNAT, each Net or Proxy VM provides also DNAT redirection for DNS resolutions, so that each VM behind a Proxy or Net VM thinks that it uses a DNS in the Net/Proxy VM, but in fact all the DNS request are DNAT-ed by all the Proxy and Net VMs down the original DNS that is provided to the final Net VM. This smart trick allows us to avoid running a DNS caching server in Proxy/Net VMs.

Also, any VM-to-VM traffic, among the VMs connected to the same Net/Proxy VM is blocked by default.

Additionally, each Proxy VM enforces system-wide firewaling rules, specifically the rules for all the directly connected VMs. Those firewalling rules are centrally managed in Dom0 and exposed to each Proxy VM through Xen store. One useful application of this firewalling mechanism is to limit certain VMs to only specific type of white-listed traffic to minimize likelihood of user mistakes. A good example could be a work VM that might be limited to network connectivity only with the select corporate servers and denied all other traffic. This way, when the user receives an email message with an embedded http link (possibly leading to a malicious website) and accidentally clicks on it, nothing wrong happens.

The current infrastructure doesn't support IPv6 routing, but we will likely add this support in the upcoming Beta 3.

The default networking topology in Qubes OS

When you proceed with the default installation of Qubes Beta 2, then your initial networking topology looks like on the diagram below:
The default network configuration in Qubes.
So, by default there is one Net VM, called 'netvm', that is automatically assigned all the networking devices in the system. There is also one Proxy VM, called 'firewallvm' that is directly connected to the default Net VM, and which provides networking to all other VMs in the system. This Proxy VM is used for firewall rules enforcement. Each such service VM consumes 200MB of RAM by default.

Network-isolated VMs

For some VMs it might be desirable to completely disconnect them from any kind of networking access. This can be easy done using the following command (issued from Dom0's konsole):

[dom0]$ qvm-prefs -s netvm none

For example I have a 'vault' VM that I use for keeping my master PGP keys, and other secrets, and this machine is not connected to any network.

Using multiple Net VMs for physically isolated networks 

In some scenarios the machine might be connected to two or more physically separate networks (e.g. safe corporate intranet, reachable via ethernet cable on the user's desk, and the unsafe and evil Internet, reachable via WiFi card).

It is easy to use more than one Net VMs in Qubes, and assign different networking devices to different Net VMs, and also decide which VMs are connected to which Net VMs. The diagram below presents an exemplary such setup:
A simple setup with two isolated networks, and one fully isolated domain ('vault').
 
We could created such a setup using the following commands (issued in Dom0):

[dom0]$ qvm-create netvm1 --net --label red
[dom0]$ qvm-create netvm2 --net --label yellow

Currently qvm-create when used with the --net option automatically assigns all networking devices to the just created VM, so in the example above you would want to remove extra devices from each Net VM using qvm-pci -d, leaving only those you really want, e.g.: 

[dom0]$ qvm-pci -l netvm1 # to get a list of currently assigned devices

[dom0]$ qvm-pci -d netvm1 02:00.0

Now we should create the Firewall VMs:

[dom0]$ qvm-create firewallvm1 --proxy --label green
[dom0]$ qvm-create firewallvm2 --proxy --label green

... and connect them to proper Net VMs:

[dom0]$ qvm-prefs -s firewallvm1 netvm netvm1
[dom0]$ qvm-prefs -s firewallvm2 netvm netvm2

And now, for any other VM, just set the appropriate Net VM (either firewallvm1 or firewallvm2, or 'none), to get it assigned to either of the isolated networks, e.g.:

[dom0]$ qvm-prefs -s banking netvm firewallvm1
[dom0]$ qvm-prefs -s xfiles netvm firewallvm2
[dom0]$ qvm-prefs -s vault netvm none
...

This configuration provides very strong isolation between the VMs belonging to network #1, and the VMs belonging to network #2. Specifically, this becomes significant if we fear about potential remotely exploitable bugs in the client code of the core TCP/IP stack (in this case the Net VM could potentially compromise all the connected VMs -- but the same problem applies to even physically separated machines that use the same network).

Setting up Tor Proxy using a Proxy VM

Let's now play a bit with Proxy VMs and see how we can use it to create a simple Tor proxy VM. Such a VM would provide anonymized networking to all its clients, so would allow to easily create VMs for anonymous Internet access. The simple setup we would like to prepare is depicted on the figure below:

The 'torvm' Proxy VM provides anonymized networking to 'anon-web' and 'anon-bitcoin' VMs. All the traffic generated by the VMs behind 'torvm' is either fed into the Tor network, or discarded. Furthermore, any app running in those VMs is not able to read any global system identifiers, such as the external IP, external MAC address, etc.

Our Tor proxy would forward only the Tor traffic, so we don't have to fear about some Tor-not-aware applications, or even intentionally malicious ones to compromise the privacy of our connection. This is because such applications have no way to generate traffic to the outside world without going through our Tor proxy (unless they could exploit a hypothetical vulnerability in the Tor process running in the Tor VM). Also, the applications running in any VM behind the Tor proxy are not able to determine any globally identifiable IDs, such as the user's external IP address, the real MAC address used by real NICs, etc.

Interestingly just after writing the above paragraph, I discovered that one of our xenstore keys had wrong permissions and, as a result, any VM could read it and get to know the actual external IP (the key is used by a Net VM to communicate the external IP configuration to the connected Proxy VMs, so they could know when to update the firewall configuration). The fix for this problem is here, and the update (qubes-core-dom0-1.6.32) is now available for Dom0 (just do qvm-dom0-updateto get it installed).

 
So, this represents a rather strong setup for use with Tor. Let's now have a look at how to practically create such a configuration, step by step.

First, let's create the VM that will become our Tor proxy:

[dom0]$ qvm-create torvm --proxy --label green

This will create a Proxy VM named 'torvm', based on the default template. We will need to now start the template VM and install the Tor client there:

[dom0]$ qvm-run -a fedora-14-x64 gnome-terminal

Alternatively, if we didn't trust the Tor client rpm package to be non-malicious, specifically for its installation scripts to be non malicious, we could have based this on a different template, e.g. one used for less trusted VMs, or we could installed the Tor client in /usr/local, that is backed by the VM's private storage, but this would require compiling Tor from sources.

Now, in the just started template VM, lets install the Tor client and (optionally) the Vidalia graphical frontend:

[fedora-14-x64]$ sudo yum install tor vidalia

And then power off the template VM. Now, every VM based on this template, started after the template shutdown, will also see the Tor binary in its filesystem.

Let's now configure our torvm to properly start Tor proxying at boot:

[dom0]$ qvm-run -a torvm gnome-terminal

Now, we will create the following script for starting up the Tor transparent proxy and setting up traffic redirection using iptables:

[torvm]$ vim /rw/config/start_tor_proxy.sh

...and now paste the following into this file:
#!/bin/sh
killall tor
QUBES_IP=$(xenstore-read qubes_ip)
TOR_TRANS_PORT=9040

if [ X$QUBES_IP == X ]; then
echo "Error getting QUBES IP!"
echo "Not starting Tor, but setting the traffic redirection anyway to prevent leaks."
QUBES_IP="127.0.0.1"
else
/usr/bin/tor \
--SocksPort 0 \
--TransListenAddress $QUBES_IP --TransPort $TOR_TRANS_PORT \
--DNSListenAddress $QUBES_IP --DNSPort 53 \
--RunAsDaemon 1 --ControlPort 9051 \
|| echo "Error starting Tor!"

fi

echo “0” > /proc/sys/net/ipv4/ip_forward
/sbin/iptables -t nat -F
/sbin/iptables -t nat -A PREROUTING -i vif+ -p udp --dport 53 -j DNAT --to-destination $QUBES_IP:53
/sbin/iptables -t nat -A PREROUTING -i vif+ -p tcp -j DNAT --to-destination $QUBES_IP:$TOR_TRANS_PORT
/sbin/iptables -I INPUT 1 -i vif+ -p udp --dport 53 -j ACCEPT
/sbin/iptables -I INPUT 2 -i vif+ -p tcp --dport 9040 -j ACCEPT
/sbin/iptables -F FORWARD

echo “1” > /proc/sys/net/ipv4/ip_forward

Except for the “QUBES_IP=$(xenstore-read qubes_ip)” line that reads the torvm's IP address, there is nothing Qubes-specific in the above listing. It's just a standard way of setting up transparent Tor proxy.

It is important that this file be located in the /rwdirectory, as this directory is backed by the VM's private storage and will survive VM reboots. The VM's root file-system is read-only and all the changes to it are lost on VM shutdown (VM gets an illusion of the root fs being writeable thanks to Copy-On-Write mechanism, but the actual COW backing device is cleared upon each VM shutdown).

We should also modify the /rw/config/rc.localscript, to ensure that our Tor proxy is automatically started -- just paste the following into this script:
#!/bin/sh

# Uncomment this if you would like to use a custom torrc file:
#rm -f /rw/config/log
#ln -sf /rw/config/torrc /etc/tor/torrc

chkconfig qubes_netwatcher off
chkconfig qubes_firewall off
/rw/config/start_tor_proxy.sh
Finally we should also provide a script that would restart our proxy in case the user dynamically switched the NetVM, which would result in the completely different routing. This could be done by creating a script with predefined name qubes_ip_change_hookwithin /rw/config/directory:
#!/bin/sh
/rw/config/start_tor_proxy.sh
Make sure that all the scripts are executable (chmod +x). And that's all. Now, shutdown the torvm:

[dom0]$ qvm-run --shutdown --wait torvm

From now on, every time you start the torvm (or when Qubes starts it in response to start of some other VM that uses torvm as its Net VM), the Tor transparent proxy should be automatically started.

Let's test this by creating a VM that would be using the just created Tor proxy:

[dom0]$ qvm-create anon-web --label black
[dom0]$ qvm-prefs -s anon-web netvm torvm

Now, every time you start the anon-web VM (e.g. by clicking on the Web browser icon in the anon-web's start menu), Qubes will also ensure that torvm is up and running, and this in turn would configure all the Tor proxying for this VM.

Fo additional control one might want to use Vidalia, the graphical front end for Tor (this should be installed within the template VM that has been used for torvm). We could easily start Vidalia by just typing:

[dom0]$ qvm-run -a torvm vidalia

We should however make sure to disable "Start the Tor software when vidalia starts" option in Settings/General in Vidalia. Otherwise, Vidalia might kill your original Tor (that has transparent proxy open) and start own without transparent proxy enabled.

The web browser runs in the 'anon-web' VM that uses 'torvm' for networking access, and thus all the traffic generated by 'anon-web' is routed through the Tor network, or discarded if it's a different traffic than TCP or DNS.


Of course one case easily create more VMs that would be using torvm as their Net VM, as so would have anonymized network access. The beauty of this solution is that in case one of my anonymized VM gets compromised, others do not. Plus, the already mentioned benefit, that no matter whether apps in those VMs are buggy, or even intentionally malicious, they would not be able to leak out the user's external IP address.

Creating a WiFi pen-testing VM

Finally let's have some fun and create a WiFi pen-testing VM. The desired config is depicted below:

Because we would like to use all sorts of l33t h4x0r t00lzpen-testing security software in this VM, it would make sense to create it as a Standalone VM, which means that it would get its own copy of the whole file-system (as opposed to just the home directory, /rwand /usr/local, as it is the case with regular Qubes VMs). This would ease the installation of all the extra software we would need there, and also ensure that even if the install/build scripts were malicious, the damages would be contained only to this very VM and nothing else. Also, for some reason the standard Linux WiFi stack and drivers still don't support injection on (all?) most of the WiFi cards out of the box, so we would need to patch the actual kernel drivers -- yet another reason to use a Standalone VM in this case.

So, let's create the VM first, and assign a WiFi card to it:

[dom0]$ qvm-create wififun --standalone --label yellow
[dom0]$ qvm-prefs -s wififun memory 800 # ensure at least this mem at startup
[dom0]$ qvm-prefs -s wififun kernel none # use own copy of kernel and modules
[dom0]$ qvm-pci -a wififun

You can easily find the BDF address of any device using the lspcicommand in Dom0 -- this would be something like e.g. “02:00.0”. You should make sure that this WiFi card is not used by any other VM, specifically by your default Net VM (called 'netvm' in a standard Qubes installation). Ideally you could just use a dedicated Express Card-based WiFi card, leaving the built in WiFi assigned to your default Net VM.

Because it's a Standalone VM, Qubes will make a copy of the whole root filesystem, and thus it would eat about 5GB of your disk (normal VMs would take only as much space as their private fs takes up).

Let's now start the VM...

[dom0]$ qvm-run -a wififun gnome-terminal

... and then install the prerequisite software there, starting with downloading the reasonably new compat-wireless sources, together with the required injection patches, and then building and installing the new kernel modules. All actions below are now executed within the VM. This stuff here is really nothing Qubes- or Xen-specific -- one would do more or less the same on any Linux in order to get injection working (so, treat this as a free bonus WiFi hacking tutorial on Linux).

[wififun]$ wget http://linuxwireless.org/download/compat-wireless-2.6/compat-wireless-2011-07-14.tar.bz2

[wififun]$ wget http://patches.aircrack-ng.org/channel-negative-one-maxim.patch
[wififun]$ wget http://patches.aircrack-ng.org/mac80211-2.6.29-fix-tx-ctl-no-ack-retry-count.patch
[wififun]$ wget http://patches.aircrack-ng.org/mac80211.compat08082009.wl_frag+ack_v1.patch

[wififun]$ sudo yum install kernel-devel patch gcc

[wififun]$ tar xjf compat-wireless-2011-07-14.tar.bz2
[wififun]$ cd compat-wireless-2011-07-14
[wififun]$ patch -p1 < ../channel-negative-one-maxim.patch
[wififun]$ patch -p1 < ../mac80211-2.6.29-fix-tx-ctl-no-ack-retry-count.patch
[wififun]$ patch -p1 < ../mac80211.compat08082009.wl_frag+ack_v1.patch

[wififun]$ make
[wififun]$ sudo make unload
[wififun]$ sudo make install

Now, lets reboot the VM to ensure that all the patched drivers will get properly loaded on each VM boot:

[dom0]$ qvm-run --shutdown --wait wififun
[dom0]$ qvm-run -a wififun gnome-terminal

Let's first see if the WiFi driver got properly loaded and if the interface has been created (look for wlanXinterface):

[wififun]$ ifconfig -a

If yes, then proceed with the steps below (if not, then have a look into dmesg and see what was the problem):

[wififun]$ sudo bash
[wififun]# yum install aircrack-ng dnsmasq
[wififun]# airmon-ng start wlan0
[wififun]# iptables -F INPUT
[wififun]# iptables -F FORWARD
[wififun]# echo “1” > /proc/sys/net/ipv4/ip_forward

Note that you don't need to add any explicit masquerading rules, as they are applied by default on Qubes VMs (you can take a look at the nat table in the VM if you want to see by yourself).

Edit the /etc/dnsmasq.conf, so that it contains at least the following:

interface=at0
dhcp-range=192.168.0.50,192.168.0.150,12h

and then start the dnsmasq daemon -- we will use it for providing DHCP to our fake AP (the at0 interface will be created by airbase-ng and emulates the “uplink” of a traditional AP):

[wififun]# /etc/init.d/dnsmasq start

And finally the fake AP:

[wififun]# airbase-ng -e free_wifi mon0

and on another console (before any client connects, but after airbase-nggot started), configure the at0interface (make sure it matches what you wrote into dnsmasq.conf):

[wififun]# ifconfig at0 192.168.0.1 up

(you can also add an udev rule to that automatically).

and just to verify it really is working:

[wififun]# tcpdump -i at0

... and now, just wait for a client to connect to your AP. What you do next is only limited by your imagination... But hey, this article is about Qubes networking and not about 0wning client systems ;)

Here's an innocent example using Moxie's sslstrip (amazing this attack still works so well at the end of 2011...):

My 'wififun' VM in action using a simple sslstrip attack, that surprisingly still works pretty nice...
Please note that as your wififun VM is a regular Qubes VM, it is automatically connected to the default Net VM, which in turn provides networking to it. That's why it is so easy to create a fully functioning fake AP.

When using custom driver domains, there are currently some catches you should be aware:

Catch #1: When you start a driver domain lateafter system boot, so after some days of uptime and extensive use of VMs, Xen might not be able to allocate enough continues (in terms of MFNs) memory for a driver domain. And PV driver domains, unlike normal domains or HVM driver domains, do require MFN-continuous memory for their DMA buffers (HVM domains do not need that, because IOMMU can create an illusion of this; even though IOMMU is also used for PV driver domains, for protection, it doesn't actively translate bus addresses into GMFNs).

This is usually not a big problem in practice, because in most cases all the driver domains are started early at system boot, when there is still plenty of non-fragmented memory available. However it might become a problem when one wishes to start e.g. the WiFi pen-testing at some later time. The work around is to close as many VMs as possible before starting such driver domain, and then also reducing, for a moment, the amount of memory assigned to Dom0:

[dom0]$ xm mem-set 0 1600m

and then starting the driver domain should be fine. Now we can start all other domains, and that should no longer be problematic for the already running driver domain.

Catch #2: Some network cards, notably Express Cards, might not work well with the 3.0.4 pvops kernel that we use in all VMs by default. In that case you might want to try to use the 2.6.38.3 xenlinux kernel in your WiFi fun VM -- to do that, follow these steps:

[dom0]$ sudo qvm-dom0-update kernel-qubes-vm-2.6.38.3-10.xenlinux.qubes
[dom0]$ cp /var/lib/qubes/vm-kernels/2.6.38.3/* /var/lib/qubes/appvms/wififun/kernels/
[dom0]$ qvm-prefs wififun -s kernelopts "swiotlb=force"

And then, in the VM:

[wififun]$ sudo yum install kernel-devel-2.6.38.3-10.xenlinux.qubes

And rebuild the compat-wireless, unload, install modules, and then load drivers again.

Summary

As you can see, Qubes Beta 2 now offers a very advanced networking infrastructure that allows more advanced users to create very sophisticated configurations, allowing for pretty good isolation between various domains and networks. Qubes leaves it up to the user (or admin) to figure out what would be the best configuration -- most users would be happy with the default simple setup with just one Net VM and one Firewall VM, while others would go for much more advanced setups.

A bit more advanced networking setup. The usbvm has a 3G modem assigned, and it is possible to dynamically switch between the Net VMs without restarting any other VMs.

\ No newline at end of file diff --git a/_posts/2011-12-06-exploring-new-lands-on-intel-cpus-sinit.html b/_posts/2011-12-06-exploring-new-lands-on-intel-cpus-sinit.html deleted file mode 100644 index 9a04a5a..0000000 --- a/_posts/2011-12-06-exploring-new-lands-on-intel-cpus-sinit.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Exploring new lands on Intel CPUs (SINIT code execution hijacking) -date: '2011-12-06T10:48:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-03-28T11:10:07.825+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7845092546778053242 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/12/exploring-new-lands-on-intel-cpus-sinit.html ---- - -Today we're releasing a new paper where we describe exploiting a bug in Intel SINIT authenticated code module that allows for arbitrary code execution in what we call an “SINIT mode”. So, to the already pretty-well explored “lands” on Intel processors, that include ring 3 (usermode), ring 0 (kernelmode), ring “-1” (VT-x root), and ring “-2” (SMM), we're now adding a new “island”, the SINIT mode, a previously unexplored territory inhabited so far only by the Intel-blessed opcodes.

What is really interesting about the attack are the consequences of SINIT mode hijacking, which include ability to bypass Intel TXT, LCP, and also compromise system SMRAM.

It's also interesting how difficult was this vulnerability for Intel to patch, as they had to release not only updated SINIT modules, but also updated microcode for all the affected processors, and also work with the BIOS vendors so they release updated BIOSes that would be unconditionally loading this updated microcode (plus provide anti-rollback mechanisms for both the BIOS and microcode). Quite an undertaking...

You can get the paper here.

Intel also published an advisory yesterday, which can be downloaded from their website here. The advisory is peculiar in a few ways, however...

First, the advisory (I'm referring to the revision 1.0) never explicitly mentions that the attack allows to bypass TXT launch itself, only that the attack “may compromise certain SINIT ACM functionality, including launch control policy and additionally lead to compromise of System Management Mode (SMM). Intel also recommend to disable TXT altogether in the BIOS, as a preventive measure, in case the user doesn't “actively running Intel® TXT”... This reminds me how various vendors started actively disabling Intel VT-x after certain virtualization rootkits have been demonstrated some 5 years ago, and how many laptops still ship with this technology disabled today (or VT-d at least) to the questionable delight of many users.

Second, the advisory assigns only an “Important” rating to this vulnerability, even though another Intel advisory, published some two years ago for a problem also reported by us, and which which was strictly a subset of the current vulnerability in terms of powers that it gave to the attacker (in other words the current vulnerability provides the attacker with everything that the previous one did, plus much more), was given a “Critical” rating... This is called evolution, I guess, and I wonder what would be considered critical by Intel these days?

UPDATE (Dec 7th, 2011): Intel has just released an updated advisory (release 1.1) that now explicitly states that the vulnerability also bypasses Intel TXT.

This is the last paper co-authored with Rafal Wojtczuk, who recently decided to try some new things and to leave ITL. Rafal has been the most talented exploit writer I have worked with, and I will surely miss his ingenious insights, such as e.g. how to practically win an absolutely hopeless race condition with ICMP-delivered MSI! But then again, how many times can one break Intel technologies, before getting bored? At the same time ITL is really transforming now into a development company, with all our efforts around Qubes and architecting, rather than on breaking. I wish Rafal all the best with his new endeavors, and thank him for all the excellent contributions he made while working for ITL over the past 3+ years. \ No newline at end of file diff --git a/_posts/2011-12-13-trusted-execution-in-untrusted-cloud.html b/_posts/2011-12-13-trusted-execution-in-untrusted-cloud.html deleted file mode 100644 index cd2fc39..0000000 --- a/_posts/2011-12-13-trusted-execution-in-untrusted-cloud.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Trusted Execution In Untrusted Cloud -date: '2011-12-13T20:25:00.000+01:00' -author: Joanna Rutkowska -tags: -- cloud -- trusted execution technology -- general -modified_time: '2012-03-28T11:10:17.874+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6975144072797589166 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2011/12/trusted-execution-in-untrusted-cloud.html ---- - -
Wouldn't it be nice if we could actually own our data and programs in the cloud? By “owning” here I mean to have control over their confidentiality and integrity. When it comes to confidentiality and integrity for the data,it's not much of a rocket since, as the classic crypto (and secure client systems) is all that we need. I have already wrote about it in an earlier post.
But it would also be nice, if we could somehow get the same confidentiality and integrity assurance for our programsthat we upload for the execution in the cloud...

For example, a company might want take their database application, that deal with all sorts of corporate critical sensitive data, and then upload and safely run this application on e.g. Amazon's EC2, or maybe even to some China-based EC2-clone. Currently there is really nothing that could stop the provider, who has a full control over the kernel or the hypervisor under which our application (or our VM) executes, from reading the contents of our process' memory and stealing the secrets from there. This is all easy stuff to do from the technical point of view, and this is also not just my own paranoia...


Plus, there are the usual concerns, such as: is the infrastructure of the cloud provider really that safe and secure, as it is advertised? How do we know nobody found an exploitable bug in the hypervisor and was not able to compromise other customer's VMs from within the attacker-hired VM? Perhaps the same question applies if we didn't decided to outsource the apps to a 3rdparty cloud, but in case of a 3rdparty clouds we really don't know about what measures have been applied. E.g. does the physical server on which my VMs are hosted also used to host some foreign customers? From China maybe? You get the point.

Sometimes all we really need is just integrity, e.g. if we wanted to host an open source code revision system, e.g. a git repository or a file server. Remember the kernel.org incident? On a side note, I find the Jonathan Corbet's self-comforting remarks on how there was really nothing to worry about, to be strikingly naive... I could easily think of a few examples of how the attacker(s) could have exploited this incident, so that Linus & co. would never (not soon) find out. But that's another story...

But, how can one protect a running process, or a VM, from a potentially compromised OS, or a hypervisor/VMM?

To some extent, at least theoretically, Intel Trusted Execution Technology (TXT), could be used to implement such protection. Intel TXT can attest to a remote entity, in that case this would be the cloud customer, about the hash of the hypervisor (or kernel) that has been loaded on the platform. This means it should be possible for the user to know that the cloud provider uses the unmodified Xen 4.1.1 binary as the hypervisor and not some modified version, with a built-in FBI backdoor for memory inspection. Ok, it's a poor example, because the Xen architecture (and any other commercially used VMM) allow the administrator who controls Dom0 (or equivalent) to essentially inspect and modify all the memory in the system, also that belonging to other VMs, and no special backdoors in the hypervisor are needed for this.

But let's assume hypothetically that Xen 5.0 would change that architecture, and so the Dom0 would not be able to access any other VM's memory anymore. Additionally, if we also assumed that the Xen hypervisor was secure, so that it was not possible to exploit any flaw in the hypervior, then we should be fine. Of course, assuming also there were also no flaws in the TXT implementation, and that the SMM was properly sandboxed, or that we trusted (some parts of) the BIOS (these are really complex problems to solve in practice, but I know there is some work going on in this area, so there is some hope).

Such a TXT-bases solution, although a step forward, still requires us to trust the cloud provider a bit... First, TXT doesn't protect against bus-level physical attacks – think of an attacker who replaces the DRAM dies with some kind of DRAM emulator – a device that looks like DRAM to the host, but on the other end allows full inspection/modification of its contents (well, ok, this is still a bit tricky, because of the lack of synchronization, but doable).

Additionally for Remote Attestation to make any sense, we must somehow know that we “talk to” a real TPM, and not to some software-emulated TPM. The idea here is that only a “real” TPM would have access to a private key, called Endorsement Key, used for signing during Remote Attestation procedure (or used during the generation of the AIK key, that can be used alternatively for Remote Attestation). But then again who generates (and so: owns) the private endorsement keys? Well, the TPM manufacturer, that can be... some Asian company that we not necessarily want to trust that much...

Now we see it would really be advantageous for customers, if Intel decided to return to the practice of implementing TPM internally inside the chipset, as they did in the past for their Series 4 chipsets (e.g. Q45). This would also protect against the LCP bus-level attacks against TPM (although somebody told me recently that TPM in current systems cannot be so easily attacked from LCP bus, because of some authentication protocol being used there – I really don't know, as physical attacks have not been the area we ever looked at extensively; any comments on that?).

But then again, the problem of DRAM content sniffing always remains, although I would consider this to be a complex and expensive attack. So, it seems to me that most governments would be able to bypass such TXT-ensured guarantees in order to “tap” the user's programs executing in the cloud provides that operate within their jurisdictions. But at least this could stop malicious companies from staring up fake cloud services with an intent to easily harvest some sensitive data from unsuspecting users.

It seems that the only way to solve the above problem of DRAM sniffing attacks is to add some protection at the processor level. We can imagine two solutions that processor vendors could implement:

First, they could opt for adding an in-processor hardware mechanism for encrypting all the data that leave the processor, to ensure that everything the is kept in the DRAM is encrypted (and, of course, also integrity-protected), with some private key that never leave the processor. This could be seen as an  extension to the Intel TXT.

This would mean, however, we still needed to relay on: 1) the hypervisor to not contain bugs, 2) the whole VMM architecture to properly protect VM's memory, specifically against the Dom0, 3) Intel TXT to not be buggy either, 4) SMM being properly sandboxed, or alternatively to trust (some parts of) the BIOS and SMI handler, 5) TPM's EK key to be non-compromised and verifiable as genuine, and 6) TPM bus attacks made impossible (those two could be achieved by moving the TPM back onto the chipset, as mentioned above), and finally, 7) on the encryption key used by the processor for data encryption to be safely kept in the processor.

That's still quite a lot of things to trust, and it requires quite a lot of work to make it practically really secure...

The other option is a bit more crazy, but also more powerful. The idea is that the processor might allow to create untrusted supervisors (or hypervisors). Bringing this down to x86 nomenclature, it would mean that kernel mode (or VT-x root) code cannot sniff or inject code into (crypto-protected) memory of the usermode processes (or VT-x guests). This idea is not as crazy as you might think, and there has even been some academic work done in this area. Of course, there are many catches here, as this would require specifically written and designed applications. And if we ever considered to use this technology also for client systems (how nice it would be if we could just get rid of some 200-300 kLOC of the Xen hypervisor from the TCB in Qubes OS!), the challenges are even bigger, mostly relating to safe and secure trusted output (screen) and, especially, input (keyboard, mouse).

If this worked out, then we would need to trust just one element: the processor. But we need to trust it anyway. Of course, we also need to trust some software stack, e.g. the compilers we use at home to build our application, and the libraries it uses, but that's somehow an unrelated issue. What is important is that we now would be able to choose that (important) software stack ourselves, and don't care about all the other software used by the cloud provider.

As I wrote above, the processor is this final element we always need to rust. In practice this comes down to also trusting the US government :) But we might imagine users consciously choosing e.g. China-based, or Russia-based cloud providers and require (cryptographically) to run their hosted programs on US-made processors. I guess this could provide reasonable politically-based safety. And there is also ARM, with its licensable processor cores, where, I can imagine, the licensee (e.g. an EU state) would be able to put their own private key, not known to any other government (here I assume the licensee also audits the processor RTL for any signs of backdoors). I'm not sure if it would be possible to hide such a private key from a foundry in Hong Kong, or somewhere, but luckily there are also some foundries within the EU.

In any case, it seems like we could make our cloud computing orders of magnitude safer and more secure than what is now. Let's see whether the industry will follow this path...
\ No newline at end of file diff --git a/_posts/2012-01-21-thoughts-on-deepsafe.html b/_posts/2012-01-21-thoughts-on-deepsafe.html deleted file mode 100644 index 583ec62..0000000 --- a/_posts/2012-01-21-thoughts-on-deepsafe.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: Thoughts on DeepSafe -date: '2012-01-21T18:01:00.002+01:00' -author: Joanna Rutkowska -tags: -- rootkits -- chipset -- attack -- exploit -modified_time: '2012-03-28T11:10:27.715+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-6804689402512253967 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/01/thoughts-on-deepsafe.html ---- - -
Several people asked me recently what I though about DeepSafe. So, below I present my opinion...

First, for any AV system (or Host IPS, or Personal Firewall, etc) to work effectively, there are three problems that must be addressed:
  1. How to protect the AV agent (code and data) from tampering (from the rest of the OS)?
  2. How can the AV agent get reliable access to (sensitive pieces of) the system memory and registers, and/or provide reliable memory protection for the (sensitive pieces of) the OS.
  3. What are those "sensitive pieces of” memory that should be monitored or protected?
From reading various PR materials, it seems like the #1 above is the primary differentiation factor for DeepSafe (DS). So, let's consider this problem in the context of e.g. a Windows OS. In order to protect its code and data, DS uses, as it is heavily advertised, Intel VT-x virtualization technology. Now, that sounds really secure -- after all what can be more secure than a hardware virtualization, right? ;)

But VT-x (including EPT) is only about CPU virtualization, which in our case translates to protecting the DS memory and registers from CPU-originating accesses. But, as every regular to this blog knows, there is also another method of accessing memory on any PC system, and this is through DMA transactions from devices. The OS (so also the kernel malware) is free to program one of the many devices in the system to issue DMA reads or writes to any physical memory it wants...

Now, in order to protect some portion of the system memory (DRAM, cache) against DMA accesses, we have the Intel VT-d technology... So, one would think that DS must be also using VT-d in order to protect itself.

Very well, let's assume then that the DeepSafe is not a total ripoff, and that it implements also VT-d protection for its agent, although I haven't found this mentioned in any of the public papers or press materials I found on the web...

This, however, would be a bit complex to do correctly, because the OS (so, also the kernel malware) still has a full control over the chipset (MCH), which is the entity... that controls the VT-d.

Now, in order to prevent the OS (or the kernel malware) from playing with the chipset for fun and profit, and e.g. disabling VT-d protection, DS would have to virtualize the chipset.

If you look at some consumer VMMs, such as VMware or Xen/Qemu, you would see that they all virtualize the chipset for their guests (of course), but that the chipset they provide this way is some kind of an ancient Pentium MCH. I don't think any of the consumers would be especially happy if they found out that after installing DS on their brand new 2012 laptop, Windows suddenly see a Pentium-era chipset... And this is not without a reason – chipsets, specifically MCHs, are one of the most complex devices, perhaps only beaten by GPUs in this category. There are virtually hundreds of configuration registers exposed by the chipset, some of them control the VT-d, some other control system memory maps and permissions, PCIe configuration, and many other things that I even have no idea about, and this all makes virtualizing the chipset a very challenging task.

So, it's either that McAfee and Intel found some interesting way of how to securely virtualize the chipset while preserving all of its (very rich) functionality, or that they... don't bother with VT-d protection and chipset virtualization at all, assuming that even without VT-d, DeepSafe is good enough and “rises the bar” anyway (sarcasm intended).

(Can somebody from McAfee or Intel confirm in the comments below what does DP really do?)

Anyway, let's assume they dohave VT-d protection and they do virtualize the chipset somehow...

Now, we're moving on to the #2 point from the list of tasks above -- about the reliable
memory access or reliable protection.

So, let say that the DS agent decided that some part of the system memory, e.g. the IDT table, is sensitiveand should be monitored/protected. So it sets up EPT traps to trigger an VT-x/EPT intercept on any access to that memory (or IDT base register), in order to find kernel malware that tried to modify IDT. That sounds really nice, but what if the malware uses DMA to modify IDT? DS would not be able to catch such access! (So far we considered the, hypothetical, use of VT-d only to protect the DS agent code).

One might think that DS is programming VT-d to sandbox each and every device in the system (so including GPU, USB controllers, NICs, SATA, etc) so they never be allowed to touch any of those sensitive parts of the system, such as IDT. Let's assume they do it this way...

And here we've arrived to the last point from the list at the beginning: which of the system memory constitutes those "sensitive pieces" that should be protected/monitored? IDT? Sure. What about all the code sections of the all the kernel modules? Yes. Are we fine now? Well, no, because the malware can hook some pointers other than the well known IDT. Some public NDIS data structure? Ok, we can add those to the protected areas. But, what about some undocumented NDIS structures? And this is just NDIS subsystem, one of the many subsystems in the Windows kernel... When we think about it, it should be intuitively obvious that in a general purpose Operating System like Windows, it is not possible (at least for 3rd party) to make a satisfactory list of all the sensitive pieces of memory that should be monitored/protected, in order to detect all the system compromises.

Greg Hoglund, Jamie Butler, Alex Tereshkin, and myself, have been researching this area actively in the early years of this millennium. In addition to the Alex's paper linked above, you might also check out one of my last slides from this period.

I don't think anything has changed since that time. It was also the reason why I gave up on writing Windows compromise detectors, or forensic tools, and moved on to researching other ways to secure OSes, which finally gave birth to Qubes OS, many years later.

So, back to DS -- in order to provide a somehow satisfactory protection level for your general purpose OS, such as Windows, it would need to:
  1. Use VT-d to protect its own memory,
  1. Virtualize the chipset, at least some (sensitive) parts of it,
  1. Program VT-d permissions for each device to exclude all the sensitive areas in the system that should be protected, and also protect one device from DMAing into/from another device memory (e.g. NIC stealing GPU framebuffer, or inserting instructions to the GPU instruction buffer, or keystrokes to USB controller buffer). Ideally, this could be done by programming VT-d to grant each device only access to its own DMA buffer, but as far as I know, this would be very hard to implement, if not impossible for a 3rd party, on a Windows OS (in contrast to Linux, which mostly support this model). Please correct me, if the recent Windows version allows for such use of VT-d.
  1. Finally, and the most hard thing to solve, how to define all the "sensitive pieces of memory" in the system that should be protected and/or monitored? Although this is a somehow more generic problem, not specific to DS, but applying to any A/V, HIPS, or forensic tool.
So, is DeepSafe another piece of crap not worth any special attention, or has McAfee and Intel came up with some novel methods, e.g. for chipset virtualization, and other problems? Unless I see some technical info to backup the latter, I would have to assume, unfortunately, the former. But I would like to be mistaken – after all DeepSafe seems to be just a new incarnation of my Bluepill ;)
\ No newline at end of file diff --git a/_posts/2012-02-06-qubes-beta-3.html b/_posts/2012-02-06-qubes-beta-3.html deleted file mode 100644 index 5449396..0000000 --- a/_posts/2012-02-06-qubes-beta-3.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes Beta 3! -date: '2012-02-06T11:45:00.002+01:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2012-11-02T18:06:34.499+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7272088205765369134 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/02/qubes-beta-3.html ---- - - -->
A new ISO with the just released Qubes Beta 3 is now available for download here.

Beta 3 fixes lots of annoying problems discovered in Beta 2 and earlier releases, and also implements a bunch of useful feature:

This includes the qvm-block tool and infrastructure for easy attachment of block devices to any AppVM, no matter which system VM is handling the actual USB controller. So, this allows to have untrusted USB domain(s), almost seamlessly integrated in the desktop system. One can consider to use it in order to prevent various USB attacks. The next release (the 1.0) will bring this feature to the Qubes GUI manager as well, making it easy to use for non-command-line users too.

Also, we have now introduced fully automatic Qubes build system, that allows to build all the Qubes packages, and also create the installation ISO, with just one command. More information on this system and on how to use it can be found in the wiki.

We have also updated to Fedora 15-based template as a default. Unfortunately F16-based template would require too much work to get all the Gnome 3 stuff working correctly. (The challenge here, is that we don't run a normal Windows and Desktop manager in every domain, in order to make the VMs light weight, and so we need to sometimes work around various problems this causes...).

Finally, we have added two new Qubes-specific applications:
  • A plugin for Thunderbird (it is automatically installed in the template), that allows for one click opening of attachments in Disposable VMs, as well as one-click saving of the attachment to select VM.
  • And something we call “split GPG”, that I will describe in a separate article later.
Those Qubes-specific applications are based on our Qubes RPC, introduced in Beta 2.

This is likely the last release before the “final 1.0”, that is scheduled to follow soon(TM). The only major work for 1.0 is GUI manager improvements to expose most of the Qubes functionality via clickable GUI, and command line tools cleanup and documentation. Plus testing and bugfixing :)

And then, the next thing we will be working on will be support for HVM domains, e.g. Windows. This work is starting actually just about now, but code will be released only after Qubes 1.0.
\ No newline at end of file diff --git a/_posts/2012-03-03-windows-support-coming-to-qubes.html b/_posts/2012-03-03-windows-support-coming-to-qubes.html deleted file mode 100644 index 0d939bc..0000000 --- a/_posts/2012-03-03-windows-support-coming-to-qubes.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Windows support coming to Qubes! -date: '2012-03-03T12:43:00.000+01:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2012-12-15T12:48:18.912+01:00' -thumbnail: http://3.bp.blogspot.com/-UFnn-9m1pO0/T1IBP9dvJ8I/AAAAAAAAAJs/E41NvH8MQKM/s72-c/qubes-hvm-windows.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-2536319280775711164 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/03/windows-support-coming-to-qubes.html ---- - -Ok, let's start with a screenshot :)


While the “Qubes 1.0” branch is currently in the final development and testing, we have already started working on the Next Big Feature, which is a support for HVM domains (hardware, or VT-x virtualized domains). This allows to run e.g. Windows VMs under Qubes. You might be wondering what so special about this, if Xen has been supporting HVM domains, and specifically Windows VMs for a long time, and Qubes uses Xen hypervisor, so why haven't we had Windows support since day one?

The are a couple of things that we don't like about HVM support in Xen (and also in other VMMs), which include: the need to run device emulator (AKA qemu) in Dom0, the need to use crappy VNC, or a similar protocol to access the VM's framebuffer, or alternatively, the crazy idea (from security point of view, that is) of using a pass-through graphics for a VM, the lack of support for disaggregated architecture where backends, e.g. network backends, run in other domains than Dom0. In fact even the Xen “stubdomain” feature, introduced a few years ago, that was supposed to be a solution allowing to move the qemu out of Dom0, in practice turned out to be quite disappointing, as the qemu in the stub domain still requires an accompanying process of another qemu in Dom0, somehow negating all the security benefits this architecture is supposed to bring... And not to mention the omni present assumption that backends run always in Dom0, hardcoded in a few places in the stubdomain code.

So, we didn't like it and that's why Qubes had no Windows support for long time. But this has now changed, as we have just finished the 1st stage implementation of HVM support in Qubes, the way we like it, without any security compromises. In our implementation we've completely eliminated all the qemu remains from Dom0 (it's running in a micro stub domain), the graphics virtualization fully integrates with our very slim GUI daemon (we didn't have to modify our GUI daemon at all!), using our Xen-optimized, zero-copy, minimalist GUI protocol, and the networking is also fully integrated with the Qubes diaggregated networking architecturethat uses isolated domains for all the networking stacks and drivers. Of course, there are still some rough edges, such as no clipboard support, and the virtualization is currently in a “per-desktop” mode, rather than in a “per-window” mode, which is used for PV domains. But, rest assured, we are working on those things right now...

This code is currently not public, and the plan is to release it only after Qubes 1.0 release, either as an upgrade, or as Qubes 2.0. All the dom0 code for HVM support will likely remain GPL, while any Windows-specific code (agent code) will likely be proprietary. \ No newline at end of file diff --git a/_posts/2012-06-27-some-comments-on-operation-high-roller.html b/_posts/2012-06-27-some-comments-on-operation-high-roller.html deleted file mode 100644 index 4f26f55..0000000 --- a/_posts/2012-06-27-some-comments-on-operation-high-roller.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Some comments on "Operation High Roller" -date: '2012-06-27T16:00:00.003+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-11-02T18:06:08.839+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7366669906499592065 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/06/some-comments-on-operation-high-roller.html ---- - -About a year ago I wrote about Why the US "password revolution" won't work, where I pointed out that a massive move towards two-factor authentication will not solve any of the identity theft problems that users experience today. Specifically, I wrote:
[People] don't understand that the [compromised] operating system can impersonate the user at will!
The compromised OS could have saved your PIN to this [smart] card when you used it previously (even if you configured it not to do so!) and now,  immediately, it could use the inserted card to authenticate as you to the bank and start issuing transactions on your behalf. And you won't even notice this all, because in the meantime it will show you a faked screen of your banking account. After all, it fully controls the screen.
The bottom line is that we cannot secure our digital lives, if our client operating systems could not be secured first.
But introduction of tokens won't make our operating systems any more secure!

This article sparked lots of controversy with many people, who considered it a fallacy to criticize two factor authentication...

Today, I came across the news about Operation High Roller, discovered recently by McAfee and Guardian Analytics. They released a paper with some details about the attacks and the malware deployed. Some interesting quotes:
All of the instances that involved High Roller malware could bypass complex multi-stage authentication. Unlike recent attacks that collect simple form authentication data—a security challenge question, a one-time token, or PIN—this attack can get past the extensive physical (“something you have”) authentication required by swiping a card in a reader and typing the input into a field (see Two-factor Authentication sidebar).
The attack asks the victim to supply the information required to get around the physical controls of smartcard reader plus pin pad entry to generate a one-time password (or digital token).
Having collected all the information it requires for the entire transfer, the malware stalls the user and executes its transaction in the background using the legitimate digital token.
Multiple after-the-theft behaviors hide evidence of the transaction from the user. For example, the client-side malware kills the links to printable statements. It also searches for and erases confirmation
emails and email copies of the statement. Finally, it also changes the transactions, transaction values, and account balance in the statement displayed on the victim’s screen so the amounts are what the account holder expects to see.

Defensive security is a difficult game, because one doesn't immediately see whether a given solution works or not. This is in stark contrast to other engineering disciplines (and to offensive security) where one usually have immediate feedback on whether something works well or not.

Say you want to build a redundant long-range video downlink for your unmanned, remotely operated helicopter -- you can throw in lots of money buying various high-gain antennas, circular antennas, antenna trackers, diversity systems, etc., but then ultimately you can verify your creation immediately by going into a field and trying to fly a few miles away, and see whether you loose the vision (usually in the middle of some life-threatening manoeuvre) or not. At least you can draw some lines of how good your solution is ("I can fly up to one mile away, but not more, unless there aren't that many trees around and the air is dry enough").

With security, especially with computer security, it is so different, because there is no immediate feedback. This results in various vendors pitching their products as wonderful solutions that just solve all the worlds problems, even though what they're saying in those marketing materials might be pure nonsense... (BTW, congrats to Simon Crosby for apparently creating a Windows-hosted VMM in below 10k LOC! ;)

The often made mistake is to say: "Perhaps there is a way to attack this solution, but then again, how much of the malware in the wild implements such attacks?" This is a classical thinking in our industry, and in my opinion, an inexcusable mistake! Let me say it clearly:

It doesn't matter whether what the malware in the wild does -- it matters what it could potentially do!

So, if we can do a quick brainstorming session and point out potential attacks within 1 hour against some technology/product X, then, if we don't see a solution how to prevent them generically, we should not bother and implement product X, because it will be defeated, sooner or later. Let's not waste time on useless solutions, life's too short! \ No newline at end of file diff --git a/_posts/2012-07-21-qubes-10-release-candidate-1.html b/_posts/2012-07-21-qubes-10-release-candidate-1.html deleted file mode 100644 index eb1b798..0000000 --- a/_posts/2012-07-21-qubes-10-release-candidate-1.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes 1.0 Release Candidate 1! -date: '2012-07-21T16:12:00.001+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-11-02T18:27:23.368+01:00' -thumbnail: http://2.bp.blogspot.com/-zJFn81JdryI/UAqu7H9KSHI/AAAAAAAAAJ0/q_vVqkoEDTY/s72-c/snapshot9.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-8104324851973297050 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/07/qubes-10-release-candidate-1.html ---- - -
I would like to announce the release of Qubes RC1. The installation ISO and instructions can be found here.



This release is expected to essentially be identical to the final 1.0 release, which will likely follow in the coming weeks, except for some minor, cosmetic fixes.

Comparing to the previous Beta 3 release, the major changes and improvements in this version include:
  • A much improved Qubes Manager, that now allows to configure and manage almost every aspect of the Qubes system using a simple and intuitive GUI.
  • All the VMs are now based on Fedora 17 template.
  • Cleaned up and improved command lines tools for both Dom0 and for the VMs.
  • Updated Dom0 and VM kernels are now based on 3.2.7-pvops kernel, which offer better hardware and power management support.
  • Convenient menu improvements, that include e.g. a handy icon for launching a Disposable Web browser in a Disposable VM.
  • Support for “yum proxy”, which smartly allows to update packages in a template VM (or other updateable VM), without requiring to grant general HTTP access for this VM. This has been a problem before, as the Fedora repos use hundreds of mirrored yum servers, and it wasn't possible to setup a single rule in the firewall VM to allow only access to the yum servers, and nothing else. Now, this is possible, and the primary application is to prevent user mistakes, e.g. against using the temaplate VM for Web Browsing.
  • We also added support for an opt-in fullscreen mode for select VMs.
  • ...plus lots of other improvements and fixes under the hood. As can be seen in the wiki, there has been over 200 tickets closed as part of the work on this release!
So, again, this is almost the final release, please test it and report any problems to the mailing list, so that we could fix them before Qubes 1.0 comes out officially.
\ No newline at end of file diff --git a/_posts/2012-09-03-introducing-qubes-10.html b/_posts/2012-09-03-introducing-qubes-10.html deleted file mode 100644 index 457f67d..0000000 --- a/_posts/2012-09-03-introducing-qubes-10.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Introducing Qubes 1.0! -date: '2012-09-03T11:28:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-11-02T18:27:09.610+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7517388891109415425 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/09/introducing-qubes-10.html ---- - -After nearly three years of work, I have a pleasure to announce that Qubes 1.0 has finally been released! To see the installation instructions and to get an ISO, please go to this page.

I would like to thank all the developers who have worked on this project. Creating Qubes OS has been a great challenge, especially for such a small team as ours, but ultimately, I'm very glad with the final outcome – it really is a stable and reasonably secure desktop OS. In fact I cannot think of any more secure alternative...

I use the term “reasonably secure”, because when it comes to defensive security it's difficult to use definite statements (“secure”, “unbreakable”, etc), unless one can formally prove the whole design and implementation to be 100% secure.

Unfortunately, contrary to common belief, there are no general purpose, desktop OSes, that would be formally proven to be secure. At the very best, there are some partsthat are formally verified, such as some microkernels, but not whole OSes. And what good is saying that our microkernel is formally verified, if we continue to use a bloated and buggy X server as our GUI subsystem? After all, a GUI subsystem has access to all the user inputs and output, thus it is as much security sensitive, as is the the microkernel! Or power management subsystem, or filesystem server, or trusted boot scheme, or ... a dozens of other elements, which just cannot be forgotten if one wants to talk about a truly secure OS. As said before, I know of no general-purpose desktop OS that would be formally proven, and thus that could be called “secure”. You can also read more about challenges with formal verification microkernels in this article, and especially in this comment from the seL4 project leader.

In Qubes OS we took a practical approach and we have tried to focus on all those sensitive parts of the OS, and to make them reasonably secure. And, of course, in the first place, we tried to minimize the amount of those trusted parts, in which Qubes really stands out, I think.

So, we believe Qubes OS represents a reasonably secure OS. In fact I'm not aware of any other solution currently on the market that would come close when it comes to secure desktop environment. But then again, I'm biased, of course ;)

I wouldn't call Qubes OS “safe”, however, at least not at this stage. By “safe” I mean a product that is “safe to use”, which also implies “easy to use”, “not requiring special skills”, and thus harmless in the hands of an inexperienced user. I think that Apple iOS is a good example of such a “safe” OS – it automatically puts each application into its own sandbox, essentially not relaying on the user to make any security decisions. However, the isolation that each such sandbox provides is far from being secure, as various practical attacks have proven, and which is mostly a result of exposing too fat APIs to each sandbox, as I understand. In Qubes OS, it's the user that is responsible for making all the security decisions – how to partition her digital life into security domains, what networkand other permissions each domain might have, whether to open a given document in a Disposable VM, etc. This provides for great flexibility for more advanced users, but the price to pay is that Qubes OS requires some skills and thinking to actually make the user's data more secure.

Generally Qubes OS is an advanced tool for implementing Security by Isolation approach on your desktop, using domains implemented as lightweight Xen VMs. It tries to marry two contradictory goals: how to make the isolation between domains as strong as possible, mainly due to clever architecture that minimizes the amount of trusted code, and how to make this isolation as seamless and easy as possible. Again, how the user is going to take advantage of this isolation is totally left up to the user. I realize this might be a tricky part for some users and some usage scenarios, yet, on the other hand, this seems to be the most flexible and powerful approach we could provide.

Thus people should realize that by mere fact of using Qubes OS they won't become automatically more secure – it's how they are going to use it might make them significantly more secure. A hypothetical exploit for your favourite web browser would work against Firefox running inside one of the Qubes VMs just as well as it worked for the same browser running on normal Linux. The difference that Qubes makes, is that this attacked browser might be just your for-personal-use-only browser which is isolated from your for-work-use-only-browser, and for-banking-use-only-browser.

Finally, even though Qubes has been created by a reasonably skilled team of people, it should not be considered bug free. In fact, over the last 3 years we already found 3 serious bugs/attacks affecting Qubes OS – one of them in the very code we created, and two other in Intel hardware. Again, we tried as much as possible to limit the amount of code that is security sensitive in the first place, yet we are just humans ;) So, I'm very curious to see others' attempts to break Qubes – I think it might make for a very interesting research. A good starting point for such research might be this page. And I know there are individuals out there who apparently only been waiting for Qubes 1.0 to come out, to get some glory(yet, it's not clear to me why to attack qemu, which is not part of the TCB in Qubes, but I guess great minds have their own mysteries ;)

In other words, please enjoy Qubes OS 1.0, hopefully it could make your digital life safer!

Please send all the technical questions regarding Qubes to the qubes-devel mailing list. Do not send them to me directly, nor post them in this blog's comments.
\ No newline at end of file diff --git a/_posts/2012-09-12-how-is-qubes-os-different-from.html b/_posts/2012-09-12-how-is-qubes-os-different-from.html deleted file mode 100644 index a3bdc37..0000000 --- a/_posts/2012-09-12-how-is-qubes-os-different-from.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: How is Qubes OS different from... -date: '2012-09-12T19:02:00.000+02:00' -author: Joanna Rutkowska -tags: -- os security -- qubes -modified_time: '2012-11-02T18:35:40.451+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3647954972953346145 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/09/how-is-qubes-os-different-from.html ---- - -Many people ask how does Qubes OS differ from other approaches to desktop security. Today I'm trying to answer the most popular questions.
  • Why bother with Qubes OS, if any Linux/BSD already allows to setup different user accounts, or some form of light-weight containers or sandboxes, such as chroot, LXC, SELinux?
First, if you use Xorg or similar X-based server as your GUI server, and this is what nearly all Linux, and most of the other non-Windows OSes use, then you don't have any form of GUI-level isolation, which is essential for a desktop system. I wrote more about this surprising problem some time ago. Proper GUI-level isolation was one of the main goals for Qubes.

Second, all mainstream desktop OSes, such as Windows, Linux, BSD, even OSX, are all based on a monolithic kernels, which present a significant security problem. This is because a typical monolithic kernel of a contemporary desktop OS contains tens of millions of lines of code, and to make it worse, most of this code is reachable from (untrusted) applications via all sorts of APIs, making the attack surface on the kernel huge. And it requires just one successful kernel exploit to own the whole system, bypassing any security mechanisms that might have been built on top of it, such as SELinux, LXC, etc.

Additionally, all the various drivers, networking and USB stacks, are also hosted in the kernel, making attacks via buggy networking (e.g. via buggy 802.11 stacksor buggy firmware) or USB stacks a practical possibility. And there is essentially nothing one can do about it, when using an OS based on a monolithic kernel.

In Qubes, on the other hand, we use Xen hypervisor to provide security isolation between domains, and Xen is just a few hundred of thousands lines of code. It also doesn't need to provide all sorts of APIs to applications, because the Xen hypervisor is essentially only interested in CPU scheduling, memory management and power management, and very few things beyond that. Most notably, the Xen hypervisor knows nothing about networking, disk storage, filesystems, USB stacks, etc, as all those tasks are delegated to (often untrusted) service VMs.
  • How is Qubes better than just running a bunch of VMs in VMWare or Virtual Box?

First, products such as VMWare Workstation or Fusion, or Virtual Box, are all examples of type II hypervisors (sometimes called “hosted VMMs”), which means that they run inside a normal OS, such as Windows, as ordinary processes and/or kernel modules. This means that they use the OS-provided services for all sorts of things, from networking, USB stacks, to graphics output and keyboard and mouse input, which in turn implies they can be only as secure as the hosting OS is. If the hosting OS got compromised, perhaps via a bug in its DHCP client, or USB driver, then it is a game over, also for all your VMs.

Second, those popular consumer type II VMM systems have not been designed with security as a primary goal. Instead, their main focus has been on easy of use, performance, and providing seamless integration of the guest OS(es) with the host OS. Especially the latter, which involves lack of good method to identify which domain a given application belongs to (so, lack of trusted Window Manager), support for shared clipboards which every other VM can steal, insecure file sharing methods, and others, all make it not a very desirable solution when strong domain isolation is important. (This is not to imply that Qubes doesn't support clipboard or file sharing between domains, it does – it's just that we do it in a secure way, at least so we believe). On the other hand, there are many usability improvements in Qubes that are specific to multi-domain system, and which you won't find in the above mentioned products, such as trusted Window Manager that, while maintaining great seamless integration of all the applications onto a common desktop, still allows the user to always know which domain owns which window, support for advanced networking setups, per-domain policies, the just mentioned secure mechanisms for clipboard and filesystem sharing, and many other. Qubes also focuses on making the VMs light-weight so that it was possible to run really a lot of them at the same time, and also on mechanism to allow for secure filesystem sharing between domains (templates).

Finally, the commercial hosted VMMs are really bloated pieces of code. They support everything and the kitchen sink (e.g. Open GL exposed to VMs, and various additional interfaces to allow e.g. drag and drop of files to/from the VM), and so, the attack surface on such a VMM system is orders of magnitude bigger than in case of Qubes OS.
  • How does Qubes compare to [your favourite academic microkernel]? 
While the Xen hypervisor can indeed be considered a microkernel if you're not a strict terminology freak, Qubes itself is much more than just the hypervisor. Qubes is everything that is needed to build a reasonably secure desktop OS on top ofa baremetal hypervisor (or microkernel). Theoretically, with just a few cosmetic changes (at least architecture-wise), Qubes could perhaps swap the Xen hypervisor for some other hypervisor or microkernel, such as perhaps Hyper-V, KVM, or some more exotic one. Thus, it makes little sense to compare Qubes with a hypervisor or microkernel project. What makes sense is to compare the Xen hypervisor, as used in Qubes, with some other hypervisor or microkernel.

Ok, so how does Xen compare with other hypervisors or microkernels out there? We think Xen is unique because it combines an elegant architecture (type I, baremetal, hypervisor) with a number of practical features, such as power management, support for Intel VT-d and driver domains, support for both para-virtualizaed, and fully-virtualized VMs, and many more, not found in e.g. academic microkernels/hypervisor projects, that otherwise seem attractive from the architecture point of view.
  • How is Qubes better than Google Chrome OS?
 First, Chrome OS is not a general purpose OS. Second, it's based on Linux with all its security limitation that are a result of using a monolithic kernel described above (e.g. all the networking and USB stacks in the kernel without a possibility to deprivilige them). Not being a traditional general purpose OS, Chrome is able to avoid many of the challenges of desktop computing, such as the need to define security domains, inter-domain file exchange (as there is essentially no filesystem visible to the user), and others, which is good, of course. But then again, Chrome OS is essentially just an environment to run the Chrome Browser, so the comparison to Qubes is a bit of a misunderstanding.

Technical aspects aside, there is always the privacy concern associated with running everything in a browser – why would all my private data be managed and accessible to some 3rd party organizations and their administrators?
  • How is Qubes better than [your favorite commercial military-grade certified secure OS]?
You must have heard about the super secure military-grade, formally verified, 100% certified, and generally “unbreakable” operating systems made by companies such as Green Hills, Lynx Works, and others. How do they compare to Qubes OS?

Really, I have no idea. For a mere mortal like myself (and perhaps not a US citizen), it seems impossible to get any more technical documentation of those systems (anything beyond the marketing pseudo-technical gibberish), not to mention a trial copy to play with...

Thus, from my point of view, those systems are just a vaporware. If you, my dear reader, are privileged enough to have access to such system, then good for you, but don't expect me to treat seriously a security product that is not available for a wider audience to touch and play with... (And the Chineese surely have the copies already to play with ;)
  • How is Qubes different than Bromium's “micro virtualization” solution?
Many people asked recently about the Bromium's upcoming product and how it differs from Qubes OS. Unfortunately there are few public information available on this product – essentially there is one not-very-technical whitepaperand there are Ian Pratt's presentation slides from the recent XenSummit about u-Xen, apparently a hypervisor that is to be ultimately used in their upcoming product.

The whitepaper suggests that Bromium is based on a hosted (type II) hypervisor running within a normal Window OS, and that this hypervisor is used to spawn a new “micro VM” for each new “task”, where apparently the task might be something as granular as opening a new tab in a Web browser, which makes it somehow similar to Google Chrome's approach. Clearly, the Bromium's main goal seem to be to automate the process of creating separation domains, which is in contrast with what we do on Qubes OS, where the user is required to define the domains explicitly.

The Pratt's slides provide also some technical insight into how Bromium intends to secure their hypervisor. As just discussed above, a hosted hypervisor must normally trust the hosting OS, in this case Windows, which, for obvious reasons, is not a good idea from the security standpoint. Pratt, however, clearly states that “host (...) can not interfere with the privacy or integrity of the hypervisor or other guests” (slide #8). This is a strong statement, so let's take a closer look at their approach to this problem.

The Bromium's idea of how to make their hypervisor (and the VMs) protected from a potentially malicious host OS is not really breakthrough: the slides suggest to “deprivilege the host into a VT-container” (I think the verb to bluepillis now an accepted term for such action ;), and to remove the host's access to the hypervisor pages (via EPT), as well as protect DMA access from devices via VT-d, plus to make this all sensible, use DRTM scheme such as Intel TXT, to load such a hypervisor from within a potentially untrusted OS.

So, what's wrong with the idea of a load-on-the-fly-secure-VMM-system? Isn't Ian Pratt correct that one could protect its memory and execution from the interference of the host? Actually that is possible – Intel TXT, VT-x, VT-d, and EPT give us means to achieve that (although there are a number of catches here). But he's missing one important point: it's the untrusted OS that still owns and manages the input devices (e.g. via USB stacks and drivers) and, most importantly, the output (via the GUI subsystem and drivers). Ensuring that the host OS cannot interfere (e.g. sniff the screen of trusted applications) might be very difficult, or even impossible, in practice.

If I ever was to break the security of such a system, I would just follow the simple way:
1) Infect the host e.g. via one of the many USB attacks (remember they cannot have sandboxed USB driver domain, as they have only a type II hosted hypervisor),
2) Hook somewhere into the GUI subsystem and keep recoding all the interesting data from the screen...
... or something like that ;)

There are also many other things that needs to be answered and which the publicly available documents are silent about, such as e.g. how does the system handle installation of new applications? How is clipboard and file exchange between (micro)VMs handled? How large are the interfaces exposed to each (micro)VM? For now, without a solid documentation available, and without any code to play with, it is just another vaporware for me. (Interestingly there seem to be Bromium's Beta program, which however doesn't seem to be working, at least not for me -- I tried to signup twice, but never got any confirmation or response...?)
  • How is Qubes different from Xen Client?
In many aspects, Xen Clientmight be the most similar product to Qubes OS. Like Qubes, it is based on the Xen hypervisor and so it is also a standalone OS, that one must install instead of one's favorite system, and also, like Qubes, it is targeted for desktop systems, and also offers a possibility to run a few VMs at a time.

However, XenClient has been designed with a different goal in mind, namely as a “Virtual Desktops To Go” solution, while Qubes has been designed to provide seamless experience for secure multi-domain desktop system. As a result, lots of focus in Qubes has been put on creating trusted GUI subsystem, support for advanced networking configurations, secure inter-VM clipboard and file sharing, secure method to reuse the same filesystem as a basis for the AppVMs, and also to optimize the AppVMs so they start almost instantly and take little memory, so that one could easily run many of them at the same time. All those things seem to be missing from Xen Client (as well as solid technical documentation about its design).

***
I surely have missed a few other products or approaches -- feel free to point them out in the comments, and I might write a continuation post one day.
\ No newline at end of file diff --git a/_posts/2012-12-14-qubes-2-beta-1-with-initial-windows.html b/_posts/2012-12-14-qubes-2-beta-1-with-initial-windows.html deleted file mode 100644 index aa50324..0000000 --- a/_posts/2012-12-14-qubes-2-beta-1-with-initial-windows.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Qubes 2 Beta 1 with initial Windows support has been released! -date: '2012-12-14T13:42:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2012-12-15T12:46:38.198+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-4370938576459656069 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2012/12/qubes-2-beta-1-with-initial-windows.html ---- - -
It's my pleasure to announce the first Beta for Qubes Release 2 is now available for download.

This release introduces generic support for fully virtualized AppVMs (called HVMs in Xen parlance), and specifically initial support for Windows-based AppVMs integration. It's been quite a challenge to add support for secure HVMs to Qubes without breaking its security architecture, and I already wrote about it in the past.

Generic support for HVMs means you can now install many different OSes as Qubes VMs, such as various Linux distros, BSD systems, and, of course, Windows. Essentially all you need is an installation ISO and the whole process is similar to creating a VM in a program like Virtual Box or VMWare Workstation (although we believe the underlying architecture for this is more secure in Qubes).

Additionally we provide a set of tools for Windows-based AppVMs (Windows 7 specifically) which allow for tight integration with the rest of the Qubes system. This currently includes support for secure (and policy controllable) clipboard and file exchanges between the Windows-based AppVMs and other AppVMs, integration with Qubes advanced networking infrastructure, and PV drivers for faster operation. As of now there is still no seamless app integration for Windows applications, so Windows VMs are presented as full-desktop-within-a-window, but we're aiming to add support for this in the next Betas.

Unlike the rest of Qubes, which is distributed under a GPL v2 license, the Qubes Windows Support Tools are not open sourced and are distributed as binaries only, under a proprietary license. They are free to use for any Qubes 2 user. The tools are not part of the Qubes 2 installation ISO (which is GPL), and are down loadable on demand.

More information about creating and using HVM domains, including Windows-based AppVMs, can be found in the wiki here.

To summary, here's a quick list of some of the exciting new features that toady's release brings in:
  • Support for generic fully virtualized VMs (without qemu in the TCB!)
  • Support for Windows-based AppVMs integration (clipboard, file exchange, qrexec, pv drivers)
  • Secure audio input to select AppVMs (Hello Skype users!)
  • Clipboard is now also controlled by central policies, unified with other qrexec policies.
  • Out of the box TorVM support
  • Experimental support for PVUSB
  • Updated Xorg packages in Dom0 to support new GPUs
  • DisposableVM customization support
  • ... and, as usual, various fixes and other improvements :)
Existing users of Qubes R1 can upgrade without needing to reinstall – the upgrade procedure is described here. Standard installation is described here.

Enjoy!

PS. Please send all the technical questions to the qubes-devel mailing list, instead posting them as comments to this blog. Keep the comments here for more generic discussions.

PS2. As usual, I would like to remind that we have little control over the servers that are used for Qubes ISO distributions and that the downloads should be verified according to the procedure described here. We always assume that even our own servers (git, wiki, yum) could be compromised, and yet this should not affect Qubes security in any way, because of the extensive use of digital signatures everywhere in the development and distribution process.
\ No newline at end of file diff --git a/_posts/2013-02-21-converting-untrusted-pdfs-into-trusted.html b/_posts/2013-02-21-converting-untrusted-pdfs-into-trusted.html deleted file mode 100644 index e1d283a..0000000 --- a/_posts/2013-02-21-converting-untrusted-pdfs-into-trusted.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: 'Converting untrusted PDFs into trusted ones: The Qubes Way' -date: '2013-02-21T20:07:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2013-02-21T20:07:29.049+01:00' -thumbnail: http://1.bp.blogspot.com/-dno9bFVAjPk/USY0jfl3-WI/AAAAAAAAAKE/4WzqMREkWSc/s72-c/r2b2-converting-pdf-2.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-6301918961626950395 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/02/converting-untrusted-pdfs-into-trusted.html ---- - -
Arguably one of the biggest challenges for desktop security is how to handle those overly complex PDFs, DOCs, and similar files, that are so often exchanged by people, or downloaded from the Web, and that often provide a way for the attacker to compromise the user's desktop system.

Today I would like to discuss a recent innovation we created for Qubes OS that allows to securely convert those pesky PDFs (as well as essentially any graphics files) into trusted PDFs. Here by a “trusted PDF” I mean a file that should be harmlessto the user's system, so, a non-malicious PDF.


A few years ago, we have already introduced a mechanism in Qubes OS called Disposable VMs, that can be used to safelyopen any file, including PDFs, DOCs, etc. The file is being opened in a... well a dedicated disposable VM that is created within seconds (typically below 5 seconds) and all the file processing and rendering happens inside this VM. Once the document is closed, the disposable VM is automatically destroyed, and any changes to the file (e.g. if the was an editable DOC file) are automatically propagated back into the original file. This mechanism is very powerful, and I often use it for my daily work. However, it surely is a bit cumbersome – who wants to wait 5 seconds for the PDF to open, especially if I have a dozen of invoices to look through! So, today I present an alternative approach...
 
Approaches to converting PDFs

The problem of converting a potentially untrusted PDF into a harmless one is certainly not a new one. Some tools have already be created for this task.

The typical approach is to parse the original PDF, look for “potentially dangerous things” there, and remove them. As simple as that! This is, of course, a typical AntiVirus approach to the problem. And, typically as it is for most AV approaches, it's completely useless against any more skilled and determined attacker (and these are the ones we fear the most, don't we?).

A somehow better approach is to parse the original PDF, disassemble it into pieces, and then reassemble them into a new PDF only using the “trusted” pieces – this, I think, could be called a whitelisting approach.

Anyway, the fundamental problem with the approaches mentioned above, is that all of them require parsingof the original PDF file. And parsing is where the “big bang” usually happens. Parsing is where our, normally pretty decent, code, comes in close, intimate contact with some unknown complex input data, which often leads to a successful abuse or exploitation.

Parsing PDFs safely

So, how to perform parsing safely? Of course, that's simple! Let's run the parser in an isolated container – in case of Qubes we already have an ideal such container: it's the Disposable VMs.

But, before we get too excited, let's think more about it – say we run the parser safely isolated in a Disposable VM, meaning it couldn't harm any of the rest of the system, except for the Disposable VM itself, which we however won't worry much about, because it is disposable... But then what?

We want our PDF back in our original VM, to actually use it, right? But we cannot just copy the result from the Disposable VM, because if it got compromised, as a result of parsing of the malicious PDF, then we would like get... a compromised converted PDF. So, this approach gives us nothing!

(Even though our “solution” incorporates all the obligatory buzzwords: “Disposable VMs” (“Micro Disposable VMs”?), “VMs isolated using hardware Intel vPRO technology” and, of course, the “hypervisor”! Sometime just the mere fact we use “hardware virtualization” buys us nothing... People seem to forget about this sometimes.)

So, the trick to make this approach meaningful is to introduce what I will call a “Simple Representation” of the input file. More on this, straightforward concept, below. The idea is that our parser (that runs in a Disposable VM) will be expectedto return the Simple Representation of the original PDF. Of course, it might very well go wild (as a result of exploitation by the PDF it parses), and don't obey our expectations, and instead return something totally different and potentially malicious. But that doesn't matter! The whole point of the Simple Representation is that it should be, well... simple to parse it safely and discard in case what we're getting doesn't look like the Simple Representation.

Ok, so what's the simplest possible representation of an arbitrary PDF file? Yes, it's the RGB format, which is essentially just a raw array of RGB values for each pixel. In fact, I'm not sure there could be anything simpler in the Known Universe to represent a PDF file...

Now this is all becoming simple: we would expect our parser to send us just two things: the dimensions (W x H) of the bitmap representation of each of the page of the PDF in question, and each of the PDF page itself converted into a raw RGB format. If the parser didn't obey, we would still interpret whatever stream of bytes we get as a RGB bitmap – in the worst case the PDF we create would look like un-tuned analog TV screen.

The diagram below summaries this idea:



Implementing this all on Qubes

Now I would like to show how easy it is to implement such PDF converter service using the Qubes advanced infrastructure that we call qrexec, and which is part of Qubes core for quite some time now.

First, let's choose the PDF and image conversion tools. The choice of PDF converter is not security critical, because it will run in an isolated Disposable VM. Here I decided to use pdftocairo converter, which is part of the poppler-utils package on Fedora. We will also use ImageMagick's “convert” command to convert the PNG files (produced by pdftocairo, one for each PDF page) to the raw RGB format. Incidentally ImageMagick supports RGB format natively. As mentioned above, in addition to sending the raw RGB file, we would also need to send the width and height of the pixmap – those can easily be obtained using ImageMagick's “identify” command. Again, all those programs discussed so far are not security critical – they might get exploited during the processing of the untrusted input PDF file, and we don't worry about that at all.

On the receiving side, however, we need to use a foolproof parser for the RGB format. Again, this is what we gain in this whole process – instead of requiring a foolproof-and-also-being-able-to-produce-non-malicious-PDFs parser, we only require a foolproof RGB parses, and that's quite a gain! The ImageMagick's convert comes to mind again here, and one might want to use it like this:

convert page.rgb page.pdf

Unfortunately this would be wrong, because the convert program would still try to detect the “real” format of the page.rgb file, and, if it looked more like, say, JPEG or PDF, it would parse it accordingly, compromising all our careful plan! What we really need is to tell our convert program to always treat the input as raw RGB file, instead of trying to be (too) smart and trying to guess the format by itself. This can be achieved by adding the “rgb:” prefix in front of the input argument, which provides explicit input format specification:

convert -size ${IMG_WIDTH}x${IMG_HEIGHT} -depth ${IMG_DEPTH} rgb:$RGB_FILE pdf:$PDF_FILE

Now also needed to add size and depth explicitly, because the raw RGB format doesn't convey such information (well, it has no header of any sort at all!). Of course we need to obtain the width and height from the parser, but we can validate such input rather easily. In addition we make sure that the received RGB file has exactly the size as indicated by width and height. With those precautions in place, there would have to be really a gappinghole in the ImageMagic's RGB parsing code for the attacker to exploit this. Perhaps instead of using the ImageMagick's convert I should have written a small script in python that would parse the received RGB file (and save it into a... RGB file, for later processing by ImageMagick), but I sincerely think this would be an overkill here. 
 
Finally we can write the following two simple bash scripts, one for client: qpdf-convert-client, and the other one, qpdf-convert-server, for the server (which runs in a Disposable VM).

Additionally we also need to create a policy file in Dom0 in /etc/qubes_rpc/policy/to allow to use this service. The policy file content for this service should look like this:

$anyvm $dispvm allow

... which is pretty self explanatory. When I do development I also add another line to the policy file like this:

$anyvm devel-vm ask

... to allow me to run the server inside my 'devel-vm' VM, instead of running it in Disposable VM every time, which would be very inconvenient for development, as it would require me to update the Disposable VM template each time I wanted to test a new version of qpdf-convert-server.

The policy file should be placed in Dom0 in /etc/qubes_rpc/policy/qubes.PdfConvertfile – here the name of the file must be the same as the name of the service, as invoked via qrexec_client_vmcommand, discussed below.

And, one last thing, in the destination VM we must also create a file that will map the service name (so, the qubes.PdfConvert in our example) to the actual binary that should be called in the VM when the service is invoked. So, the file should be named: /etc/qubes_rpc/qubes.PdfConvert(again, this is now in a VM, not in Dom0, also note the lack of policy/ subdir), and it is another one-liner with the following content:

/usr/lib/qubes/qpdf-convert-server

The full source code of qpdf-converter can be seen and downloaded from this git repo.

We're ready now to test our qubes.PdfConvert service: in the requesting VM, i.e. the one from which we want to initiate the conversion process we do:

[user@work Downloads]$ /usr/lib/qubes/qrexec_client_vm '$dispvm' qubes.PdfConvert /usr/lib/qubes/qpdf-convert-client ITLquote.pdf
-> Sending file to remote VM...
-> Waiting for converted samples...
-> Receving page 2 out of 2...
-> Merging pages into a single PDF document...
-> Converted PDF saved as: ITLquote.trusted.pdf
-> Original file saved as .ITLquote.pdf

Again, for development process I would replace '$dispvm' with something like 'devel-vm'.

The qrexec_client_vmcommand, used above, is not actually intended to be used by user directly (that's why it's installed in /usr/lib/qubes instead of /usr/bin/), and so when one creates a Qubes qrexec service, it's customary to create also a small wrapper around qrexec, like this one, that makes using the service simple.

The presented converter saves the original file as .${original_pdf}making it a hidden file to help the user avoid accidental opening. The new, converted file gets .trusted.pdfsuffix appended to the base name of the original file. I discuss more issues regarding the human factor and avoiding accidental opening in one of the next paragraphs below. The converter can also be used to convert essentially any image file, such as JPEG, PNG, etc, into a PDF, using the same method.

As you can see creating client-server services in Qubes is very simple – in fact it took me just one afternoon to get the inital working version of the converter (with subsequent "polishing" over the next 2 days).

The qrexec infrastructure takes care about all the under-the-hood tasks, such as starting the necessary VMs, e.g. creating Disposable VM to handle the service request,establishing communication channels between VMs (which are ultimately implemented on top of Xen's shared memory), redirecting client and server's stdin and stdout to each other, so that writing services is very simple, even in shell, and, of course, obeying policies defined centrally in Dom0.

Most “inter-VM” features in Qubes, such as secure file copy between domains, opening files in Disposable VMs, time synchronization, appmenus synchronization, etc, are all implemented on top of qrexec. A notable exception is clipboard exchange, which is implemented as part of the GUI protocol, but still uses the same common qrexec code for policy processing (e.g. I use this policy to block clipboard and file exchanges between my work and personal domains).

Limitations, other Simple Representations

The obvious disadvantage of converting a PDF to an RGB representation is that one looses text search, as well as copy and edit capabilities (e.g. in case of PDF forms). So, converting Intel's IA32 Software Developer's Manual this way would certainly not be a good idea... But, hey, such large PDFs can always be opened in a Disposable VM – they would be fully functional then, only that you would need to wait a few seconds for the PDF window to pop up. Or, better yet, why not keep all such PDFs in a dedicated domain? E.g. I have a VM called “work-pub” where I keep tons of various, publicly available PDFs, such as the mentioned Intel's SDM, as well as various chipset docs, conferences papers and slides, and generally lots of stuff. The key point is that all in this VM is public material (and also all is related to my work), so that I don't really care if any of those PDFs compromises my work-pub domain. In the worst case, I will revert the VM from backup and download any missing PDFs again from the web. They are public after all. 
 
But the PDF conversion described above comes extremely useful in case of all the various invoices, Purchase Orders, NDAs, contracts, and god-knows-what-else PDF documents, which I'm forced to deal with in my “work” domain (where my email client runs). Most of those are one pagers, or maximum a few pages long documents, so the fact that they got converted to a bitmap provides me with very little discomfort. At the same time I gain incredible freedom in opening all those documents natively in my work VM, without fearing that one of those invoices will comrpomise my work domain (which would be a rather sad thing for me, although the really sensitive stuff is still in some other domains ;)

An interesting question is, however, can we come up with another form of Simple Representation that would allow e.g. to preserve the text searching ability of the converted PDFs (and DOCs, PPTs)? Probably... yes. The choice of the Simple Representation should be thought of as of a trade-off between security and document's features preservation. I'm not an expert on PDF and DOC formats (and I'm not sure I want to be) but it seems plausible that one could disassemble PDF into simple pieces, select the really simple ones, send those pieces as a Simple Representation back to client, and have them reassembled back into a almost-fully-functional PDF. Here, again, the point is that the PDF parsing is done in isolated Disposable VM, while the reassembly in the trusted VM. Anyway, let me leave it as a exercise for the reader :)
 
Preventing user mistakes

Being able to right-click on a PDF file and have it converted into a trusted PDF is one thing. Having this mechanism adopted by users and actually making their daily computing safer, is another story.
Users will likely have hundreds of PDF spread over their home directories, and the real challenge is how to make sure that the user never accidentally opens the unconverted, untrusted PDF. We can think of several approaches to this problem:
  • We modify the Thunderbird, Firefox, etc, e.g. by providing specific plugins, to always perform PDF conversion on each file that we got via email or downloaded from the Web. Additionally we convert all the already present PDFs in the user's home directory (file system?). And, additionally, we modify Qubes file copy operation to also always do automatic PDF conversion whenever one transfers files from other domains (if Qubes qrexec policy allows for such transfer in the first place, of course).

This approach would not be optimal, because some PDFs, as we discussed above, might not be well suited for conversion-through-bitmap process – they might be large PDFs where text search is crucial, some conference papers for review, where text copy is crucial, or some editable forms. That's why it seems better to take a slightly different approach:
  • We modify mime handlers for PDF files (as well as any other files that our converter supports) and then upon every opening of the file (e.g. via mouse click in a file manager) our program gets to run and its job is to determine whether the file should be opened natively, converted to a trusted PDF, or perhaps opened in a Disposable VM. Of course, upon “first” opening we should probably ask the user about the decision, if this cannot be determined automatically. E.g. if we can reliably determine the file is already converted, we can safely open it without prompting the user, but if it's not, we should ask – perhaps the user would like to open it in a Disposable VM instead of converting, or perhaps the file should be considered trusted anyway, because it was created by the user herself.

This second approach seems like a way to go, and we will likely implement it sooner or later (probably sooner, but after the upcoming R2 Beta2). It should also be noted, that typically user would need such mechanism only in some domains – e.g. I really feel the need for such protection in my “work” domain, but not in any other. But that, of course, depends on how one partitions their digital life into security domains.

One important detail worth mentioning here, is that we should unconditionally disable “Thumbnail View” in whatever file manager we use (which itself is really a stupid feature – can people not read filenames anymore or something?).

Qubes: from containers isolation down to apps protection

The mechanism introduced today, in addition to the Disposable VMs mechanism introduced earlier, represents a trend in Qubes development of “stepping down” into AppVMs in order to also make the VMs themselves somehow more secure (in addition to the isolation between the VMs).

Originally Qubes aimed at containers isolation only. This included protecting the system TCB where techniques such as deprivileged networking stacks (and optionally also deprivileged USB stacks) have been deployed, as well as custom GUI virtualization, and generally somehow “hardened” Xen configuration. This also included protecting the VMs from each other, where techniques such as secure clipboard, secure file copy and generally secure qrexec infrastructure have been introduced, as well as trusted GUI subsystem with explicit domain decorations.

But now, Qubes is stepping down into the AppVMs in order to make the VMs themselves also less prone to compromise. We surely will be working on more such mechanisms in the future. We still are only at the beginning of the quest to create a Reasonably Secure Desktop OS!

PS. The presenetd converter will be part of the Qubes R2 Beta 2, that is expected to be released... in the comming days. Experienced users of Qubes R1 and R2 Beta 1 can install the converter immediately by building the rpms from the git repo.


PS. WTF is happening with the Blogger web interface? Seriously, I don't remember being so frustrated using any software in the recent years that I am right now, when editing this post (as well as the last several ones). It sometimes honours the line breaks, sometimes do not, sometimes inserts a couple of new lines, sometime removes them, sometime mysterious spaces appear at the end of lines, sometime those cannot be removed... It doesn't allow to paste pre-formatted code-listing (at least I couldn't figure out how to make it honour tabs). And yes, I'm using the "Compose mode", because when I try to switch to the HTML mode, not only I'm overwhelmed with tons of HTML markups, nobody knows what for, but also when I switch back to the Compose mode, my article tends to get even more fucked up! Really, a shame. I wish I could go away to some other blogging service, but I'm afraid that converting all my posts would be even a bigger PITA... Sigh.
\ No newline at end of file diff --git a/_posts/2013-02-28-qubes-2-beta-2-has-been-released.html b/_posts/2013-02-28-qubes-2-beta-2-has-been-released.html deleted file mode 100644 index efa579f..0000000 --- a/_posts/2013-02-28-qubes-2-beta-2-has-been-released.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Qubes 2 Beta 2 has been released! -date: '2013-02-28T19:26:00.002+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2013-02-28T19:26:09.671+01:00' -thumbnail: http://4.bp.blogspot.com/-0JE2dw3GsfA/US-a83j442I/AAAAAAAAAKc/peSktYNQeec/s72-c/r2b2-kde-start-menu.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-7559919355447471448 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/02/qubes-2-beta-2-has-been-released.html ---- - -
Qubes R2 Beta 2 with KDE 4.9 environment (click for more screenshots)


We're progressing fast and today I would like to announce the release of Qubes R2 Beta 2 ISO. The installation and upgrade instructions, as well as the ISO itself, can be found via the our wiki page. As usual, please remember to verify the digital signature of the downloaded ISO.

The major changes in this beta release include:
  • Upgraded Dom0 distribution to the latest Fedora 18 (all previous releases used Fedora 13 for Dom0!)
  • Upgraded default VM template also to Fedora 18
  • Upgraded Dom0 kernel to 3.7.6
  • Upgraded KDE environment in Dom0 (KDE 4.9)
  • Introduced Xfce 4.10 environment for Dom0 as an alternative to KDE
  • A few other fixes and improvements, including the recently discussed Disposable VM-based PDF converter

The upgrade of the Dom0 distribution and kernel should significantly improve hardware compatibility – one of the major problems with Qubes adoption so far, as we hear. Now, with the latest GPU drivers and Xorg packages, I hope we will be able to cover a much boarder range of hardware (especially all the newer GPUs).

The upgrade of KDE in Dom0 is mostly an eye-candy type of improvement (but then, who doesn't like eye candies!), as is the introduction of the Xfce4 as its alternative, although, arguably, Xfce4 is considered faster and lighter than KDE. In Qubes the choice of an actual desktop environment that runs in Dom0 is not as important as it is on traditional Linux systems, I think, simply because most of the functionality, typically provided by such environments, such as apps and file management, is simply... disabled, because on Qubes there are no user apps or files in Dom0.

Nevertheless people love and hate particular window managers and environments, and we hope that now, by supporting alternative environments, we could appeal to even more users.

I'm glad that we just completed this difficult phase of upgrading Qubes Dom0 distribution (for the first time since Qubes R1 Beta 1!) -- this forced us to clean up the code and prepare for some even bigger and bolder changes in the near future. But those will come only in Release 3. As far as Release 2 is considered, we do have quite a few more tickets scheduled for R2 Beta 3 milestone, but most of those represent various addons, rather than modifications to Qubes core software.

So what are those brave changes that are to happen in Release 3? That I will write about in a separate blog post... Stay tuned!

So, please enjoy this latest Qubes R2 beta release, and be sure to send all your questions and comments, as well as the HCL info, to the qubes-devel mailing list. I have already upgraded my primary laptop to this release a few days ago and everything seems to be working fine, so fear not!
\ No newline at end of file diff --git a/_posts/2013-03-21-introducing-qubes-odyssey-framework.html b/_posts/2013-03-21-introducing-qubes-odyssey-framework.html deleted file mode 100644 index 1203949..0000000 --- a/_posts/2013-03-21-introducing-qubes-odyssey-framework.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Introducing Qubes Odyssey Framework -date: '2013-03-21T17:47:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:26:11.508+01:00' -thumbnail: http://3.bp.blogspot.com/-x0nnYdPBMWY/UUsxEwJCxhI/AAAAAAAAAKs/_jpzGFGXT4k/s72-c/Qubes+Odyssey+Diagrams+1.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-7660168967011899954 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/03/introducing-qubes-odyssey-framework.html ---- - -
Qubes OS is becoming more and more advanced, polished, and user friendly OS.
But Qubes OS, even as advanced as it is now, surely have its limitations. Limitations, that for some users might be difficult to accept, and might discourage them from even trying out the OS. One such limitation is lack of 3D graphics support for applications running in AppVMs. Another one is still-far-from-ideal hardware compatibility – a somehow inherent problem for most (all?) Linux-based systems.
There is also one more “limitation” of Qubes OS, particularly difficult to overcome... Namely that it is a standalone Operating System, not an application that could be installed inside the user's existing OS. While installing a new application that increases system's security is a no-brianer for most people, switching to a new, exotic OS, is quite a different story...
Before I discuss how we plan to address those limitations, let's first make a quick digression about what Qubes reallyis, as many people often get that wrong...
What Qubes IS, and what Qubes IS NOT?
Qubes surely is not Xen! Qubes only usesXen to create isolatedcontainers – security domains (or zones). Qubes also is not a Linux distribution! Sure, we currently use Fedora 18 as the default template for AppVMs, but at the same time we also support Windows VMs. And while we also use Linux as GUI and admin domain, we could really use something different – e.g. Windows as GUI domain.
So, what is Qubes then? Qubes (note how I've suddenly dropped the OS suffix) is several things:
  • The way how to configure, harden, and use the VMM (e.g. Xen) to create isolated security domains, and to minimize overall system TCB.
  • Secure GUI virtualization that provides strong gui isolation, while at the same time, provides also seamless integration of all applications running in different VMs onto one common desktop. Plus a customized GUI environment, including trusted Window Manager that provides unspoofable decorations for the applications' windows.
  • Secure inter-domain communication and services infrastructure with centrally enforced policy engine. Plus some “core” services built on top of this, such as secure file exchange between domains.
  • Various additional services, or “addons”, built on top of Qubes infrastructure, such as Disposable VMs, Split GPG, TorVM, Trusted PDF converter, etc. These are just few examples, as basically the sky is the limit here.
  • Various additional customizations to all the guest OSes that run in various domains: GUI, Admin, ServiceVMs, and AppVMs.
Introducing Qubes HAL: Hypervisor Abstraction Layer
Because Qubes is a bunch of technologies and approaches that are mostly independent from the underlying hypervisor, as discussed above, it's quite natural to consider if we could easily build an abstraction layer to allow the use of different VMMs with Qubes, instead of just Xen? Turns out this is not as difficult as we originally thought, and this is exactly the direction we're taking right now with Qubes Odyssey! To make this possible we're going to use the libvirt project.
So, we might imagine Qubes that is based on Hyper-V or even Virtual Box or VMWare Workstation. In the case of the last two Qubes would no longer be a standalone OS, but rather an “application” that one installs on top of an existing OS, such as Windows. The obvious advantage we're gaining here is improved hardware compatibility, and ease of deployment.
And we can go even further and ask: why not use Windows Native Isolation, i.e. mechanisms such as user account separation, process isolation, and ACLs, to implement domain isolation? In other words why not use Windows OS as a kind of “VMM”? This would further dramatically improve then lightness of the system...
Of course the price we pay for all this is progressively degraded security, as e.g. Virtual Box cannot be a match to Xen in terms of security, both architecturally and implementation-wise, and not to mention the quality of isolation provided by the Windows kernel, which is even less.

 
But on the other hand, it's still better than using “just Windows” which offers essentially only one “zone”, so no domain isolation at all! And if we can get, with minimal effort, most of our Qubes code to work with all those various isolation providers then... why not?
Being able to seamlessly switch between various hypervisors is only part of the story, of course. The remaining part is the support for different OSes used for various Qubes domains. Currently we use Linux, specifically Fedora 18, in our GUI & Admin domain, but there is no fundamental reason why we couldn't use Windows there instead. We discuss this more in-depth in one of the paragraphs below.
The diagram below tries to illustrate the trade-offs between hardware compatibility and ease of deployment vs. security when using different isolation backends with Qubes. Some variants might also offer additional benefits, such as “super-lightness” in terms of CPU and memory resources required, as is the case with Windows Native Isolation.

 
Some example configurations
Let's now discuss two extreme variants of Qubes – one based on the baremetal Xen hypervisor and the other one based on Windows Native Isolation, so a variant from the opposite endof the spectrum (as shown on the illustration above).
The diagram below shows a configuration that uses a decent baremetal hypervisor, such as Xen, with abilities to securely assign devices to untrusted service domains(NetVM, UsbVM). So, this is very similar to the current Qubes OS.

 
Additionally weseeseparate GUI and Admin domains:the GUI domain might perhaps be based on Windows, to provide users with a familiar UI, while the Admin domain, tasked with domain management and policy enforcement,might be based on some minimal Linux distribution.
In the current Qubes OS there is no distinction between a GUI and an Admin domain --both are hosted within one domain called “dom0”. But in some cases there are benefits of separating the GUI domain from the Admin domain. In a corporate scenario, for example, the Admin domain might be accessible only to the IT department and not to the end user. This way the user wouldhave no way of modifying system-wide policies, and e.g. allowing their “work” domain to suddenly talk to the wild open Internet, or to copy workproject files from “work” to “personal” domains(save for the exotic, low-bandwidthcovert channels, such as through CPU cache).
The ability to deprivilege networking and USB stacks by assigning corresponding devices (NICs, and USB controllers) to untrusted, or semi-trused, domains provides great security benefits. This automatically prevents various attacks against the bugs in WiFi stacks or USB stacks.
What is not seen on the diagram, but what is typical for baremetal hypervisors is that they are usually much smaller than hosted hypervisors, implementing less services, and delegating most tasks, such as the infamous I/O emulation to (often)unprivileged VMs.
Let's now look at the other extreme example of using Qubes – the diagram below shows an architecture of a “Qubized” Windows system that uses either a hosted VMM, such as Virtual Box or VMWare Workstation, or even the previously mentioned Windows Native Isolation mechanisms, as an isolation provider for domains.
 

Of course this architecture lacks many benefits discussed above, such as untrusted domains for networking and USB stacks, small hypervisors, etc. But it still can be used to implement multiple security domains, at amuch lower “price”: better hardware compatibility, easier deployment, and in case of Windows Native Isolation – excellent performance.
And it really can be made reasonable, although it might require more effort  than it might seem at first sight. Take Windows Native Isolation – of course just creating different user accounts to represent different domains is not enough, because Windows still doesn't implement true GUI-level isolation. Nor network isolation. So, there is a challenge to do it right, and “right” in this case means to make the isolation as good as the Windows kernel can isolate processes from different users from each other.
Sure, a single kernel exploit destroys this all, but it's still better than “one application can (legally) read all my files” policy that 99% of all desktop OSes out there essentially implement today.
Now, probably the best thing with all this is that once we implement a product based on, say, Qubes for Windows, together with various cool “addons” that will take advantage of the Qubes services infrastructure, and which shall be product-specific, it should then be really easy to upgrade to another VMM, say Hyper-V to boost security. And the users shall not even notice a change in the UI, save for the performance degradation perhaps (well, clearly automatic creation of VMs to handle various users tasks would be more costly on Hyper-V than with Windows Native Isolation, where “VMs” are just... processes).
Qubes building blocks – implementation details
Let's have a look now at the repository layout for the latest Qubes OSsources – every name listed below represents a separate code repository that corresponds to a logical module, or a building block of a Qubes system:
core-admin
core-admin-linux
core-agent-linux
core-agent-windows
core-vchan-xen
desktop-linux-kde
desktop-linux-xfce4
gui-agent-linux
gui-agent-windows
gui-agent-xen-hvm-stubdom
gui-common
gui-daemon
linux-dom0-updates
linux-installer-qubes-os
linux-kernel
linux-template-builder
linux-utils
linux-yum
qubes-app-linux-pdf-converter
qubes-app-linux-split-gpg
qubes-app-linux-tor
qubes-app-thunderbird
qubes-builder
qubes-manager
vmm-xen
vmm-xen-windows-pvdrivers

Because current Qubes R2 still doesn't use HAL layer to support different hypervisors, it can currently be used with only one hypervisor, namely Xen, whose code is provided by the vmm-xenrepository (in an ideal world we would be just using vanilla Xen instead of buildingour own from sources, but in reality we like the ability to build it ourselves, slightly modifying some things).
Once we move towards the Qubes Odyssey architecture (essentially by replacing thehardcoded calls to Xen's management stack, in the core-adminmodule, with libvirt calls), we could then easily switch Xen for other hypervisors, such as Hyper-V or Virtual Box. In case of Hyper-V we would not have access to the sources of the VMM, of course, so would just be using the stock binaries, although we still might want to maintain thevmm-hyperv repository that could contain various hardening scripts and configuration files for this VMM. Or might not. Also, chances are high that we would be just able to use the stock libvirt driversfor Hyper-V or Virtual Box,so no need for creating core-libvirt-hypervor core-libvirt-virtualboxbackends.
What we will need to provide, is ourcustom inter-domaincommunication library for each hypervisor supported.This means we will need to write core-vchan-hypervor core-vchan-virtualbox. Most (all?) VMMs do provide some kind of API for inter-VM communication (or at least VM-host communication), so the main task of such component is to wrap the VMM-custom mechanism with Qubes-standarizedAPI for vchan (and this standardization is one thing we're currently working on). All in all, in most cases this will be asimple task.
If we, on the other hand, wanted to support an “exotic” VMM, such as the previously mentioned Windows Native Isolation, which is not really a true VMM, then we will need to write our own libvirt backend to support is:
core-libvirt-windows
... as well as the corresponding vchan module (which should be especially trivial to write in this case):
core-vchan-windows
Additionally, if we're building a system where the Admin domain is not based on Linux, which would likely be the case if we used Hyper-V, or Virtual Box for Windows, or, especially, Windows Native Isolation, then we should also provide core-admin-windowsmodule, that, among other things, should provide Qubes qrexecimplementation, something that is highly OS-dependent.
As can be seen above, we currently only have core-admin-linux, which is understandable as we currently use Linux in Dom0. But the good news is that we only need to write core-admin-XXXonce for each OS that is to be supported as an Admin domain, asthis code should not be depend on the actual VMM used (thanks to our smart HAL).
Similarly, we also need to assure that our gui-daemoncan run on the OS that is to be used as a GUI domain (again, in most cases GUI domain would be the same as Admin domain, but not always). Here the situation is generally much easier because “with just a few #ifdefs” our current GUIdaemon should compile and run on most OSes, from Linux/Xorg to Windows and Macs (which is the reason we only have one gui-daemonrepository, instead of several gui-daemon-XXX).
Finally we should provide some code that will gather all the components neededfor our specific product and package this all into either an installable ISO, if Qubes is to be a standalone OS, like current Qubes,or into an executable, in case Qubes is to be an “application”. The installer, depending on the product, might do some cool things, such as e.g. take current user system and automatically move it into one of Qubes domains.
To summary, these would be the components needed to build “Qubes for Windows” product:
core-admin
core-admin-windows
core-agent-windows
core-vchan-windows
core-libvirt-windows
desktop-windows
gui-agent-windows
gui-common
gui-daemon
windows-installer-qubes-for-windows
qubes-builder
qubes-manager

Additionally we will likely need a few qubes-app-*modules that would implement some "addons", such as perhaps automatic links and documents opening in specific VMs, e.g.:
qubes-app-windows-mime-handlers
Here, again, the sky's the limit and this is specifically the area where each vendor can go to great lenghts and build killer apps using our Qubes framework.
Now, if we wanted to create "Qubes for Hyper-V" we would need the following components:
core-admin
core-admin-windows
core-agent-linux
core-agent-windows
core-vchan-hyperv
desktop-windows
gui-agent-linux
gui-agent-windows
gui-common
gui-daemon
windows-installer-qubes-hyperv
qubes-app-XXX
qubes-builder
qubes-manager
vmm-hyperv

Here, as an example, I also left optional core-agent-linux and gui-agent-linux components (the same that are to be used with Xen-based Qubes OS) to allow support for also Linux-based VMs – if we can get those “for free”, then why not!
It should be striking how many of those components are the same in both of those two cases – essentially the only differences are made by the use of different vmm-* components and, of course, the different installer
It should be also clear now how this framework now enables seamless upgrades from one product (say Qubes for Windows) to another (say Qubes for Hyper-V).
Licensing
Our business model assumes working with vendors, as opposed to end users, and licensing to them various code modules needed to create products based on Qubes.
All the code that comprises the base foundation needed for creation of any Qubes variant (so core-admin, gui-common, gui-daemon, qubes-builderand qubes-manager) will be kept open source, GPL specifically. Additionally all the code needed for building of Xen-based Qubes OS with Linux-based AppVMs and Linux-based GUI and Admin domains, will continue to be available as open source. This is to ensure Qubes OS R3 that will be based on this framework, can remain fully open source (GPL).
Additionally we plan to double-license this core open source code to vendors who would like to use it in proprietary products and who would not like to be forced, by the GPL license, to share the (modified) sources.
All the other modules, especially those developed to support other VMMs (Hyper-V, Virtual Box, Windows Native Isolation), as well as those to support Windows OS (gui-agent-windows, core-agent-windows, core-admin-windows, etc) will most likely be proprietary and will be available only to vendors who decide to work with us and buy a license.
So, if you want to develop an open source product that uses Qubes framework, then you can freely do that as all the required core components for this will be open sourced. But if you would like to make a proprietary product, then you should buy a license from us. I think this is a pretty fair deal.
Current status and roadmap
We're currently working on two fronts: one is rewriting current Qubes code to support Qubes HAL, while the other one is adding a backend for Windows Native Isolation (which also involves doing things such as GUI isolation right on Windows).
We believe that by implementing two such extreme backends: Xen and Windows Native Isolation we can best show the flexibility of the framework (plus our customer is especially interested in this backend;)
We should be able to publish some code, i.e. the framework together with early Qubes OS R3 that will be based on it, sometime in fall or maybe earlier.
We obviously are determined to further develop Xen-based Qubes OS, because we believe this is the most practically secure OS available today, and we believe such OS should be open source.
Qubes R2 will still be based on the Xen-hardcoded code, because it's close to the final release and we don't want to introduce such drastic changes at this stage. The only thing that Qubes R2 will get in common with Qubes Odyssey is this new source code layout as presented above (but still with hardcoded xl calls and xen-vchan).
So, this is all really exciting and a big thing, let's see if we can change the industry with this :)
Oh, and BTW, some readers might be wondering why the framework was codenamed “Odyssey” -- this is obviously because of the “HAL” which plays a central role here, and which, of course, also brings to mind the famous Kubrick's movie.
\ No newline at end of file diff --git a/_posts/2013-06-21-qubes-os-r3-alpha-preview-odyssey-hal.html b/_posts/2013-06-21-qubes-os-r3-alpha-preview-odyssey-hal.html deleted file mode 100644 index 0cbeb9d..0000000 --- a/_posts/2013-06-21-qubes-os-r3-alpha-preview-odyssey-hal.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: 'Qubes OS R3 Alpha preview: Odyssey HAL in action!' -date: '2013-06-21T12:15:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2013-06-22T10:56:16.820+02:00' -thumbnail: http://3.bp.blogspot.com/--nDYFJy9De8/UcMVFM2mygI/AAAAAAAAALg/EJORWNCQNTI/s72-c/r3a1-konsoles.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-5526599582625415637 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/06/qubes-os-r3-alpha-preview-odyssey-hal.html ---- - -
In a previous postI have outlined a new direction we're aiming with the Qubes project, which is a departure from using a “hardcoded” hypervisor with Qubes (as well as “hardcoded” Linux as Dom0, GUI domain, etc).

Today I'm happy to announce that we've already completed initial porting of the current Qubes OS into this Hypervisor-Abstraction-Layer-based framework. The new version of Qubes, that we call “R3 Alpha” for now, builds fine, installs fine, and even (mostly) works(!), as can be admired on the screenshot below :) It still uses Xen, of course, but this time in a non-hardcoded way, which allows to replace it easily with another hypervisor, as I discuss below.


Our Qubes Odyssey backendneeded to support a specific hypervisor comprises essentially three parts:
  1. A libvirt driver to support a given VMM. In our case we got it (almost) for free, because Xen 4.2 is well supported by libvirt. I wrote “almost” for free, because some patches to libvirt were still needed, mostly to get rid of some unjustified simplifying assumptions, such as that all the backends are always in Dom0, which is not the case for Qubes OS, of course. Some of those patches were accepted into upstream libvirt, some (still) not, so we had to fork libvirt.
  2. A VMM-specific implementation of our vchan – a simple, socket-like, VMM shared memory-based communication stack between the VMs. Again, in case of Xen 4.2 we got that (almost) for free, because Xen 4.2 has now included a libxenvchan component, which is modified (improved and cleaned up) version of our original vchan (written in early Qubes days for older Xen versions) contributed and maintained by Daniel De Graff from the NSA.
  3. Some minor configuration files, e.g. to tell libvirt which hypervisor protocol to use (in our case: xen:///), and VM configuration template files.
Now, if one wanted to switch Xen for some other hypervisor, such as e.g. the KVM, we would need to write a KVM Odyssey backend in a form of providing the above mentioned three elements. Again, libvirt driver we would get for free, configuration files would be trivial to write, and the only task which would require some coding would be the vchan for KVM.

Ok, one thing that is left out (non-HAL'ified) for now, is the xc_map_foreign_pages() Xen-specific function call within our GUI daemon.

Ideally such call could also be handled by the libvirt API, however it's not clear to us whether true zero-copy page access is really supported (and intended). If it is not, we will try to contribute a patch to libvirt to add such functionality, as it is generally useful for many things that involve high-speed inter-VM communication, of which our GUI virtualization is just one example. So, at this moment, one would need to add an ugly #if (BACKEND_VMM == ...) to the code above and use another VMM's function(s), equivalent to the xc_map_foreign_pages() on Xen.

But besides the above, essentially everything else should Just Work (TM). And that's pretty amazing, I think :) While I personally can't immediately see any security benefit of switching from Xen to KVM, it might appeal to some people for other reasons (Performance? Better hardware support?). The point is: this should be now easy to do.

If one wanted to support some Windows-based hypervisor, on the other hand, such as MS Hyper-V, or Virtual Box on top of Windows, then two more things will need to be taken care of:

  1. Our core management stack (the core-admin repository), the core RPC services (mostly the qrexec daemon, currently part of core-admin-linux repo), and the libvirt code (core-libvirt, a forked original libvirt with some custom patches I mentioned above), all would need to build and run fine on Windows. While this is not a big problem for core-admin (it's all python) and core-libvirt (it is supposed to build and run on Windows fine), the qrexec daemon would need to be rewritten with Windows OS in mind. We're currently working on this step, BTW.
  2. The GUI daemon would also need to be ported to run on Windows, instead of on top of X Server. This is somehow orthogonal to the need to get rid of the hardcoded xc_map_foreign_pages() function as mentioned above. This step might be optional, however, if we wanted to use a Linux-based (and so Xorg-based GUI server) as a GUI domain.

Once the above two pieces are made Windows-ready (note how I wrote Windows-ready, and not specific-VMM-ready), we can then use any Windows-based hypervisor we want (i.e. for which we have libvirt driver, and can write vchan).

This is again pretty amazing, because it means we don't need N*M variations of each component (where N is the number of VMMs, and M the number of host/GUI OSes to support) – but only N+M! This is similar to how modern compilers are designed using a language-specific frontends (C, C++, Pascal, C#, etc), and architecture-specific backends (x86, x64, ARM, etc), and an Intermediate Language for internal “grinding”, again achieving this N+M number of needed variants instead of N*M, which otherwise would be just totally impractical.

One other detail I would like to point out, and which is also visible on the screenshot above, is that we also got rid of using the Xen-specific Xenstore infrastructure (a registry-like tree-based infrastructure for inter-VM configuration and status exchange), and we replaced it with our own, vchan-based Qubes DB (core-qubesdb).

One interesting thing about Qubes DB is that it get rids of the (overly complex and unnecessary) permission system that is used by xenstore, and instead uses the most simple approach: each VM has its separate Qubes DB daemon, and so a totally separate configuration/state namespace. This is inline with the rest of the Qubes philosophy, which basically says that: permissions is dead, long live separation!

So, in Qubes OS we just isolate everything by default, unless a user/configuration specifically allows an exception – e.g. no file copy operation between domains is possible, unless the user expresses an explicit consent for it.

Many old-school security people can't imagine a system without permissions, but if wethink about it more, we might get to a conclusion that: 1) permissions are complex and so often difficult to understand and set correctly, 2) require often complex code to parse and make security decisions, and 3) often are absolutely unneeded.

As a practical example of how permissions schemes might sometime trick even (otherwise somehow smart) developersinto making a mistake consider this bug in Qubes we made a long time ago when setting permissions on some xenstore key, which resulted in some information leak (not much of a security problem in general, but still). And just today, Xen.org has published this advisory, that sounds pretty serious, again caused by bad permissions on some xenstore keys. (Yes, we do have updated Xen packages to fix that, of course).

Back to Qubes R3 Alpha, the first successful Qubes based on Odyssey HAL framework. As previously mentioned, we plan to make most of the framework open sourced, specifically all the non-Windows code. However, we're not publishing this Odyssey/R3 code at this moment, mainly for two reasons: 1) we don't want people to immediately start building other backends, such as to support KVM, right at this stage, because we still might want/need to modify some interfaces slightly, e.g. for our vchan, and we don't want to tide our hands now, and 2) the other reason is that we're still in the middle of “Beta” releases for Qubes R2, and we want people to rather focus on testing that, rather stable release, than jumping onto Qubes R3 alpha.

In other news: everybody seems to be genuinely surprised that unencrypted information can be intercepted and analyzed without user consent... Can it be that people will "discover" cryptography now? How many of you use PGP everyday? And how long will it take then to understand that cryptography without secure client devices is useless?
\ No newline at end of file diff --git a/_posts/2013-08-30-thoughts-on-intels-upcoming-software.html b/_posts/2013-08-30-thoughts-on-intels-upcoming-software.html deleted file mode 100644 index bc9a155..0000000 --- a/_posts/2013-08-30-thoughts-on-intels-upcoming-software.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Thoughts on Intel's upcoming Software Guard Extensions (Part 1) -date: '2013-08-30T14:14:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2013-08-30T14:14:10.001+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-8440793216705036426 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/08/thoughts-on-intels-upcoming-software.html ---- - -
Intel Software Guard Extensions (SGX) might very well be The Next Big Thing coming to our industry, since the introduction of Intel VT-d, VT-x, and TXT technologies in the previous decade. It apparently seem to promise what so far has never been possible – an ability to create a secure enclavewithin a potentially compromised OS. It sounds just too great, so I decided to take a closer look and share some early thoughts on this technology.

Intel SGX – secure enclaves within untrustedworld!

Intel SGX is an upcoming technology, and there is very little public documents about it at the moment. In fact the only public papers and presentations about SGX can be found in the agenda of one security workshop that took place some two months ago. The three papers from Intel engineers presented there provide a reasonably good technical introduction to those new processor extensions.

You might think about SGX as of a next generation of Intel TXT – a technology that has never really took off, and which has had a long history of security problems disclosed by certain team of researchers ;) Intel TXT has also been perhaps the most misunderstood technology from Intel – in fact many people thought about TXT as if it already could provide security enclaves within untrusted OS – this however was not really true (even ignoring for our multiple attacks) and I have spoke and wrote many times about that in the past years.

It's not clear to me when SGX will make it to the CPUs that we could buy in local shops around the corner. I would be assuming we're talking about 3-5 years from now, because the SGX is not even described in the Intel SDM at this moment.

Intel SGX is essentially a new mode of execution on the CPU, a new memory protection semantic, plus a couple of new instructions to manage this all. So, you create an enclave by filling its protected pages with desired code, then you lock it down, measure the code there, and if everything's fine, you ask the processor to start executing the code inside the enclave. Since now on, no entity, including the kernel (ring 0) or hypervisor (ring “-1”), or SMM (ring “-2”) or AMT (ring “-3”), has no right to read nor write the memory pages belonging to the enclave. Simple as that!

Why have we had to wait so long for such technology? Ok, it's not really that simple, because we need some form of attestation or sealing to make sure that the enclave was really loaded with good code.

The cool thing about an SGX enclave is that it can coexist (and so, co-execute) together with other code, such all the untrusted OS code. There is no need to stop or pause the main OS, and boot into a new stub mini-OS, like it was with the TXT (this is what e.g. Flicker tried to do, and which was very clumsy). Additionally, there can be multiple enclaves, mutually untrusted, all executing at the same time.

No more stinkin' TPMs nor BIOSes to trust!

A nice surprise is that SGX infrastructure no longer depends on the TPM to do measurements, sealing and attestation. Instead Intel has a special enclave that essentially emulates the TPM. This is a smart move, and doesn't decrease security in my opinion. It surely makes us now trust only Intel vs. trusting Intel plus some-asian-TPM-vendor. While it might sound like a good idea to spread the trust between two or more vendors, this only really makes sense if the relation between trusting those vendors is expressed as “AND”, while in this case the relation is, unfortunately of “OR” type – if the private EK key gets leaked from the TPM manufacture, we can bypass any remote attestation, and no longer we need any failure on the Intel's side. Similarly, if Intel was to have a backdoor in their processors, this would be just enough to sabotage all our security, even if the TPM manufacture was decent and played fair.

Because of this, it's generally good that SGX allows us to shrink the number of entities we need to trust down to just one: Intel processor (which, these days include the CPUs as well as the memory controller, and, often, also a GPU). Just to remind – today, even with a sophisticated operating system architecture like those we use in Qubes OS, which is designed with decomposition and minimizing trust in mind, we still need to trust the BIOS and the TPM, in addition to the processor.

And, of course, because SGX enclaves memories are protected against any other processor mode's access, so SMM backdoor no longer can compromise our protected code (in contrast to TXT, where SMM can subvert a TXT-loaded hypervisor), nor any other entity, such as the infamous AMT, or malicious GPU, should be able to do that.

So, this is all very good. However...

Secure Input and Output (for Humans)

For any piece of code to be somehow useful, there must be a secure way to interact with it. In case of servers, this could be implemented by e.g. including the SSL endpoint inside the protected enclave. However for most applications that run on a client system, ability to interact with the user via screen and keyboard is a must. So, one of the most important questions is how does Intel SGX secures output to the screen from an SGX enclave, as well as how does it ensure that the input the enclave gets is indeed the input the user intended?

Interestingly, this subject is not very thoroughly discussed in the Intel papers mentioned above. In fact only one paper briefly mentions Intel Protected Audio Video Path (PVAP) technology that apparently could be used to provide secured output to the screen. The paper then references... a consumer FAQ onBlueRay Disc Playback using Intel HD graphics. There is no further technical details and I was also unable to find any technical document from Intel about this technology. Additionally this same paper admits that, as of now, there is no protected inputtechnology available, even on prototype level, although they promise to work on that in the future.

This might not sound very surprising – after all one doesn't need to be a genius to figure out that the main driving force behind this whole SGX thing is the DRM, and specifically protecting Holywwod media against the pirate industry. This would be nothing wrong in itself, assuming, however, the technology could also have some other usages, that could really improve security of the user (in contrast to the security of the media companies).

We shall remember that all the secrets, keys, tokens, and smart-cards, are ultimately to allow the user to access some information. And how does people access information? By viewing in on a computer screen. I know, I know, this so retro, but until we have direct PC-brain interfaces, I'm afraid that's the only way. Without properly securing the graphics output, all the secrets can be ultimately leaked out.

Also, how people command their computers and applications? Well, again using this retro thing called keyboard and mouse (touchpad). However secure our enclave might be, without secured input, the app would not be able to distinguish intended user input from simulated input crafted by malware. Not to mention about such obvious attacks as sniffing of the user input.

Without protected input and output, SGX might be able to stop the malware from stealing the user's private keys for email encryption or issuing bank transactions, yet the malware will still be able to command this super-secured software to e.g. decrypt all the user emails and later steal the screenshots of all the plaintext messages (with a bit of simple programming, the screenshot's could be turned back into nice ASCII text for saving on bandwidth when leaking them out to a server in Hong Kong), or better yet, perhaps just forward them to an email address that the attacker controls (perhaps still encrypted, but using the attackers key).

But, let's ignore for a moment this “little issue” of lack of protected input, and lack of technical documentation on how secure graphics output is really implemented. Surely it is thinkable that protected input and output could be implemented in a number of ways, and so let's hope Intel will do it, and will do right. We should remember here, that whatever mechanism Intel is going to use to secure the graphics and audio output, it surely will be an attractive target of attacks, as there is probably a huge money incentive for such attacks in the film illegal copying business.

Securing mainstream client OSes and why this is not so simple?

As mentioned above, for SGX enclaves to be truly meaningful on client systems we need protected input and output, to and from the secured enclaves. Anyway, lets assume for now that Intel has come up with robust mechanisms to provide these. Let's now consider further, how SGX could be used to turn our current mainstream desktop systems into reasonably secure bastions.

We start with a simple scenario – a dedicated application for viewing of incoming encrypted files, say PDFs, performing their decryption and signature verification., and displaying of the final outcome to the user (via protected graphics path). The application takes care about all the key management too. All this happens, of coruse, inside an SGX enclave(s).

Now, this sounds all attractive and surely could be implemented using the SGX. But what about if we wanted our secure document viewer to become a bit more than just a viewer? What if we wanted a secure version of MS Word or Excel, with its full ability to open complex documents and edit them?

Well it's obviously not enough to just put the proverbial msword.exe into a SGXenclave. It is not, because the msword.exe makes use of million of other things that are provided by the OS and 3rdlibraries, in order to perform all sorts of tasks it is supposed to do. It is not a straightforward decision to draw a line between those parts that are security sensitive and those that are not. Is font parsing security critical? Is drawing proper labels on GUI buttons and menu lists security critical? Is rendering of various objects that are part of the (decrypted) document, such as pictures, security critical? Is spellchecking security critical? Even if the function of some of a subsystem seem not security critical (i.e. not allows to easily leakthe plaintext document out of the enclave), let's not forget that all this 3rdparty code would be interacting very closely with the enclave-contained code. This means the attack surface exposed to all those untrusted 3rdparty modules will be rather huge. And we already know it is rather not possible to write a rendererfor such complex documents as PDFs, DOCs, XLS, etc, without introducing tons of exploitable bugs.And these attack are not coming now from the potentially malicious documents (against thosewe protect, somehow, by parsing only signed document from trusted peers), but are coming from the compromised OS.

Perhaps it would be possible to take Adobe Reader, MS Word, Powerpoint, Excel etc, and just rewrite every of those apps from scratch in a way that they wereproperly decomposed into sensitive parts that execute within SGC enclave(s), and those that are not-sensitive and make use of all the OS-providedfunctionality, and further define clean and simple interfaces between those parts, ensuring the “dirty” code cannot exploit the sensitive code. Somehow attractive, but somehow I don't see this happening anytime soon.

But, perhaps, it would be easier to do something different – just take the whole msword.exe, all the DLLs it depends on, as well as all the OS subsystems it depends on, such as the GUI subsystem, and put all of this into an enclave. This sounds like a more rational approach, and also more secure.

Only notice one thing – we just created... a Virtual Machine with Windows OS inside and the msword.exe that uses this Windows OS.. Sure, it is not a VT-x-based VM, it is an SGX-based VM now, but it is largely the same animal!

Again, we came to the conclusion why the use of VMs is suddenly perceived as such an increase in security (which some people cannot get, claiming that introducing VM-layer only increases complexity) – the use of VMs is profitable because of one of thing: it suddenly packs all the fat libraries- and OS-exposed APIs and subsystems into one security domain, reducing all the interfaces between this code in the VM and the outside world. Reducing of the interfaces between two security domains is ALWAYS desirable.

But our SGX-isolated VMs have one significant advantage over the other VM technologies we got used to in the last decade or so – namely those VMs can now be impenetrable to any other entity outside of the VM. No kernel or hypervisor can peek into its memory. Neither can the SMM, AMT, or even a determined physical attacker with DRAM emulator, because SGX automatically encrypts any data that leave the processor, so everything that is in the DRAM is encrypted and useless to the physical attacker.

This is a significant achievement. Of course SGX, strictly speaking, is not a (full) virtualization technology, it's not going to replace VT-x.. But remember we don't always need full virtualization, like VT-x, often we can use paravirtualization and all we need in that case is a good isolation technology. For examaple, Xen usesparavirtualizationfor Linux-based PV VMs, and usesgood-old ring3/ring0 separation mechanism to implement this, and the level of isolation of such PV domains on Xen is comparable to the isolation of HVMs, which are virtualized using VT-x.

To Be Continued

In the next part of this article, we will look into some interesting unconventional uses of SGX, such as creating malware that cannot be reversed engineered, or TOR nodes or Bitcoin mixers that should be reasonably trusted, even if we don't trust theiroperators. Then we will discuss how SGX might profoundly change the architecture of the future operating systems, and virtualization systems, in a way that we will no longer need to trust (large portions of) their kernels or hypervisors, or system admins (Anti Snowden Protection?) And, of course, how our Qubes OS might embrace this technology in the future.

Finally, we should discuss the important issue of whether this whole SGX, while providing many great benefits for system architects, should really be blindly trusted? What are the chances of Intel building in backdoors there and exposing those to the NSA? Is there any difference in trusting Intel processors today vs. trusting the SGX as a basis of security model of all software in the future?

\ No newline at end of file diff --git a/_posts/2013-09-23-thoughts-on-intels-upcoming-software.html b/_posts/2013-09-23-thoughts-on-intels-upcoming-software.html deleted file mode 100644 index 4cac8be..0000000 --- a/_posts/2013-09-23-thoughts-on-intels-upcoming-software.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Thoughts on Intel's upcoming Software Guard Extensions (Part 2) -date: '2013-09-23T19:35:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:25:17.519+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7969805790285882812 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/09/thoughts-on-intels-upcoming-software.html ---- - -
In the first part of this article published a few weeks ago, I have discussed the basics of Intel SGX technology, and also discussed challenges with using SGX for securing desktop systems, specifically focusing on the problem of trusted input and output. In this part we will look at some other aspects of Intel SGX, and we will start with a discussion of how it could be used to create a truly irreversible software.

SGX Blackboxing – Apps and malware that cannot be reverse engineered?

A nice feature of Intel SGX is that the processor automatically encrypts the content of SGX-protected memory pages whenever it leaves the processor caches and is stored in DRAM. In other words the code and data used by SGX enclaves never leave the processor in plaintext.

This feature, no doubt influenced by the DRM industry, might profoundly change our approach as to who controls our computers really. This is because it will now be easy to create an application, or malware for that matter, that just cannot be reversed engineered in any way. No more IDA, no more debuggers, not even kernel debuggers, could reveal the actual intentions of the EXE file we're about to run.

Consider the following scenario, where a user downloads an executable, say blackpill.exe, which in fact logically consists of three parts:

  1. A 1st stage loader (SGX loader) which is unencrypted, and which task is to setup an SGX enclave, copy the rest of the code there, specifically the 2nd stage loader, and then start executing the 2nd stage loader...
  2. The 2nd stage loader, which starts executing within the enclave, performs remote attestation with an external server and, in case the remote attestation completes successfully, obtains a secret key from the remote server. This code is also delivered in plaintext too.
  3. Finally the encrypted blob which can only be decrypted using the key obtained by the 2nd stage loader from the remote server, and which contains the actual logic of the application (or malware).

We can easily see that there is no way for the user to figure out what the code from the encrypted blob is going to do on her computer. This is because the key will be released by the remote server only if the 2ndstage loader can prove via remote attestation that it indeed executes within a protect SGX enclave and that it is the original unmodified loader code that the application's author created. Should one bit of this loader be modified, or should it be attempted to run outside of an SGX enclave, or within a somehow misconfigured SGX enclave, then the remote attestation wouldfail and the key will not be obtained.

And once the key is obtained, it is available only within the SGX enclave. It cannot be found in DRAM or on the memory bus, even if the user had access to expensive DRAM emulators or bus sniffers. And the key cannot also be mishandled by the code that runs in the SGX enclave, because remote attestation also proved that the loader code has not been modified, and the author wrote the loader specifically not to mishandle the key in any way (e.g. not to write it out somewhere to unprotected memory, or store on the disk). Now, the loader uses the key to decrypt the payload, and this decrypted payload remains within secure enclave, never leaving it, just like the key. It's data never leaves the enclave either...

One little catch is how the key is actually sent to the SGX-protected enclave so that it could not be spoofed in the middle? Of course it must be encrypted, but to which key? Well, we can have our 2ndstage loader generate a new key pair and send the public key to the remote server – the server will then use this public key to send the actual decryption key encrypted with this loader's public key. This is almost good, except for the fact that this scheme is not immune to a classic main in the middle attack. The solution to this is easy, though – if I understand correctly the description of the new Quoting and Sealing operations performed by the Quoting Enclave – we can include the generated public key hash as part of the data that will be signed and put into the Quote message, so the remote sever can be assured also that the public key originates from the actual code running in the SGX enclave and not from Mallory somewhere in the middle.

So, what does the application really do? Does it do exactly what has been advertised by its author? Or does it also “accidentally” sniffs some system memory or even reads out disk sectors and sends the gathered data to a remote server, encrypted, of course? We cannot know this. And that's quite worrying, I think.

One might say that we do accept all the proprietary software blindly anyway – after all who fires up IDA to review MS Office before use? Or MS Windows? Or any other application? Probably very few people indeed. But the point is: this could be done, and actually some brave souls do that. This could be done even if the author used some advanced form of obfuscation. Can be done, even if taking lots of time. Now, with Intel SGX it suddenly cannot be done anymore. That's quite a revolution, complete change of the rules. We're no longer masters of our little universe – the computer system – and now somebody else is.

Unless there was a way for “Certified Antivirus companies” to get around SGX protection.... (see below for more discussion on this).

...And some good applications of SGX

The SGX blackboxing has, however, some good usages too, beyond protecting the Hollywood productions, and making malware un-analyzable...

One particularly attractive possibility is the “trusted cloud” where VMs offered to users could not be eavesdropped or tampered by the cloud provider admins. I wrote about such possibility two years ago, but with Intel SGX this could be done much, much better. This will, of course, require a specially written hypervisor which would be setting up SGX containers for each of the VM, and then the VM could authenticate to the user and prove, via remote attestation, that it is executing inside a protected and properly set SGX enclave. Note how this time we do not require the hypervisor to authenticate to the users – we just don't care, if our code correctly attests that it is in a correct SGX, it's all fine.

Suddenly Google could no longer collect and process your calendar, email, documents, and medial records! Or how about a tor node that could prove to users that it is not backdoored by its own admin and does not keep a log of how connections were routed? Or a safe bitcoin web-based wallet? It's hard to overestimate how good such a technology might be for bringing privacy to the wide society of users...

Assuming, of course, there was no backdoor for the NSA to get around the SGX protection and ruin this all goodness...(see below for more discussion on this).

New OS and VMM architectures

In the paragraph above I mentioned that we will need specially written hypervisors (VMMs) that will be making use of SGX in order to protect the user's VMs against themselves (i.e. against the hypervisor). We could go further and put other components of a VMM into protected SGX enclaves, things that we currently, in Qubes OS, keep in separate Service VMs, such as networking stacks, USB stacks, etc. Remember that Intel SGX provides convenient mechanism to build inter-enclave secure communication channels.

We could also take the “GUI domain” (currently this is just Dom0 in Qubes OS) and move it into a separate SGX enclave. If only Intel came up with solid protected input and output technologies that would work well with SGX, then this would suddenly make whole lots of sense (unlike currently where it is very challenging). What we win this way is that no longer a bug in the hypervisor should be critical, as it would be now a long way for the attacker who compromised the hypervisor to steal any real secret of the user, because there are no secrets in the hypervisor itself.

In this setup the two most critical enclaves are: 1) the GUI enclave, of course, and 2) the admin enclave, although it is thinkable that the latter could be made reasonably deprivileged in that it might only be allowed to create/remove VMs, setup networking and other policies for them, but no longer be able to read and write memory of the VMs (Anti Snowden Protection, ASP?).

And... why use hypervisors? Why not use the same approach to compartmentalize ordinary operating systems? Well, this could be done, of course, but it would require considerable rewrite of the systems, essentially turning them into microkernels (except for the fact that the microkernel would no longer need to be trusted), as well as the applications and drivers, and we know that this will never happen. Again, let me repeat one more time: the whole point of using virtualization for security is that it wraps up all the huge APIs of an ordinary OS, like Win32 or POSIX, or OSX, into a virtual machine that itself requires orders of magnitude simpler interface to/from the outside world (especially true for paravirtualized VMs), and all this without the need to rewrite the applications.

Trusting Intel – Next Generation of Backdooring?

We have seen that SGX offers a number of attractive functionality that could potentially make our digital systems more secure and 3rdparty servers more trusted. But does it really?

The obvious question, especially in the light of recent revelations about NSA backdooring everything and the kitchen sink, is whether Intel will have backdoors allowing “privileged entities” to bypass SGX protections?

Traditional CPU backdooring

Of course they could, no question about it. But one can say that Intel (as well as AMD) might have been having backdoors in their processors for a long time, not necessarily in anything related to SGX, TPM, TXT, AMT, etc. Intel could have built backdoors into simple MOV or ADD instructions, in such a way that they would automatically disable ring/page protections whenever executed with some magic arguments. I wrote more about this many years ago.

The problem with those “traditional” backdoors is that Intel (or a certain agency) could be caught using it, and this might have catastrophic consequences for Intel. Just imagine somebody discovered (during a forensic analysis of an incident) that doing:

MOV eax, $deadbeef
MOV ebx, $babecafe
ADD eax, ebx

...causes ring elevation for the next 1000 cycles. All the processors affected would suddenly became equivalents of the old 8086 and would have to be replaced. Quite a marketing nightmare I think, no?

Next-generation CPU backdooring

But as more and more crypto and security mechanisms got delegated from software to the processor, the more likely it becomes for Intel (or AMD) to insert really “plausibly deniable” backdoors into processors.

Consider e.g. the recent paper on how to plant a backdoor into the Intel's Ivy Bridge's random number generator (usable via the new RDRAND instruction). The backdoor reduces the actual entropy of the generator making it feasible to later brute-force any crypto which uses keys generated via the weakened generator. The paper goes into great lengths describing how this backdoor could be injected by a malicious foundry (e.g. one in China), behind the Intel's back, which is achieved by implementing the backdoor entirely below the HDL level. The paper takes a “classic” view on the threat model with Good Americans (Intel engineers) and the Bad Chinese (foundry operators/employees). Nevertheless, it should be obvious that Intel could have planted such a backdoor without any effort or challenge described in the paper, because they could do so at any level, not necessarily below HDL.

But backdooring an RNG is still something that leaves traces. Even though the backdoored processor can apparently pass all external “randomness” testes, such as the NIST testsuite, they still might be caught. Perhaps because somebody will buy 1000 processors and will run them for a year and will note down all the numbers generated and then conclude that the distribution is quite not right. Or something like that. Or perhaps because somebody will reverse-engineer the processor and specifically the RNG circuitry and notice some gates are shorted to GND. Or perhaps because somebody at this “Bad Chinese” foundry will notice that.

Let's now get back to Intel SGX -- what is the actual Root of Trust for this technology? Of course, the processor, just like for the old ring3/ring0 separation. But for SGX there is additional Root of Trust which is used for remote attestation, and this is the private key(s) used for signing the Quote Messages.

If the signing private key somehow got into the hands of an adversary, the remote attestation breaks down completely. Suddenly the “SGX Blackboxed” apps and malware can readily be decrypted, disassembled and reverse engineered, because the adversary can now emulate their execution step by step under a debugger and still pass the remote attestation. We might say this is good, as we don't want irreversible malware and apps. But then, suddenly, we also loose our attractive “trusted cloud” too – now there is nothing that could stop the adversary, who has the private signing key, to run our trusted VM outside of SGX, yet still reporting to us that it is SGX-protected. And so, while we believe that our trusted VM should be trusted and unsniffable, and while we devote all our deepest secrets to it, the adversary can read them all like on a plate.

And the worst thing is – even if somebody took such a processor, disassembled it into pieces, analyzed transitor-by-transitor, recreated HDL, analyzed it all, then still it all would look good. Because the backdoor is... the leaked private key that is now also in the hands of the adversary, and there is no way to prove it by looking at the processor alone.

As I understand, the whole idea of having a separate TPM chip, was exactly to make such backdoor-by-leaking-keys more difficult, because, while we're all forced to use Intel or AMD processors today, it is possible that e.g. every country can produce their own TPM, as it's million times less complex than a modern processor. So, perhaps Russia could use their own TPMs, which they might be reasonably sure they use private keys which have not be handed over to the NSA.

However, as I mentioned in the first part of this article, sadly, this scheme doesn't work that well. The processor can still cheat the external TPM module. For example, in case of an Intel TXT and TPM – the processor can produce incorrect PCR values in response to certain trigger – in that case it no longer matters that the TPM is trusted and keys not leaked, because the TPM will sign wrong values. On the other hand we go back now to using “traditional” backdoors in the processors, whose main disadvantage is that people might got cought using them (e.g. somebody analyzed an exploit which turns out to be triggering correct Quote message despite incorrect PCRs).

So, perhaps, the idea of separate TPM actually does make some sense after all?

What about just accidental bugs in Intel products?

Conspiracy theories aside, what about accidental bugs? What are the chances of SGX being really foolproof, at least against those unlucky adversaries who didn't get access to the private signing keys? The Intel's processor have become quite a complex beasts these days. And if you also thrown in the Memory Controller Hub, it's unimaginably complex beast.

Let's take a quick tour back discussing some spectacular attacks against Intel “hardware” security mechanisms. I wrote “hardware” in quotation marks, because really most of these technologies is software, like most of the things in electronics these days. Nevertheless the “hardware enforced security” does have a special appeal to lots of people, often creating an impression that these must be some ultimate unbreakable technologies....

I think it all started with our exploit against Intel Q35 chipset (slides 15+) demonstrated back in 2008 which was the first attack allowing to compromise, otherwise hardware-protected, SMM memory on Intel platforms (some other attacks against SMM shown before assumed the SMM was not protected, which was the case on many older platforms).

This was then shortly followed by another paper from us about attacking Intel Trusted Execution Technology (TXT), which found out and exploited a fact that TXT-loaded code was not protected against code running in the SMM mode. We used our previous attack on Q35 against SMM, as well as found a couple of new ones, in order to compromise SMM, plant a backdoor there, and then compromise TXT-loaded code from there. The issue highlighted in the paper has never really been correctly patched. Intel has spent years developing something they called STM, which was supposed to be a thin hypervisor for SMM code sandboxing. I don't know if the Intel STM specification has eventually been made public, and how many bugs it might be introducing on systems using it, or how much inaccurate it might be.

In the following years we presented two more devastating attacks against Intel TXT (none of which depending on compromised SMM): onewhich exploited a subtle bug in the processor SINIT module allowing to misconfigure VT-d protections for TXT-loaded code, and another one exploiting a classic buffer overflow bug also in the processor's SINIT module, allowing this time not only to fully bypass TXT, but also fully bypass Intel Launch Control Policy and hijack SMM (several years after our original papers on attacking SMM the old bugs got patched and so this was also attractive as yet another way to compromise SMM for whatever other reason).

Invisible Things Lab has also presented first, and as far as I'm aware still the only one, attack on Intel BIOS that allowed to reflash the BIOS despite Intel's strong “hardware” protection mechanism to allow only digitally signed code to be flashed. We also found outabout secret processor in the chipset used for execution of Intel AMT code and we found a way to inject our custom code into this special AMT environment and have it executed in parallel with the main system, unconstrained by any other entity.

This is quite a list of Intel significant security failures, which I think gives something to think about. At the very least that just because something is “hardware enforced” or “hardware protected” doesn't mean it is foolproof against software exploits. Because, it should be clearly said, all our exploits mentioned above were pure software attacks.

But, to be fair, we have never been able to break Intel core memory protection (ring separation, page protection) or Intel VT-x. Rafal Wojtczuk has probably came closest with his SYSRET attackin an attempt to break the ring separation, but ultimately the Intel's excuse was that the problem was on the side of the OS developers who didn't notice subtle differences in the behavior of SYSRET between AMD and Intel processors, and didn't make their kernel code defensive enough against Intel processor's odd behavior.

We have also demonstrated rather impressive attacks bypassing Intel VT-d, but, again, to be fair, we should mention that the attacks were possible only on those platforms which Intel didn't equip with so called Interrupt Remapping hardware, and that Intel knew that such hardware was indeed needed and was planning it a few years before our attacks were published.

So, is Intel SGX gonna be as insecure as Intel TXT, or as secure as Intel VT-x....?

The bottom line

Intel SGX promises some incredible functionality – to create protected execution environments (called enclaves) within untrusted (compromised) Operating System. However, for SGX to be of any use on a client OS, it is important that we also have technologies to implement trusted output and input from/to the SGX enclave. Intel currently provides little details about the former and openly admits it doesn't have the later.

Still, even without trusted input and output technologies, SGX might be very useful in bringing trust to the cloud, by allowing users to create trusted VMs inside untrusted provider infrastructure. However, at the same time, it could allow to create applications and malware that could not be reversed engineered. It's quote ironic that those two applications (trusted cloud and irreversible malware) are mutually bound together, so that if one wanted to add a backdoor to allow A/V industry to be able to analyze SGX-protected malware, then this very same backdoor could be used to weaken the guarantees of the trustworthiness of the user VMs in the cloud.

Finally, a problem that is hard to ignore today, in the post-Snowden world, is the ease of backdooring this technology by Intel itself. In fact Intel doesn't need to add anything to their processors – all they need to do is to give away the private signing keys used by SGX for remote attestation. This makes for a perfectly deniable backdoor – nobody could catch Intel on this, even if the processor was analyzed transistor-by-transistor, HDL line-by-line.

As a system architect I would love to have Intel SGX, and I would love to believe it is secure. It would allow to further decompose Qubes OS, specifically get rid of the hypervisor from the TCB, and probably even more.

Special thanks to Oded Horowitz for turning my attention towards Intel SGX.
\ No newline at end of file diff --git a/_posts/2013-11-26-windows-7-seamless-gui-integration.html b/_posts/2013-11-26-windows-7-seamless-gui-integration.html deleted file mode 100644 index 3ba119b..0000000 --- a/_posts/2013-11-26-windows-7-seamless-gui-integration.html +++ /dev/null @@ -1,13 +0,0 @@ ---- -layout: post -title: Windows 7 seamless GUI integration coming to Qubes OS! -date: '2013-11-26T18:04:00.001+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:25:04.398+01:00' -thumbnail: http://1.bp.blogspot.com/-PJN1_VDD1NQ/UpTN4lE_xdI/AAAAAAAAAME/KmnnAnNmMGo/s72-c/windows-seamless-1.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-3852916224574976224 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/11/windows-7-seamless-gui-integration.html ---- - -
Finally, after months of hard work, seamless mode for Windows 7 AppVMs is coming to Qubes OS! The new Windows Support Tools will be released together with the Qubes OS R2 Beta 3, which we plan to release in the next 1-2 weeks. Here is an obligatory screenshot showing a few Windows apps running in seamless mode integrated onto Qubes trusted desktop (note the usual Qubes trusted decorations around each of the Win7 windows):



The seamless mode for Windows AppVMs is not yet as polishedas the one we have for Linux AppVMs, because, unlike what we do for Xorg, the Windows GUI agent is not based on composition buffers extraction. This causes some, ratherminor, cosmetic problems. For example, when we have two overlapping windows from a Win7 AppVM, and move the top window away, its remaining "shadow" will be visible on the underlying window for the duration of the operation. But generally this all works reasonably good, and you should not really feel any slowness or heaviness compared to Linux AppVMs virtualization. It should be noted that we managed to add this seamless support for Windows AppVMs without any changes to our secure GUI virtualization protocol.

Of course, the usual Qubes integration features, such as secure inter-VM clipboard and file copy also work for Windows AppVMs with the tools installed.

The Qubes Windows Support Tools are proprietary, but they are supposed to be installed only in the Windows 7 VMs, which themselves contain millions of lines of proprietary code already. Besides that, the tools do not introduce any other modifications to the system.

As a special bonus we have also added (and releasing also in R2B3) the support for template-based HVMs. So it will now be possible to do something like this:


qvm-create --hvm work-win7 --template win7-x64 --label green
qvm-create --hvm personal-win7 --template win7-x64 --label purple
qvm-create--hvm testing-win7 --template win7-x64 --label red


... tellingQubes to createthree HVM AppVMs based on the same template.

All such template-based AppVMs use the root filesystem from the Template VM, which is shared in a read-only manner, of course, but Qubes makes it look for the AppVMs as if the root filesystem was writable.Just like in case of Linux AppVMs, the actual writes are stored in COW buffersbacked by files stored in each of the AppVMs directories. Upon AppVM's reboot, thosefilesarediscarded, which reverts the VMs' root filesystems back to that of the template (the “golden image”).

For the above mechanism to make any sense we should configure the OS in the Template VMto usea separate disk for the user's home directory(ies) (e.g. C:\Users in case of Windows). Qubes automatically exposes an additional private disk to each of the AppVMs exactly for this very purpose. Again, just like it has been done for Linux AppVMs for years.

The above feature allows to create lots of Windows AppVMs quickly and with minimal use of disk space, and with an ability to centrally update all the system software in all the AppVMs all at once. Just like for Linux AppVMs.

Users should, however, ensure that their license allows for such instantiating of the OS they use in the template. Note that from the technical point of view the OS is installed, and, in case of Windows, also activated, only once: in the template VM. The installed files are never copied, they are only shared with the running instances of AppVMs. Consult your software licensing lawyer.
\ No newline at end of file diff --git a/_posts/2013-12-11-qubes-r2-beta-3-has-been-released.html b/_posts/2013-12-11-qubes-r2-beta-3-has-been-released.html deleted file mode 100644 index 07064dd..0000000 --- a/_posts/2013-12-11-qubes-r2-beta-3-has-been-released.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Qubes R2 Beta 3 has been released! -date: '2013-12-11T00:14:00.000+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:24:51.677+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-3957611366610637891 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2013/12/qubes-r2-beta-3-has-been-released.html ---- - -
Today we're releasing Qubes R2 Beta 3, one of the latest milestones on our roadmap for Qubes R2. Even though it is still called a “beta”, most users should install it, because, we believe, it is the most polished and stable Qubes edition. Looking back, I think it was a mistake to use this alpha/beta/rc nomenclature to mark Qubes releases, and so, starting with Qubes R3 we will be just using version numbers: 3.0, 3.1, etc.

Anyway, back to the R2 Beta 3 – below I discuss some of the highlights of the today's release:
  • The seamless GUI virtualization for Windows 7-based AppVMs, and support for HVM-based templates (e.g. Windows-based templates) is one of the most spectacular feature of this release, I think. It has already been discussed in an earlier blog post, and now instructions have also been added to the wiki for how to install and use such Windows AppVMs.

  • We've also introduced a much more advanced infrastructure for system backups, so it is now possible to make and restore backups to/from untrusted VMs, which allows e.g. to backup easily the whole system to a NAS, or just to an USB device, not worrying that somebody might exploit the NAS client over the network, or that plugging of the USB disk with malformed partition table or filesystem might compromise the system. The whole point here is that the VM that handles the backup storage (and which might be directing it to a NAS, or somewhere) might be compromised, and it still cannot do anything that could compromise (or even DoS) the system, neither can it sniff the data in the backup. I will write more about the challenges we had to solve and how we did it in a separate blog post. I'm very proud to note that majority of the implementation for this has been contributed by the community, specifically Oliver Medoc. Thanks!
  • A very simple feature, trivial almost, yet very important from the security point of view – it is now possible to set 'autostart' property on select VMs. Why is this so important for security? Because I can create e.g. UsbVM, assign all my USB controllers to it, and then once I set it as autostarting, I can have assurance that all my USB controllers will be delegated to such AppVM immediately upon each system boot. Having such a UsbVM is a very good idea, if one is afraid of physical attacks coming though USB devices. And it now could double as a BackupVM with this new backup system mentioned above!
  • To improve hardware compatibility we now ship the installer with multiple kernel versions (3.7, 3.9, and 3.11) allowing to run the installation using any of those, e.g. if it turned out that one kernel doesn't support the graphics card correctly -- a typical problem many users faced in the past. All the kernels are also installed in the final system, allowing the user to easily boot with a select Dom0 kernel later, choosing the one which supports their hardware best.

  • Another popular problem of the past now was the lack of support for dynamically changing resolution/screen layout in the AppVMs when a seccond monitor or a projector was hot-plugged in (which changed only the resolution layout in Dom0). Now this problem has been solved and the new monitor layout is dynamically propagated to the AppVMs, allowing to use all the screen real estate by the apps running there.
  • There has also been a significant amount of cleanups and fixes. This includes the unification of paths and command names (“The Underscore Revolution” as we call it), as well as refactoring of all the source code components (which now closely matches what we have on Qubes Odyssey/R3), and lots of various bugfixes.
We're planning one more release (Qubes R2 RC1) before the final R2, which will bring improvements mostly in the area of more polished UI, such as allowing some of the tasks that currently require commandline to be done from the Qubes Manager. So, this would mostly be a minor cosmetic upgrade, plus bugfixes. And probably we will also upgrade the default Linux template to Fedora 20.

Installation and upgrade instructions can be found here.
\ No newline at end of file diff --git a/_posts/2014-01-16-shattering-myths-of-windows-security.html b/_posts/2014-01-16-shattering-myths-of-windows-security.html deleted file mode 100644 index df39fe7..0000000 --- a/_posts/2014-01-16-shattering-myths-of-windows-security.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Shattering the myths of Windows security -date: '2014-01-16T00:32:00.000+01:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:24:38.464+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-366066024465255660 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/01/shattering-myths-of-windows-security.html ---- - -When I originally described the flexible Qubes Odyssey framework several months ago, I mentioned that we would even consider to use “Windows Native Isolation” mechanisms as a primitive type of isolation provider (“hypervisor”) for some basic edition of Qubes for Windows. The idea has been very attractive indeed, because with minimal effort we could allow people to install and run such Qubes WNI on their normal, consumer Windows laptops.

Sure, the inter-process isolation provided by a monolithic kernel such as Windows or Linux could never be compared to the inter-VM isolation offered even by the most lousy hypervisors. This is simply because the sizes of the interfaces exposed to untrusted entities (processes in case of a monolithic kernel; VMs in case of a hypervisor) are just incomparable. Just think about all those Windows system calls and GDI calls which any process can call and which contains probably thousands of bugs still waiting to be discovered by some kid with IDA. And think about those tens of thousands of drivers, which also expose (often unsecured) IOCTLs, as well as parsing the incoming packets, USB devices infos, filesystem metadata, etc. And then think about various additional services exposed by system processes, which are not part of the kernel, but which are still trusted and privileged. And now think about the typical interface that needs to be exposed to a typical VM: it's “just” the virtualized CPU, some emulated devices (some old-fashined Pentium-era chipset, SVGA graphics adapter, etc) and virtualized memory.

Anyway, knowing all this, I still believed that Qubes WNI would make a whole lot of sense. This is because Qubes WNI would still offer a significant boost over the “Just Windows” default security, which is (still) essentially equivalent to the MS-DOS security model.  And this is a real pity, because Windows OS has long implemented very sophisticated security mechanisms, such as complex ACLs applicable to nearly any object, as well as recent mechanisms such as UIPI/UAC, etc. So, why not use all those sophisticated security to bring some real-world security to Windows desktops!

And, best of all, once people start using Qubes WNI, and they liked it, they could then pretty seamlessly upgrade to Xen-based Qubes OS, or perhaps Hyper-V-based Qubes OS (when we implement it) and their system would look and behave very similarly. Albeit with orders of magnitude stronger security. Finally, if we could get our Odyssey Framework to be flexible enough to support both Qubes WNI, as well as Xen-based Qubes OS, we should then be able to support any hypervisor or other isolation mechanism in the future.

And so we decided to build the Qubes WNI. Lots of work we invested in building Qubes WNI was actually WNI-independent, because it e.g. covered adjusting the core Odyssey framework to be more flexible (after all “WNI” is quite a non-standard hypervisor) as well as some components that were Windows-specific, but not WNI-specific (e.g. could very well be used on Hyper-V based Qubes OS in the future). But we also invested lots of time into evaluating all those Windows security mechanisms in order to achieve our specific goals (e.g. proper GUI isolation, networking isolation, kernel object spaces isolation, etc)...

Sadly this all has turned out to be a story without a happy end, as we have finally came to the conclusion that consumer Windows OS, with all those one-would-think sophisticated security mechanisms, is just not usable for any real-world domain isolation.

And today we publish a technical paper about our findings on Windows security model and mechanisms and why we concluded they are inadequate in practice. The paper has been written by Rafał Wojdyła who joined ITL a few months ago with the main task of implementing Qubes WNI. I think most people will be able to learn a thing or two about Windows security model by reading this paper.

Also, we still do have this little hope that somebody will read the paper and then write to us: “Oh, you're guys so dumb, you could just use this and that mechanism, to solve all your problems with WNI!” :)

The paper can be downloaded from here. \ No newline at end of file diff --git a/_posts/2014-04-20-qubes-os-r2-rc1-has-been-released.html b/_posts/2014-04-20-qubes-os-r2-rc1-has-been-released.html deleted file mode 100644 index 0b86483..0000000 --- a/_posts/2014-04-20-qubes-os-r2-rc1-has-been-released.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Qubes OS R2 rc1 has been released! -date: '2014-04-20T20:40:00.000+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-11-27T13:24:27.320+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-7571053820604404319 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/04/qubes-os-r2-rc1-has-been-released.html ---- - -Today we're releasing Qubes OS R2 rc1 (release candidate), which is expected to be the last milestone before the final Qubes OS R2 release. As mentioned previously today's release is bringing mainly UI improvements and polishing and lots of bugfixes, as well as some last new features: 
  • Both Dom0 and VMs have been upgraded to Fedora 20.
  • Support for full templates download via two new repo definitions: templates-itl and templates-community. With a bit of imagination we could call it Qubes “AppStore” for VMs :) Currently we have only published one template there – the new default fc20-based template, but we plan to upload more templates in the coming weeks (such as the community-produced Arch Linux and Debian templates). Even though we have a separate repo for community contributed templates, we still plan on building those templates ourselves, from (contributed) sources.
  • Support for running Windows AppVMs in “full desktop” mode with support for arbitrary window resizing (which automatically adjusts the resolution in the VMs).
  • Support for on-the-fly switching between the “full desktop” and “seamless” modes for Windows AppVMs.
The last two features require, of course, our proprietary Qubes Windows Tools to be installed in the Windows AppVMs to work, which new version we have also published to the new repositories for R2rc1.

We support smooth upgrading for current Qubes R2 Beta 3 users – the procedure is very simple, yet it will take some hours because of the Dom0 distro upgrading.

As can be seen in our ticketing system, there really are only few minor cosmetic tasks left before the final Qubes R2 release. It is expected that upgrade from today's release to the final R2 will be very simple and quick – just standard updates installation.

As usual, the detailed installation and upgrade instructions, as well as the HCL, can be found here. Note however, that the HCL for the today's release will take some days/weeks to compile, as we need to wait for reports from the community, and so for this time the HCL for the previous release (R2 Beta 3) should be used instead. It is reasonable to expect that the new HCL will be a subset of the previous one.

Also, as usual, please keep in mind that we don't control the servers from which the ISO is being served and so please always make sure to verify the digital signature on the downloaded ISO before installing it.

Please direct all the technical questions or comments regarding Qubes OS to our mailing lists.

Enjoy!

\ No newline at end of file diff --git a/_posts/2014-08-06-qubes-os-r2-rc2-debian-template-ssled.html b/_posts/2014-08-06-qubes-os-r2-rc2-debian-template-ssled.html deleted file mode 100644 index 639bd53..0000000 --- a/_posts/2014-08-06-qubes-os-r2-rc2-debian-template-ssled.html +++ /dev/null @@ -1,16 +0,0 @@ ---- -layout: post -title: Qubes OS R2 rc2, Debian template, SSLed Wiki, BadUSB, and more... -date: '2014-08-06T13:02:00.000+02:00' -author: Joanna Rutkowska -tags: -- os security -- usb -- qubes -modified_time: '2014-11-27T13:24:15.997+01:00' -thumbnail: http://1.bp.blogspot.com/-FZ0wECOfuPs/U-FSwDST6UI/AAAAAAAAAO0/kJUqXKYkqlU/s72-c/qubes-logo-blue.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-7667743056108682405 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/08/qubes-os-r2-rc2-debian-template-ssled.html ---- - -Today we're release the second release candidate (rc2) for Qubes OS R2. There are currently no more open tickets for the final R2 release, and we hope that what we release today is stable enough and so will be identical, or nearly identical, to the final R2 ISO, which we plan to release after the summer holidays. Download and installation instructions are here.

After Qubes rc1 release a few months ago we have been hit by a number of problems related to unreliable VM start-ups. The most prevalent problem has been traced down to an upstream bug in systemd, which just happened to be manifesting on Qubes OS due to specific conditions imposed by our startup scripts.

Actually, it has not been the first time when some things related to VM bootup or initialization didn't work quite well on Qubes, a side effect of heavy optimizations and stripping down we do in order to make the VMs as light weight as possible. E.g. we don't start most of the Desktop Environment which otherwise is assumed to be running by various desktop-related applications and services. In most cases these are really NOTOURBUG kind of problems, yet we just happen to be unlucky they manifest on Qubes. We do need more help from the community with testing, debugging and patching such NOTOURBUG problems in the upstream. The more people use Qubes OS, the higher the chances such problems will be addressed much quicker. Ideally, in the future, we could partner with a Linux distro that would include Qubes AppVM as one of the test cases.

Speaking of different Linux distros --  we have also recently built and released an experimental (“beta”) Debian template for Qubes AppVMs, a popular request expressed by our users for quite some time. It can be readily installed with just one command, as described in the wiki. It is supposed to behave as a first class Qubes AppVM with all the Qubes signature VM integration features, such as seamless GUI virtualization, secure clipboard, secure file copy, and other integration, all working out of the box. Special thanks to our community contributors for providing most of the patches required for porting of our agents and other scripts to Debian. This template is currently provided via our templates-community repo, but it nevertheless has been built and signed by ITL, and is also configured to fetch updates (for Qubes tools) from our server, but we look forward for somebody from the community to take over from us the maintenance (building, testing) of the updates for this template.

Also in our "Templates Appstore" you can find now an experimental “minimal” fedora-based template, which might be used by more advanced users to build customized special-purpose VMs and templates.

We have also moved our Wiki server to a bigger EC2 instance so it could better handle the increased traffic and also added a real CA-signed SSL certificate! But I encourage people to read why this is mostly irrelevant from the security standpoint and why they should still be checking signatures on the ISOs.

We also got a new logo (actually we never really had our own logo before). This also means Qubes now got its own distinct set of themes for installer, plymouth and, of course, a bunch of cool wallpapers with Qubes logo nicely engraved on them. However, it turned out that convincing KDE to set our wallpaper as a default one exceeds the collective mental abilities of ITL, and so one needs to right-click on the desktop and choose one of the Qubes-branded wallpapers manually after install or upgrade.

Every once in a while people (re-)discover that monolithic kernel-based desktop operating systems are not the best solution whenever the user even remotely cares about security...

Yes, USB inherent insecurity, as well as widespread GUI insecurity, or networking stack insecurity, trivial physical insecurities, or sick permissions model as used in most desktop systems, have all been known facts for years. The recognition of these problems has been the primary motivator for us to start the work on Qubes OS back in 2009/2010.

And yes, Qubes running on an appropriate hardware (specifically with Intel VT-d) can solve most of these problems. Correction: Qubes OS can allow the user or administrator to solve these problems, as unfortunately this still requires some configuration decisions made by the human operator. So today Qubes R2 is like a sports manual transmission, which requires a bit of skill to get most out of it. In the near future I see no reason why we should not be offering the "automatic 8-speed transmission" edition of Qubes OS. We just need more time to get there. The R3 release (Odyssey-based), whose early code is planned to be released just after the "final" R2, so sometime in September, is all about bringing us closer to that "automatic transmission" version.

With my 10+ years of experience as a system-level security researcher, I believe there is no other way to go. Don't get deluded that safe languages or formally verified microkernels could solve these problems. Security by Isolation, done sensibly, is the only way to go (of course it doesn't preclude making use of some formally verified components, like e.g. microkernel in place of Xen, at least in some editions of Qubes).

Finally one more announcement for today: after writing this blog for 8 years, I've suddenly felt like I might need to try also some new form of expression... And so, for a few days, I now have a twitter account (@rootkovska), which I hope to use for updates on Qubes, as well as more general commentary on various things happening in IT security.

\ No newline at end of file diff --git a/_posts/2014-08-26-physical-separation-vs-software.html b/_posts/2014-08-26-physical-separation-vs-software.html deleted file mode 100644 index 2ef9f24..0000000 --- a/_posts/2014-08-26-physical-separation-vs-software.html +++ /dev/null @@ -1,12 +0,0 @@ ---- -layout: post -title: Physical separation vs. Software compartmentalization -date: '2014-08-26T19:15:00.003+02:00' -author: Joanna Rutkowska -tags: -modified_time: '2014-08-26T19:15:58.669+02:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2261156925386470515 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/08/physical-separation-vs-software.html ---- - -Many people believe the Holy Grail of secure isolation is to use two or more physically separate machines. This belief seems so natural, that we often don't give it much thought. After all, what better isolation could we possible get than physical "airgap"?

I argue with this point of view in this new paper.

I think a good place for in-depth technical discussions around the topics discussed in the paper would be our qubes-devel mailing list. \ No newline at end of file diff --git a/_posts/2014-09-26-announcing-qubes-os-release-2.html b/_posts/2014-09-26-announcing-qubes-os-release-2.html deleted file mode 100644 index 66415f8..0000000 --- a/_posts/2014-09-26-announcing-qubes-os-release-2.html +++ /dev/null @@ -1,14 +0,0 @@ ---- -layout: post -title: Announcing Qubes OS Release 2! -date: '2014-09-26T20:28:00.000+02:00' -author: Joanna Rutkowska -tags: -- qubes -modified_time: '2014-11-27T13:23:40.232+01:00' -thumbnail: http://3.bp.blogspot.com/-0yOLNM-YXqs/VCWk3PrvYgI/AAAAAAAAAPE/AnXQpgxmjLY/s72-c/qubes-logo-blue.png -blogger_id: tag:blogger.com,1999:blog-24586388.post-4366442760226795341 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/09/announcing-qubes-os-release-2.html ---- - -
Today we're releasing Qubes OS R2! I'm not gonna write about all the cool features in this release because you can find all this in our wiki and previous announcements (R2-beta1, R2-beta2, R2-beta3, R2-rc1, and R2-rc2). Suffice to say that we've come a long way over those 4+ years from a primitive proof of concept to a powerful desktop OS which, I believe, it is today.

One of the biggest difficulties we have been facing with Qubes since the very beginning, has been the amount of this extra, not-so-exciting, not directly security-related work, but so much needed to ensure things actually work. Yet, the line between what is, and what is not-security related, is sometimes very thin and one can easily cross it if not being careful.

It's great that we're receiving more and more community contributions. This includes not only bug fixes, but also invaluable efforts related to documentation, HCL maintenance, as well as some really non-trivial new features (advanced backups support, Debian and Arch templates, TorVM, Whonix port, etc). Thanks!

I'm also happy to announce that Caspar Bowden, a well known privacy advocate, expert on EU data protection law, member of the board of Tor, former Microsoft Chief Privacy Adviser, etc, will be taking a role as Qubes Policy Adviser, helping us to make Qubes OS more suitable for a wider audience of people interested in privacy, and be liaising  with other projects that would like to build privacy services with Qubes as a base.

And there is still a lot in front of us. Using the obligatory car analogy, I would say Qubes OS is currently like a racing car that just went into production as a road vehicle: one hell of an engine under-the-hood, and powerful new technologies until now unavailable even for professional use, yet lacking leather interior with 12-speaker audio system, and still with a manual transmission... This is just the beginning for making security by isolation on the desktop as "driveable" as a [insert your fav make of German fine cars] :)

Exciting stuff is coming next: the Release 3 (“Odyssey”) and more, stay tuned!

Thanks to everyone who has made Qubes OS possible, as well as all the upstream projects without which we would probably never even try this journey: Xen, Linux, Xorg, and many others!


\ No newline at end of file diff --git a/_posts/2014-11-27-qubes-r3odyssey-initial-source-code.html b/_posts/2014-11-27-qubes-r3odyssey-initial-source-code.html deleted file mode 100644 index e673088..0000000 --- a/_posts/2014-11-27-qubes-r3odyssey-initial-source-code.html +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: post -title: Qubes R3/Odyssey initial source code release -date: '2014-11-27T14:57:00.001+01:00' -author: Joanna Rutkowska -tags: -- qubes -- r3 -- odyssey -modified_time: '2014-11-27T14:57:55.459+01:00' -blogger_id: tag:blogger.com,1999:blog-24586388.post-2049939853263374613 -blogger_orig_url: http://theinvisiblethings.blogspot.com/2014/11/qubes-r3odyssey-initial-source-code.html ---- - -Back in 2013 we've started the work on generalizing Qubes architecture, which we code-named “Odyssey”, to allow for use of multiple hypervisors instead of just Xen via Hypervisor Abstraction Layer (“HAL” -> “Space Odyssey”, get it? ;). The concept has been described in this post, which I recommend to re-read if you're more interested in understanding our goals.

We have been wandering here and there since that time. Lots of work has been invested in the light-weight Qubes edition for Windows, which, sadly, turned out to be a failure.

We have also done a lot of work in the meantime to polish Qubes R2 and bring it to the state of the final release, which happened earlier this fall.

We have also been heavily researching possibilities of other cool projects based on this flexible new architecture. Some of which you might hear about in the coming months, others turned out to be dead ends.

Today we're finally releasing the Qubes R3 source code to the public. The code builds fine (see here for building instruction), produces install-able ISO, and, if that was not enough, even seems to be working, mostly fine, when installed :)

However, we don't recommend users to switch to it, and we intend this release for developers only, specifically those who would like to start working towards porting of other hypervisors, or other containerization technologies, like LXC, to Qubes R3. I highly recommend these devlopers to discuss what they try to achieve on the qubes-devel mailing list, before they start the actual coding.

Currently the only implemented and supported backend is Xen, of course, specifically the Xen 4.4, currently the latest version. It should be now trivial to switch to future versions as they become available, although, a decision to rush with that might not be such a no-brainer from the security point of view. We should remember that the hypervisor, unlike Linux kernel, is not someting you would like to change every month or so. Ideally we should aim for having a stable version of Xen for desktops that would work for years without needing any updates.

But use of other hypervisors might open up lots of interesting possibilities: imagine e.g. Qubes Live USB edition that has backends for 1) Xen, 2) KVM, and 3) LXC, and choose automatically the most secure one which is still supported on the given laptop.

Major features of the current release, compared to Qubes R2:
  • Hypervisor Abstraction Layer for all the core management stack (but still missing for the GUI daemon, see below)
  • New implementation of vchan and qrexec. As you might know our original vchan has been rewritten and improved (better performance and flexibility) and included in the upstream Xen starting from v4.2. Now we're switching to this upstream libvchan. Also, qrexec has been slightly rewritten to utilize some new features of this libvchan, which results in much better performance for inter-VM traffic (like a few orders of magnitude better!) Especially important for things such as USB virtualization that we're testing right now (not to be confused with USB controller pass-though).
There is still some work going on which we would like to complete before we officially decide to release Qubes OS 3.0-rc1 ISO, and this includes:
  • Rewrite of some internal code for the core management stack, which includes internal API of the python classes. This should mostly be of no interest to users, and even most developers working on Qubes.
Further down the road (Qubes OS 3.1) we plan to work on some really exciting things:
  • More flexibility to qrexec policy (more on that in a separate post)
  • More flexibility to Qubes Admin API (expose it to slelect other VMs)
  • Split of Dom0 into (semi-depriviliged) GUI domain and minimal Admin domain. This would be great opportunity to also add the missing HAL support for the GUI daemon.
One of the immediate application of these features above would be to introduce support for remote management of Qubes installations, an absolutely necessary feature for corporate adoption of Qubes.

Also note how all these tasks are independent of the actual hypervisor support, meaning it's perfectly possible for other developers to work on porting other hypervisors to Qubes in the meantime.

The possibilities seems to be endless now. Join us and help us with The Revolution! :)

\ No newline at end of file diff --git a/_posts/2015-02-09-my-new-git-based-blog.md b/_posts/2015-02-09-my-new-git-based-blog.md deleted file mode 100644 index 3d3b295..0000000 --- a/_posts/2015-02-09-my-new-git-based-blog.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -layout: post -title: My New Git-based Blog -author: Joanna Rutkowska ---- - -After using Google Blogger for nearly 9 years to [host my -blog](http://theinvisiblethings.blogspot.com/), I decided to migrate to a -Git-based blog. My blog is now primarily [hosted on -GitHub](https://github.com/rootkovska/rootkovska.github.io) using [GitHub -Pages](https://pages.github.com/) for ease of viewing via a Web browser. I -shall stress, however, the blog is Git-based, not necessarily GitHub-based! - -This move offers several important advantages: - -1. Independence on the underlying hosting company -2. Flexibility of distribution -3. Integrity protection -4. Easily accessible edits history - -The statement about independence on hosting might sound a bit surprising, -because one could point out that I still depend on GitHub to host my blog repo. -However, this is really just a technicality. I might trivially (via `git push`) -move to another Git hosting platform, shall there be any problems with GitHub -(e.g. censorship). - -While the use of [Markdown](http://en.wikipedia.org/wiki/Markdown) and -[Jekyll](http://jekyllrb.com/), which is natively used by GitHub Pages to -render nicely looking static HTML, makes this repo somehow GitHub-specific, -special care has been taken to make all the content human readable even without -Jekyll pre-processing and when viewed using standard plaintext editors. - -Moreover, it's not just *me* who can move this blog to some other hosting -platform, but this could be *anybody*, thanks to the ease of Git repo cloning -(irrelevant whether through GitHub web interface or just using `git -clone`/`pull` manually). This, combined with integrity protection discussed -below, allows anybody to create mirrors offering this blog to different groups -of people, without losing ability to prove its authenticity, which no longer -needs to be implied by DNS record ownership. - -Somebody [suggested](https://twitter.com/_ta0/status/562632421305507840) -recently that I should be distributing my blog as a bunch of text files over a -Tor Hidden service. Of course I don't have time and enough incentive to do that -myself. However, thanks to git-based nature of this blog, it is easy for -somebody else to setup a script that would be regularly pull'ing my blog, -verifying authenticity, and then e.g. publishing it as a Tor Hidden Service. - -Or somebody might not like the blog is served over plaintext HTTP connections -when accessible via the blog.invisiblethings.org DNS (which sadly is a -[limitation](https://konklone.com/post/github-pages-now-sorta-supports-https-so-use-it) -of GitHub pages) and might want to setup own server with proper SSL certificate -to serve it. Again, no problem, and there is no action required on my side! -That's the beauty of maintaining this as an easily clone-able git repo. - -And, no, realistically, I don't think I am, or this blog is, that important or -controversial, that the US or other government, or whoever, will likely want to -block, censor or tamper with it in any way. This is more about principles. -About the feeling that even if They wanted, they could not. It's a nice -feeling. - - -Integrity protection of this blog ----------------------------------- - -End-to-end integrity protection of any distributed information (code, -documents, etc) is an extremely important aspect in the digital world, -unfortunately way too often ignored by the industry today. - -End-to-end integrity protection (as well as end-to-end encryption) is the only -solution that allows to keep the infrastructure (servers, admins, networks) out -of the trust base. Sadly most of the Internet and its services have been -designed with the assumption that integrity and confidentiality is to be -provided by the infrastructure (e.g. via SSL, VPNs, etc). Such approach -necessarily puts individuals, who often are not able to fully control the -infrastructure, out of control with regards to who they trust. Lots of problems -arises from lack of end-to-end integrity and confidentiality guarantees. - -This blog is integrity protected. The integrity protection utilizes Git signed -tags on the underlying repo commits. These are signed with by [Blog Signing -Key](/keys/). - -It's worth noting, however, for the record, that the 2006-2014 posts have been -automatically downloaded from my Google Blogger account and have been included -in this repo as HTML files (as generated by [Jekyll -Importer](http://import.jekyllrb.com/docs/blogger/)) without a thorough manual -inspection after the conversion. My Git tags still cover them, of course. - - -Distribution, Hosting, Notifications -------------------------------------- - -This blog is now available for traditional Web-based viewing via the following URL: - -* http://blog.invisiblethings.org/ - -One can get notifications about new posts/updates via: - -* The blog's [RSS feed](/feed.xml) -* [My Twitter Account](https://twitter.com/rootkovska/) -* [My GitHub Account] (https://github.com/rootkovska/) - - -The source of this repo is currently available via my GitHub account -[here](https://github.com/rootkovska/rootkovska.github.io) - - diff --git a/_posts/2015-04-23-qubes-30rc1-and-roadmap.md b/_posts/2015-04-23-qubes-30rc1-and-roadmap.md deleted file mode 100644 index 2f73bfb..0000000 --- a/_posts/2015-04-23-qubes-30rc1-and-roadmap.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -layout: post -title: Qubes 3.0-rc1 ISO and roadmap for 2015 -author: Joanna Rutkowska ---- - -A lot of important news today. - -Finally, we're releasing the first installable ISO for Qubes 3.0, the Release -Candidate 1 (3.0-rc1)! - -Compared to Qubes R2, which we -[released](http://blog.invisiblethings.org/2014/09/26/announcing-qubes-os-release-2.html) -last year, Qubes OS 3.0 brings major improvements in two distinct areas: - -* It implements the new hypervisor-abstracted architecture (which we call: - [HAL](http://blog.invisiblethings.org/2013/03/21/introducing-qubes-odyssey-framework.html)), - and introduces a load of new features: Xen 4.4, [new - qrexec](https://www.qubes-os.org/doc/Qrexec3Implementation/), and brings lots - of new VM templates with full Qubes integration: Debian 7 and 8, Whonix 9, and - [many more](https://www.qubes-os.org/doc/Templates/). - -* It also provides important modifications and improvements to our build system. - -Let me spend a while discussing these build system improvements now, as these -are quite important for the future of the project, I think: - -As Qubes is becoming more popular, and we get more contributions from the -community, the obvious problem we're starting to face is how to verify all the -contributions in terms of them being both of proper quality (i.e. not -introducing bugs to the system), as well as being non-malicious (i.e. not -introducing backdoors or compromising developer's systems). - -Another problem we're facing is how to avoid potential targeted attacks on us -when we're building Qubes binaries, such as ISOs or updates. E.g. we trust -Fedora and Debian Projects to produce un-backdoored (but not necessarily -flawless!) RPM and DEB binary packages, which we subsequently use to build Qubes -templates and Dom0/installation images. I believe it is reasonable for us to -make such a trust decision, because these projects are widespread and if they -decided to publish (and sign) backdoored binaries, they would be risking getting -caught red-handed. However, given Qubes extreme focus on security and its -attractiveness for various "interesting targets", it's absolutely thinkable that -an adversary, who somehow got access to Fedora or Debian projects binary singing -keys, might be able to target the Qubes developers who are responsible for -building the ISOs and/or the updates, and provide them with backdoored packages, -still correctly signed by the distro key. - -Finally, there is a problem of trusting us, the Qubes developers, that we really -are not malicious and produce and distribute un-backdoored binaries and ISOs, -matching indeed the source code we publish. Or that our build systems/VMs are -not compromised. Or that our singing keys are not stolen (e.g. through EM leaks). - -We believe we can address most of these concerns with the following mechanisms: - -1. By making Qubes building process more defensive, better sandboxed, so that it - is safe for the builder (i.e. preventing the building system's compromises). - This especially applies to building Qubes templates. - -2. By making the build process difficult to target. E.g. to be fed with - backdoored Fedora or Debian packages, even if they were correctly signed with - (a stolen) distro signing key. - -3. By making the templates distribution/installation mechanisms more defensive. - So that even if the user decided to install a 3rd-party-provided template, - that turned out to be malicious, that this would not affect other parts of - the user's Qubes system. - -4. By distributing the "trust base" for Qubes binary packages and ISOs using a - multi-signature signing scheme in which the Qubes Updater checks whether each - downloaded binary update package has at least M signatures made by one of the - N trusted, pre-selected parties. This, of course, requires deterministic - builds. - -We have already implemented #1 (sandboxed builds) by introducing support for -building templates in Disposable VMs (see -[here](https://github.com/QubesOS/qubes-builder/blob/master/doc/TemplateDispVMBuild.md) -for details). This will now allow to maintain separate repos for different -templates (Fedora, Debian, Whonix, etc.) with different people responsible for -each, and without the need to trust all of them (or carefully look at their -hands!). - -We have also implemented #2 from the list above by using TorVM as a default -netvm for all the VMs used for the 3.0 rc1 ISO build (as per #1 there are now -more than one involved). As an alternative/additional way to prevent developer -targeted attacks, we have considered to implement a variation of a scheme -[proposed by](https://www.whonix.org/wiki/Verifiable_Builds) Patrick Schleizer -of Whonix, but modified in such a way that our builder produces a list of hashes -of all the downloaded components used for the build (rpm/deb packages, tgz -sources, etc.), but ultimately didn't implement it due to other things getting -higher priorities (but still would welcome patches to enable such functionality). - -Finally, we have also made quite some progress in implementing #3 from the list -above. This was done by simplifying the template packaging (i.e. getting rid of -all the auxiliary files, such as icon or appmenus, that we can create later, -using the trusted code). This way it is now possible for a user, who is about to -install a potentially untrusted, community-contributed template package in Dom0, -to verify it won't compromise the system (by simply reviewing its metadata and -simple install scripts). In the near future we plan on moving to a better -packaging for the templates (and also unify them with VM backups packaging, and -make these also more suitable for VM migration/sharing) and to automate this -process even more, so that all the template packages were ultimately treated as -untrusted by default, always, without any user action required. - -The #4 would be most challenging to get, as currently most projects, including -all Linux distributions, do not build deterministically (i.e. various people -building from the same source code are getting different binaries). -Deterministic builds are, of course, a pre-requisite for this multi signature -scheme for use on ISOs and updates. However, all the work we have made to -sandbox the build process for (untrusted) components, such as the templates, is -also crucial here, as we want to make it safe for many parties to be able to -build Qubes and provide hashes for the binaries independently. - -Speaking of our plans, the diagram below shows the roadmap for the rest of the -year for Qubes 3.x and beyond (click -[here](https://raw.githubusercontent.com/rootkovska/rootkovska.github.io/master/resources/roadmap-2015-apr.png) -for a full size image): - -![Qubes Roadmap for 2015]({{ site.url }}/resources/roadmap-2015-apr.png) - -The major new feature coming in the next release (Qubes 3.1) is the management -and pre-configuration infrastructure. This is gonna be a basis for both remote -management (e.g. for corporate Qubes editions) and also for preparing customized -Qubes editions/configurations for specific users/use cases. More on this -important topic in an upcoming article. - -We have also invested a lot of work into what we call "core3", our next -generation Qubes management stack, mostly rewritten from scratch by Wojtek -Porczyk and Marek Marczykowski-Górecki. We have originally planned to base Qubes -3.0 on this new core3 stack, but the changes turned out to be too intrusive and -we decided to release Qubes 3.0 using the previous core2 (which is essentially a -Marek's rewrite of the original core I did for Qubes R1, and which we used -throughout Qubes R2), and delay the introduction of core3 until... Qubes 4.0, -planned sometime at the end of the year). In the meantime 3.1, and 3.2 releases -will bring additional features on top of the 3.0 we're releasing today, such as -the management and preconfiguration support mentioned above. - -We now also have a [qubes-roadmap](https://github.com/rootkovska/qubes-roadmap) -repo which tracks the high-level release roadmap for 3.x and 4.x, and the -diagram above was generated out of this repo. We're also planning to introduce -qubes-architecture repo with a collection of current documents about Qubes OS -architecture, both implemented, as well as planned for upcoming releases. Stay -tuned! - -Speaking of releases and roadmap, it's worth mentioning we have decided to -slightly change the release cycle for Qubes. The new scheme is modeled after the -Linux Kernel release cycle. More on this can be read -[here](http://www.qubes-os.org/doc/VersionScheme/). - -One important improvement that hasn't been illustrated in the roadmap diagram is -the introduction of many automatic tests into our build system. We hope that in -the near future this will result in Qubes 3.x releases reaching production -quality much quicker than the earlier R1s and R2s did. - -Finally, as many of you has undoubtedly seen, over the last weeks we have -decided to migrate our servers infrastructure out of our private servers (hosted -at AWS) to public services: GitHub.com and SF.net. This is part of a larger plan -to decentralize our project (see above), as well as provide better integrity -protection for some additional resources, such as the documentation (the Trac -wiki we used previously could not provide any form of integrity protection, -which we can now achieve thanks to git signed tags). This is for similar reasons -I decided to move my blog to git/GitHub.com (See my [previous -post](http://blog.invisiblethings.org/2015/02/09/my-new-git-based-blog.html) for -more explanations). - -The new Qubes 3.0 ISO can be downloaded from -[here](https://www.qubes-os.org/doc/QubesDownloads/). This is the first official -Qubes OS ISO built and signed by Marek Marczykowski-Górecki, instead of by -myself. As I have recently been involved in a New Project, I decided to hand off -the signing keys for Qubes Release 2 and 3 to Marek. Everybody who has been -following Qubes development in the recent years know Marek very well, I'm sure, -and realize he has been the lead developer of Qubes OS for a while now. For the -record, I still plan on playing a role of Qubes long-term architect/milestones -planner. And I also still keep the Qubes Master Key ;) diff --git a/_posts/2015-06-04-otf-funding-announcement.md b/_posts/2015-06-04-otf-funding-announcement.md deleted file mode 100644 index 96e88d2..0000000 --- a/_posts/2015-06-04-otf-funding-announcement.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -layout: post -title: Qubes OS Project gets OTF funding to integrate Whonix, improve usability -author: Joanna Rutkowska ---- - -It's my pleasure to announce that Qubes OS Project has got funding from the -[Open Technology Fund](https://www.opentechfund.org/), and this way joined a -number of other high-profile, open-source -[projects](https://www.opentechfund.org/projects), such as the Tor Project, or -Open Whisper Systems, who also have received substantial funding from the OTF -lately. - -OTF does not provide generic funding to projects, but rather sponsors -development of a set of specific features. In our case, OTF agreed to support -the efforts of porting [Whonix](https://www.whonix.org/) (which is a -compartmentalization-aware alternative to -[Tails](https://www.accessnow.org/about/staff)) to Qubes OS, as well as some -more generic work needed to make Qubes OS more usable, both in the context of -hardware compatibility and better UX. - -Lots of this work has started many months ago, in fact, as many of you might -have noticed. Majority of the Whonix and Qubes integration has then been -performed by Jason Mehring, a well known Qubes community contributor. This work, -of course, would not be possible, if not for Patrick Schleizer, who founded and -has been maintaining Whonix, in the first place. We thus decided to split the -funding among Jason, Patrick and the ITL (to account for the open source work -done by Marek Marczykowski-Górecki and Wojtek Porczyk on core Qubes components). - -The funding we got is pretty modest to be frank: it's $160,000 USD with the -intention to cover a year of development by, essentially, 3-4 skilled developers -working full time, and some even more than full time ;) Even by open source -standards this is very symbolic, as other projects, such as e.g. the Tor -Project, -[pay](https://www.torproject.org/about/findoc/2013-TorProject-Form990.pdf) not -not much less than this amount to _each_ of their core developers. And this is -understandable -- after all nobody wants crappy-paid developers to work on -software onto which people sometimes virtually entrust their lives. But that's -just the first step, and it's still important because it shows how Qubes is -going more mainstream now :) - -This funding is to cover the development efforts carried between October 2014 -and September 2015 (we have submitted our original proposal back in September -2014). Of course, a large part of this time period has already passed and the -development efforts during that time have been either (1) graciously donated by -the above mentioned developers, (2) partly funded by ITL, and/or (3) funded by -other means (i.e. donations to Whonix project). Now the above mentioned $160k -amount will be partly paied directly to the developers mentioned above as a -(partial) compensation for their work, and partly to ITL as a reimbursement of -the costs it carried while supporting this work over the past months. - -Critics might say that these are the US Government money we're taking, and this -might negatively impact credibility of the project... Well, it surely is true -these are the US Government money indeed. The OTF makes this perfectly clear on -their [own website](https://www.opentechfund.org/about/program). Shall we then -really worry about it? Shall our users worry? - -I don't think so, and here is why: - -1. Being funded by US Government does not necessarily imply maliciousness. - Occasionally the USG funds something meaningful, such as e.g. NASA or DARPA. - -2. Almost always there is _somebody_ (often powerful and of doubtful ethics) - behind any larger money... Somehow most people are not concerned about how - ITL managed to keep Qubes development over the last 5 years... Whose money - have these been, really? And those who think donations or some form of - crowdfunding could sustain a project like Qubes are advised to look into the - total amount of [Bitcoins we have - accumulated](https://blockexplorer.com/address/14zockMSKKp5MK6X2cHJ3mQwm9MwYsJ39j) - from donations over the course of nearly 2 years (yes, that's around $800, - for which we could probably afford to pay for... 1-2 days of work a skilled - system developer ;) - -3. Last but not least: we have been trying to keep Qubes development process as - transparent and infrastructure-independent as technically possible with the - goal of reducing the amount of trust our users needs to put into... us. This - includes, e.g. introduction of our [qubes-secpack repo with - canaries](https://github.com/QubesOS/qubes-secpack), the build process - improvements I wrote more about in [the previous - post](http://blog.invisiblethings.org/2015/04/23/qubes-30rc1-and-roadmap.html), - and also [recently - discussed](https://groups.google.com/d/msg/qubes-devel/BSz1c8Te7B8/A2UBFh_siTMJ) - on the mailing list. - -In other words: the mere introduction of US government-originating money does -not change much in terms of how trusted the Qubes OS project should be, in my -opinion. Admittedly, the binary distribution process currently remains the -weakest link here (because it's possible our signing keys could be stolen -somehow, or that one of us could be bribed or tortured or blackmailed to give -them away) and this is the case regardless of whether we signed a contract with -the OTF or not. Currently the only way to eliminate this weakness is to build -everything from sources, which actually is quite nicely supported by our -automatic Qubes builder system. - -In the future, when deterministic builds become reality, the multi-signature -scheme on binaries would become possible, reducing the problem of -single-point-of-failure with regards of binaries build and distribution process. - -Those who still felt uncomfortable about Qubes getting this kind of funding from -the USG are always welcomed to help us on getting other sources. There is, of -course, nothing that could prevent us from receiving funding from other -organizations at the same time. - -Finally, I would like to end this post by giving a big Thank You to a person who -is directly responsible for making this OTF funding contract a reality: Michael -Carbone. Michael approached me with the idea of submitting a proposal to OTF for -Qubes and Whonix integration back in mid-2014 and offered help with preparation -of the submission and managing of the overall process. Michael's dayjob is at -[Access](https://www.accessnow.org/about/staff), where he helps civil society -and human rights organizations around the world defend themselves against cyber -threats. Naturally this makes Qubes, especially Qubes with Whonix, an attractive -tool for him and his partners. For the conspiracy theorists: yes, Michael used -to work for the US Department of State as he clearly notes in his biographical -note linked above. He also studied in China ;) - -You can also read the annoucement by the Whonix Project -[here](https://www.whonix.org/blog/host-and-sponsorship-by-otf). diff --git a/_posts/2015-07-10-caspar.md b/_posts/2015-07-10-caspar.md deleted file mode 100644 index 75eb2b6..0000000 --- a/_posts/2015-07-10-caspar.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -layout: post -title: Caspar -author: Joanna Rutkowska ---- - - - -I met Caspar Bowden for the first time back in 2013 when he was visiting Warsaw -for a privacy conference. I was expecting to meet another boring policy/legal -person, but that expectation was quickly revisited. First, he surprised me by -pulling his laptop, which turned out to be running... yes, that's correct: Qubes -OS! And he actually turned out to just "get it" all, and so instead of dealing -with silly questions about security, which I'm so often exposed to, we had a -very interesting conversation, spanning both technology and politics. - -Of course this wouldn't be that surprising if I knew back then he actually -studied math and computer science on Cambridge back in the 80s, and then worked -as a programmer for some years, before he turned towards privacy advocacy and -politics. - -Caspar was a man with a strong moral fibre, not afraid to ask difficult -questions, even if this might be harming his career. He held certain beliefs -about how the world should be functioning (he was a supporter of civil society, -with a strong respect for privacy rights), and was ready to fight for them, no -matter what. At the same time he had little interest in honours for himself, -something that, ironically, might have been an obstacle for becoming more -successful in his fights (which so often is the case with Good People). - -He believed that the approach we took with Qubes OS was the right one and -essential for defense of privacy violations in the modern digital world. And so, -for the last 2+ years, Caspar was playing an active role of the project's -evangelist, tirelessly promoting Qubes to other members of the privacy -community, EU politicians, and many other people who he was dealing with during -his life's mission. As far as I can tell, Caspar was the first true Qubes -evangelist we have had. Last year he agreed to be officially listed as "Qubes -Policy Adviser", a position for which he requested no compensation. In fact he -has never received any compensation from ITL for his efforts to promote our -project... - -Caspar was also a board member for the Tor project. - -Caspar Bowden died yesterday, after an exhausting battle with cancer. -[[1]][^1][[2]][^2][[3]][^3][[4]][^4][[5]][^5][[6]][^6][[7]][^7][[8]][^8] - -It saddens me that Caspar passed away before having a chance to see a victory -for his efforts -- He died in very dark times. It saddens me we lost a great -ally in this war. It saddens me I lost a friend. - -In moments like this I also find it increasingly disturbing to realize how our -society promotes [dubious -individuals](https://www.psychologytoday.com/basics/psychopathy) to the top of its -ladder of success, people with whom Caspar often had to fight, while making the -life difficult and often discouraging for good people like Caspar. It's probably -worth to think about this, sometimes. - -To honor Caspar's work and to thank him, we decided to dedicate the upcoming -Qubes 3.0 release to him. - -It's been an honour working, discussing, and learning from you, Caspar. Among -other things, I'm also gonna miss our discussions about the nature of -consciousness. All the best with your new ventures, whatever and wherever these -might be! Thanks for everything. - -[^1]: http://www.bbc.com/news/technology-33473105 - -[^2]: http://www.theguardian.com/technology/2015/jul/10/outspoken-privacy-campaigner-caspar-bowden-dies-after-battle-with-cancer - -[^3]: http://boingboing.net/2015/07/09/rip-caspar-bowden-tireless.html - -[^4]: https://www.eff.org/deeplinks/2015/07/memoriam-caspar-bowden - -[^5]: http://arstechnica.co.uk/tech-policy/2015/07/caspar-bowden-tireless-defender-of-online-privacy-dies/ - -[^6]: http://www.theregister.co.uk/2015/07/09/caspar_bowden_dies_cancer_battle/ - -[^7]: http://paranoia.dubfire.net/2015/07/goodbye-caspar.html - -[^8]: http://www.independent.co.uk/news/people/caspar-bowden-dead-tireless-privacy-campaigner-dies-from-cancer-10380746.html diff --git a/_posts/2015-08-19-HelloWorld.md b/_posts/2015-08-19-HelloWorld.md new file mode 100644 index 0000000..a8236e5 --- /dev/null +++ b/_posts/2015-08-19-HelloWorld.md @@ -0,0 +1,7 @@ +--- +layout: post +title: Sah sah sah ... Test. +author: mfp19 +--- + +Hello World diff --git a/_posts/2015-08-24-Integrity.md b/_posts/2015-08-24-Integrity.md new file mode 100644 index 0000000..0467e60 --- /dev/null +++ b/_posts/2015-08-24-Integrity.md @@ -0,0 +1,102 @@ +--- +layout: post +title: Integrity. +author: mfp19 +--- + +Tags: [txt](#txt) [authorship](#authorship) [judicial](#judicial) [distribution](#distribution) + +The fork from Rooty should be complete now. I must reduce a bit all the verbosity I got from the original repo; +but it's ok; just cosmesis work. I've already spotted some Herrors: I hope my english teachers don't +point their browsers to this URI. +I'm really looking forward - damned curiosity, we are all alike - for The Real Thing instead: + +* integrity, in theory is granted by the merkle tree and the distribution of the tree. +In practice some italian guys about 2 years ago have produced a proof of concept for +git history (dates) mangling: the merkle tree grants integrity of the commit (ie: all his objects), +that is 'a bunch of SHA-1ed key-value pairs'; but in a commit there's no date object. AFAIK. +That is some sort of coherent with the design rules that Linus gave himself: git had to be simple and fast, +a minimum standard for teamwork, to build on top with, whenever some team need his own feature added on top to the minimum standard. +And dates are not strictly needed for every application; time is relative, so at this stage it is overhead. +Maybe for some applications SHA-512 is more advisable than SHA-1; it depends from the maximum entropy level +for that application. But all the rest looks good to me. + +* keys, there's no need of, to bind a commit to a time coordinate. A timestamp could +be applied producing a date=timestamp object on commit; including the timestamp in the 'hashed bunch of objs'. +In this way by manipulating dates ex-post for fraud, the hash would change, revealing the manipulation. +I say 'fraud' and not 'error correction' because for error correction there's... another commit. +It's not elegant because it grows the blob, but to track evolution is git's core business; +to loose details is a system fail; so the blob grows. + +* signing, is not strictly needed for the purpose of certifing dates. Open a text file for writing, +dump in the Unix Timestamp, and you got the time cert (but changing timezone/calendar will screw it; +other formats won't). Do the same with your name and you got author signature. Text files: amazing simplicity. + +I wonder why then [Rooty is suggesting](http://blog.invisiblethings.org/2015/02/09/my-new-git-based-blog.html) +to use 'git tags -s' to enforce 'integrity'. And I wonder what's the '-f' switch; +forcing overwrite a tag that is supposed to certify date and author? +It can do it by 'enlarging the blob' (ie: inflation) or by 'loosing details' (ie: frauds). + +A part from the tech, that is not really relevant, It looks like she is including +the 'authorship' in the 'integrity' definition. There's the need of Freud here, not me. +Because it is a pretty common mistake of all the university-grown scientists where the university +enforced the accountability and profitability, by forcing them to produce a minimum amount of papers per year +to measure their performance. + + + +And according to that mindset - but not mine - that mistake is not acceptable: +'In the name of My Almighty Unsolicited Peer Review, you are fired, Rooty'. + +But ... change the context and accountability become a must, judicial: +'you' who? She didn't set expiring dates on her keys. +She might be dead and someone else abusing of her Self Certified ID; +unless some of her buddies certified her key, see her on daily basis, +this individual is not a rogue/leech in her w-o-t, etc, etc, etc. +So, when I see her moving away from blogspot I should ask to her +to appear in a picture with a newspaper in her hands showing +today's news. Yeah, it looks funny, but ... for three years I haven't +been able to look at the 1st-May concert in Rome ... and I was +searching for that because it is one of the main public, +popular events that can't just disappear. +Well, it doesn't disappear easy. +And yes, I checked up: the concerts have been there. +They didn't in my computer only. + +We have two accountability problems here, we can't set her on fire +and 3 years of concerts disappeared from my computer and +[not only from mine, presumably](https://www.youtube.com/watch?v=ar2rLUhlhvI)! + +Damned Hackers, they are all alike: 'unwittingly and unwillingly debunking +[gov spies](http://www.bgpmon.net/how-hacking-team-helped-italian-special-operations-group-with-bgp-routing-hijack/) and their ancient treachery' :) + +Let's give up Rooty's Fire and Witch Concerts for a while and face +the distribution problem: GitHub, as far as I know, is a single administration, +probably buying storage around the world, using the commercial part of the legal framework. +As far as I don't replicate this git repo on another Autonomous System, +one Cease&Desist letter, a bunch of gunmen (with uniforms or not), +or a trecherous guy working at GitHub, could make it disappear. +But if I do, If I setup a complex VPN Empire made out of Tor, I2P, Freenet, +OpenVPN, CiscoWhatever, etc, commonly known as Darknet, +I get the gunmen at home - ex: Kim.Com, Aaron Swartz, SilkRoad, BitCoin, etc - +because of my [Advanced Digital Heterogeneous Datapedoterrosatanism](https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse). +To not even mention that my bank will refuse to serve me the e-bank interface. +You go on My tube and you'll find me dancing Froggin Molly with a 'Usual Suspect' t-shirt. +And I swear (without gpg): it was me, in 2010, after the cops came to my house, +and I realised that I just got a certificate from Uniformed Riflemen Lobotomisers. +Then I got abducted in DR, set free to AU, escaped to TH, and finally the concerts +in IT disappeared. + +[Freddy Krueger Glove](http://freddykruegersglove.com/) aka Discaimer: +I don't show my dancing here because I don't want to ruin your sleep for the next 3 days. +YOU watch my hairy belly bouncing, YOU are the only one responsible for your Nightmare. + +I did everything I could to not being indexed ... but: +[Once You Go Hack, You Never Go Back](http://www.lombrosity.com/). +Notice that my picture on lombrosity.com was taken in 2009, but released in 2015. + + + +Everything - except Integrity - should be ok, but I'll request a pull so that Rooty knows +about my fork and can eventually point out exceptions (licenses, mistakes, etc). + diff --git a/_posts/2015-12-15-Solution.md b/_posts/2015-12-15-Solution.md new file mode 100644 index 0000000..ee34eaa --- /dev/null +++ b/_posts/2015-12-15-Solution.md @@ -0,0 +1,133 @@ +--- +layout: post +title: Solution? +author: mfp19 +--- + +Tags: [reason](#reason) [tech](#tech) [security](#security) [end](#end) + +It looks like someone DID IT! They solved the [integrity issue](http://mfp19.github.io/2015/08/24/Integrity.html) and much more. + +While I was yelling at the moon, some little nasty invisible creatures in their secret basement were saving the world (again): +IT Guys, incredible people; they took over the Santa Claus helpers lab. +Those are their new toys that made me jump on my seat: + +* [IPFS](https://ipfs.io/) ([source](https://github.com/ipfs/ipfs)) +* [Ethereum](https://www.ethereum.org/) ([source](https://github.com/ethereum/)) + +# What for? + +The first one, IPFS, can (?) produce a permanent, robust, cheap, indipendent, private, disk, for every one; it's not the first filesystem distributed on top of the pre-existing "[The Internet for Everyone](http://www.ietf.org/rfc/rfc3271.txt)" but this is the first that exposes both file names and hashes to the user interface, it simply looks better (than plan9, gfs, etc). +The second one, Ethereum, is "how the Internet was supposed to work": contracts, work, procedures, accounting, currency. + +Combined togheter they sum up all the previous attempts, experiments, etc; decouple the machine part from the human part; meter everything using a virtual currency. +It may take a few years for you to save the little amount of money needed to join the party, but ... still: minimum effort for a huge result. +You can start with very little effort even if you are a nomad (ie: live on rent and alike) because +it is easy to move that 20cm box around when you relocate yourself; it's just a matter of plugging and unplugging, anytime, without loosing anything +or interrupting others' activities. + +They could work soon togheter, like that: + +1. spend your 100 coins to buy a [4TB disk](http://www.amazon.com/Seagate-SATA-3-5-Inch-Desktop-ST4000DM000/dp/B00B99JU4S), +2. spend your 100 coins for an [RPi](https://www.raspberrypi.org/), [ODROID](http://www.hardkernel.com/), whatever tiny board is on stage at the moment... +3. spend your 100 coins for a case (or DIY), +4. spend your 100 coins per year to pay 24*365 electricity. +5. partition that disk in 2 parts: private, public. The private part are your dick-pics, the public part are "public blocks" you don't know about. +6. move your public contents all (website, p2p shares, etc) to the public partition. +7. call to arms your current buddies on ed2k, kademlia, bittorrent, irc, etc. +8. map the public partition to an IPFS pool made with your buddies. + +Et Voila': you are a founding honorary member of the first Distributed Private World Archive. Projects like [The Internet Archive](https://archive.org/) could serve, togheter with other libraries, universities and even intelligence agencies, as an overall business continuity facility. Instead of sending money to projects like Wikipedia and Github, +for profit or not, you could reduce their costs by having part of the pedia in your house, office, love cabin, car, jacket, pants and - considering mSD memory+wifi cards - even in your bra and other orifices. Mmm ... just remember that the human body is mostly water and low power radios can't pass too much meat; we haven't figure out something for fatty pals&gals yet; but I'd prefer to carry a small box in my hands rather than having an usb cable coming out from my ass or an ultrasonic deep water communicator vibrating my breast, so please, just use a normal usb hd box or smartphone until someone figure out something better for intimate carring spots. +Things like arxiv.org and jstor.org could share efforts on storage maintaining their own identity and best practices through their own Ethereum app over public storage. +Instead of having fear of loosing important pieces of human art, history, wisdom; some of those libraries could automatically acquire files that are loosing copies around the world, to ensure enough redundancy on niche art pieces only. Making knowledge&arts tsunami, war, nuclear, resistant. +It is also easier to identify, track and censor; but there's more knowledge today than there was yesterday... + +Any of those project would be just a spider that runs on the filesystem that is distributed in our houses; by having the way to decrypt (or brute force) we can also access it without breaking into someonelse's house, office, basement, etc. [Aaron Swartz](https://en.wikipedia.org/wiki/Aaron_Swartz) is smiling. + +Now consider that IPFS is a complicate information technology thing "upon which one can build [...] blockchains"; +and Ethereum is ... guess what? A blockchain. This means that whether you are a +public administration seeking for a cheap&reliable IT solution, or a private business +seeking for a cheap&reliable IT solution, and you have already given yourself an IPFS box, +by adding Ethereum you can make your own private custom application, on top of a public +distributed filesystem, on top of your private digital locker under your bed close to your gun. +You might end up protecting Justin Timberlake's songs and some of my dick-pics as well, but +like it or not, this way of keeping memories simply costs less than any commercial solution (both for individuals and the world as a whole) and it is more reliable. +And my dick-pics in your public part would be encrypted: you won't see anything disgusting in your premises. + + + +A few more steps then: + +9. Port your old apps to Ethereum. +10. Trash your old apps. + +Tadaaaaaaaaaaaaa: + +> Governments of the Industrial World, you weary giants of flesh and steel, I come from Cyberspace, the new home of Mind. On behalf of the future, I ask you of the past to leave us alone. You are not welcome among us. You have no sovereignty where we gather." +> (["A Declaration of the Independence of Cyberspace](https://projects.eff.org/~barlow/Declaration-Final.html), [John Perry Barlow](https://homes.eff.org/~barlow/)) + +# Technology + +Technology wise, I didn't have chance to test it yet, to figure out what to use as underlying filesystem (if any), its performances, and so on. And there's a lot to test here. Some examples: + +* Both are engineered to be distributed, and Ethereum claims to be "without any possibility of downtime, censorship, fraud or third party interference". I spot some redundancy. Even more redundancy considering things like ZFS instead of EXT4 to comfortably grow the local box, or the need of DB applications (ex: Oracle, Postgres, MySQL, etc) to keep running current applications until the porting will be complete. +* Multiple layered/nested encryption allows to safely share a private Ethereum project on a public huge filesystem. But it doesn't necessarily produce a safer locker; it could be all the way the opposite. The issue here have to be dissected and regressed deeply. +* Modern devices, even cheap handhelds, have plenty parallel power to cope with all this fragments, retransmissions, encryption but are we sure that it is enough? Whenever I see javascript I'm skeptical... +* And what about the buffer bloat problem? And what about garbage collection? There will be the need of public spiders with specific functions as well; and this produces overhead (that someone have to pay for). + +There are many other words rumbling in my poor brain at the moment (ex: Tor, plausible deniability, etc). But we (me, you, anybody) don't need (almost) any fucking cloud service. Any more. + +# Sekurity + +Et Voila': the full mankind's imagination stack could be soon something like a simple minimum filesystem that exposes blocks +both to your local private operating system; and to an IPFS public planetary 'disk', on top of which Ethereum apps are built, updated, delivered, run. +All Free tech, all private, all shared, all metered with a pretty predictable electricity function to simply (self)plan, (self)schedule, (self)execute, fair (self)societies with. + +Hardware issues (ex: why my device can, by design, spy me?) aren't solved; but I'm positive about that: the HW needed for such software setup is pretty simple to design and produce. HW and SW have always evolved each other; the more we change our behaviours the more the HW evolve into that direction, the more the HW evolve in one direction the +more we change our behaviours. In all this, the only problem has been the law each and every time we embedded that law into the HW or SW code - "Code is law" - and some assholician publicly claimed some revolutionary strategy for the parliament to fix problems: degenerative parassitic redundancy. + +When I was 'barely 18' - 1994 - I used to spend my summer time with a few guys passionate about hamradio. One of them was 16 and got some sort of [SWATted](https://en.wikipedia.org/wiki/Swatting): cops came, searched&seized. Allegations: pedophilia. Truth: he was 16, by law couldn't be a perv; but the contract of the internet connection was to the name of his father (that didn't know even how to turn on a computer) and this resulted into that infamous allegation; his 'crime': having an FTP server, open for others to upload on his computer. Result: Free Purging. In the meaning that he got purged for nothing, and you all paid for that 'service'. Aftwer a few years we figure out that the same happened massively country wide; we call it 'Italian Crackdown' (of the Fidonet amateurial network). Today someone say that it was to enforce closed source software market policies, others to clamp down Peacelink network. +Sixteen years later (2010) happened to me too (allegations: stalking, but at the end of the police report there was also a question about pedoporn... a masterpiece). + +And others could end up hammered because of the traditional approach (and pre-existing laws!) to information. But I'm positive about that too: in US many old laws pre-existing to packet switching have ben reviewed; in EU are struggling to cope with that, and in many other countries as well, but they keep working to fix the incremental mistakes they did in time; most of the technology-enabled people of the world have learnt from us, their kids, or they will. They'll be Assimilated. + + + +This time we are doing it not at file level ("a song"), but at block level ("a fragment of a song"): no matter how much WIPO uniformed the Intellectual Protection practices around the world because a block, by itself, content nothing. And all of them, one content, is scattered anywhere in the world: costly to track, fucking expensive to persecute. + + +(dedicated to the Italian Prime Minister Matteo Renzi, an 80s born idiot) + +Note to the italians: + +* [Dario Fo](https://en.wikipedia.org/wiki/Dario_Fo), 1997 Nobel Prize in Literature, [02/2013 said "Culture can be eaten"](https://www.youtube.com/watch?v=SOPawaoOESA). +* [Gino Paoli](https://en.wikipedia.org/wiki/Gino_Paoli), 2013-2015 President of the italian collecting society SIAE, [02/2015 proved him wrong](https://en.wikipedia.org/wiki/Gino_Paoli#Legal_problems). + +With this Cathartes [vulturing](https://en.wikipedia.org/wiki/New_World_vulture), we couldn't expect much more than [that](https://en.wikipedia.org/wiki/Cathartic). + +If they want to keep bashing the-so-called-computer-piracy, we can spawn another round: there's steganography (ex: arts carried by bitcoin blocks). It would further slow down our messaging, but it is pretty interesting stuff to add on top to distribution and cryptography. Just remember steganography, just in case [the current EU law](http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2014.084.01.0072.01.ENG) will fail, [as the previous one did](http://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX:32001L0029), and so on ... [until Daxos and the Cathartes stop messing around my profession](https://www.youtube.com/watch?v=gI6sARmxEuc). +And remember: by hashing any circulating file, and elevate such pratice to 'best practice' (ie: IPFS or Ethereum gone standard), you can't just replace padding with secret content ... you can't modify the file without changing its hash, operation that could trigger an alarm. + + + +# Conclusion + +This stuff might be already operational in the big datacenters and have been used to mass manipulating us all. Personally I've spotted plenty time-screws in the last 8 years that made me think to off side track adjustments trough snapshotting contents back and forth in the time domain, to manipulate single individuals. For a few years I haven't been able to find webpages with a date on page. Public events just disappeared from my device. The same for judicial high court sentences and public law sources, despite the fact that the italian constitution makes mandatory to publish the law on "Gazzetta Ufficiale". Remember that the Italian Constitution was a joint effort to avoid what happened in the WWII, every single detail of that piece of paperi, like it or not, exists for a very good reason. + +By using multiple concurrent, nested, blockchains, nobody can manipulate us all in the same way. Any more. + +Let's bootstrap this thing; if libraries, big datacenters, companies will join us ... well ... the more the legacy formal systems +(ex: government registries, Amazon EC2, Dropbox, etc) will crumble under their costs, and the more we would feel the need of +creating "NSA" account into Ethereum private chats apps, as well as "TAX" accounts into our Ethereum private business projects, +to allow escrow of private transactions, and public funding on voluntary basis. + +I know, considering what just happened (Assange, Manning, Snowden, and many other "unsung heroes"), and the ongoing wars, +to feel the need to pay taxes or invite a spy at home may sound ridicolous but indeed ... it's already happening. +It always happened. Just cross your fingers and work to make the costruens (lat. "building") part faster than the destruens (lat. "destroying") part. +I mean, work on both parts but keep both the speedometers under your eyes. As usual. + + + +Soon or later there could be an "Hall of Fame" for all these guys, where to add also the IPFS&Ethereum developers. + diff --git a/_posts/2015-12-17-Constitution.md b/_posts/2015-12-17-Constitution.md new file mode 100644 index 0000000..cf186d9 --- /dev/null +++ b/_posts/2015-12-17-Constitution.md @@ -0,0 +1,185 @@ +--- +layout: post +title: Constitution? +author: mfp19 +--- + +Tags: [politics](#politics) [personal](#personal) [crackdown](#crackdown) [hacktivist](#hacktivist) [constitution](#constitution) [pirate](#pirate) [conclusion](#conclusion) + +There was an [integrity issue](http://mfp19.github.io/2015/08/24/Integrity.html) and there is a technological [solution](http://mfp19.github.io/2015/12/15/Solution.html) that doesn't expand the attack surface by introducing third parties (ex: cloud commercial services). On top of TCP/IP, with its own problems of integrity (ex: of routing messages) and its own solutions (ex: encryption of handshakes and routing messages). And maybe, one day, on top of [ad-hoc radio networks](https://en.wikipedia.org/wiki/Wireless_ad_hoc_network) as well, where integrity problems and solutions are tightly embedded into electromagnetism: the power of the electron and the beauty of the light. Finally. + +But by hashing everything, every single 'word' (7,8,16,32,... bit) in the common public filesystem is easily identified; and the same for any key-value pair (ex: author-message). And this easily identifiable author-message pairs run on telecommunications systems having for their core function to keep track of all (and any) connected device. Is it the beginning of a nightmare? + +What is not clear, in fact, is the legal part of the story. Do you really want it without asserting your rights first? In other words: do you, me, need a pre-defined set of safeguarding rules commonly called Constitution? + +I was kid in Italy, and in Internet, so I've never had the need of a constitution; Italy had one, and the Internet was just working fine thanks to this [Deutsche Wunderbar](http://dasalte.ccc.de/hackerethics.en), [common sense](https://en.wikipedia.org/wiki/Fair_use), some [legal barriers](https://en.wikipedia.org/wiki/Sony_Corp._of_America_v._Universal_City_Studios,_Inc.), and some [transcontinental games](https://en.wikipedia.org/wiki/Software_patent). Things evolved pretty badly up to two modern examples of (Internet) consitutions aiming to restore peace of mind to all: + +* [Marco Civil](http://pensando.mj.gov.br/marcocivil/lei-no-12-965-de-23-abril-de-2014/) +* [Dichiarazione dei diritti in Internet](http://www.camera.it/application/xmanager/projects/leg17/attachments/upload_file/upload_files/000/000/187/dichiarazione_dei_diritti_internet_pubblicata.pdf) + +Those are two [civil law (aka continental law)](https://en.wikipedia.org/wiki/Civil_law_%28legal_system%29) countries. In common law countries instead, the people produced amazing 'cases' that triggered some parliamentary proposals and presidential acts + +* Julian Assange +* Chelsea Manning +* Kim Schmitz +* Edward Snowden + +## Political background. + +Around 2000 the EU leaders gatered in Lisbon and drafted the so called "i2010 Strategy". Then 9/11/2001 and ... + + + +In 2008 the EU leaders signed - by overriding French and Irish vote on the EU Constitution - the so called 'Lisbon Treaty'. Italians and probably others have been simply ... jumped, bypassed without a referendum. +From there on, there have been an european train of [intellettuali organici](https://en.wikipedia.org/wiki/Antonio_Gramsci) that did anything they could to keep this plan in place: [public funded propaganda](http://www.europaquotidiano.it/2007/11/27/veltroni-bipolaristae-il-treno-parte/), information warfare (ex: this text, if public funded and slingshotted on any media for prolonged time), fake judicials (ex: me; for my personal security I don't have on-line docs to link), abduction of activists (ex: [me in Dominican Republic](https://www.youtube.com/embed/YBkBKePiEK8)), espionage on radicals (ex: [me at Partito Pirata with servers in Aruba S.p.a. webfarm](http://www.bgpmon.net/how-hacking-team-helped-italian-special-operations-group-with-bgp-routing-hijack/)), etc. + + + +Roger Waters for president! + +## My personal background. CHECK IT! + +I was following the european legal issue by proxy: my ex girlfriend was studying law and this european process was a constant topic between me and her. But I had top priority problems to access the judicial system, and the things were getting worse in time; I simply couldn't recognise a working public establishment. To let them + + + +replace the Constitution was just ... too much. + +So I wrote what I call 'My Constitution' and (on 22 July 2008) addressed the President of the Republic Giorgio Napolitano thanking him for my culture, introducing My Constitution and resigning from the italian citizenship because my constitution factively overlaps, include, his one. + + + +No black magic here: I've just compressed the first (roughly) 20 slim articles of the Italian Constitution in 7 fat ones, applied old patches never enacted by our catholicians, and added a few ideas for practical reasons. I showed the promo video to a few (bored) people and asked to evolve that text using tools like SVN (or alike) rather then a wiki; so that, by adding collective intelligence, one day it could become something serious. + +# Italian Crackdown + +> A movie that was originally a comedy, but became a documentary. +> (Urban Dictionary about the movie "Idiocracy") + +The title of that 2008 video is 'Italian Crackdown' because in 1994 police cracked down in one night the italian chapter of Fidonet amateurs network (for no reason: nothing was illegal before, very little was found after). They might have done it for commercial reasons (SIP, the public owned Telecom Italia, was selling an underachieving service called Videotel, similar to Compuserve; and the Internet was coming out). In 2008 the whole thing has gone simply ridicolous: the formal systems were failing because of an insane double spending for paper&computer, but politicians, journalists, artists, were excited because of this 'new frontier' of more spending for nothing. The ones didn't know who [Keynes](https://en.wikipedia.org/wiki/John_Maynard_Keynes) was had cocaine-digged craters in their brain; [some of them](http://www.treccani.it/enciclopedia/gianni-riotta/) even publicly stated to be 'the first on the internet', referring to the usual insignificant act of uploading text to a file server (someone like me was managing). +In my small hometown have been a technology event: they talked of marketing, only. Not marketing of technology, but marketing by itself. +Uh? Ehm? Sorry sir, I red "Technology" and I got "Marketing": where is the technology? + +And all around was all the same. The telecommunication closets in the streets were broken: doors unlocked, open, missing; our landlines, hundreds per closet, exposed to anyone and anything. But they were using the network for chatting, downloading, chatting with a better platform, and porn (with videochat on a better platform). + +Here me helping Robin Good at video-documenting the rise of the blog phenomenon + + + +And here me (at 6:25, the one with a blue florwery idiot-like hawaian shirt) documenting the rise of the vlog phenomenon + + + +They have been one whole day talking about videomaking repelling any kind of deeper tought about the infrastructure: "Hey dudes, the telephone closets are broken! How do you stream your masterpieces?". Lynched. +Things like asymmetric datapaths (ex: ADSL) that limit the upstream (ie: publishing capabilities) where very far from their comprehension. +They kept talking about 'media democracy' repelling any important topic about that. + +And with the representatives of the newly elected (2006) Ministries was even worse, me "I have a plan! I've already made a prototype, it works!": + +* Ministero delle Communicationi (Communication), answer from Paolo Gentiloni sending me to ([Paolo Zocchi](http://www.larete-innovazione.it/innovazione/salutiamo-paolo-zocchi/), note: he was the toyboy of Linda Lanzillotta at the Ministry of Regional Affairs, but they were crowd-sourcing inside the same party instead of cross-ministries to produce a public unity so you won't find any public registry about him at MinComm): "There's no table to drop your project upon", +* Ministero dell'Ambiente (Environment), answer from Beppe Grillo sending me to([Maurizio Pallante](https://it.wikipedia.org/wiki/Maurizio_Pallante)): "How do I sell it to the people?". + +Holy crap: it's infrastrcutrue, 'infra', INFRA! Between structures: everybody give it for granted until it fails; there's simply nothing to sell. The plan was exactly to foster the crowd-build-up of a backup network with cheap charlie money until they figure out what to do with the traditional copper network and its (scattered) fiber optic updates. And in my small town was even worse, the mayor: "I want to make it self-sustainable: what about mandatory advertising on webpages?". At the same time, in the same area (province level), they were wasting money with Provincia Wireless Spa project, everybody want both a share and a wage for their kids. The final result is that at the moment there's no wireless service network, and a huge amount of money wasted. + +Basically we were paying for the 1994 Italian Crackdown by having a generation of Anal-f-Abets in charge. + + + +# Hacktivist + +I published the Italian Crackdown video 3 days before the parliament voted the Lisbon Treaty. It wasn't on purpose; I mean: I had no idea that they were going to vote on 25th. I was at MOKA2008 in Pescara (IT) to deliver my other video made at CCC2007: "Sapere Aude 1784". + +But later on I've been happy to discover that, by heart and by facts, I could have been the only one (?) to not have signed the so called "Lisbon Treaty", and have declared it. Without any need nor intention to profit from it: just sincerelly [stateless](https://en.wikipedia.org/wiki/Statelessness). Terrorists, mafia, criminals act for profit (emotions included), without warning; and are outlawed for it. I didn't. Cool. + +It was just a weird thing: I locked myself inside and made fun of all the others, "you are outside!"; but legit, by international rules because of the public acknowledgment. I (didn't) fight the law. I've never had the will of doing so. I was just an immigrant in my own town. +And I love it, I don't want to change it. Despite the fact that I'm living abroad, and I probably agree with most of the current european policies, I don't want to sign the Lisbon Treaty until the whole italian side of the story is fixed (if ever). + +When the cops came to my place in 2010, with a search&seize order, I was scared to death, upset, angry, fleble, disoriented. And still I am. But also happy, because finally I had the chance to access the judicial system that I tried to access in the past 4 years, in vain. It was just weird the way it happened. + +I've been since then trying to watch edge cases without getting involved - easy to say, hard to do - in the attempt to build up my imaginary law, on top of My Constitution. The hard part in fact is to understand things like: why the hell cops don't wear cams on their uniforms to avoid popular hate and such things? Why the military don't arrest those politicians straight away and send us to new elections? Result of my research: a nevrosis, and the damned feeling that freely searching for those answers is too risky. + +## We don't need no Constitution + + + +Even today - after so much digging for clues in others' business, collecting and mixing so many opinions - I'm not sure whether we need a Constitution or not. Some of the longer lasting 'western democracies' don't have one, ex: UK. And I love the federations: CH. Expecially the ones based on individual will (one et all) to partecipate for a common result: UK&CH. Simple democratic culture deeply rooted into their people. + +The common law systems (ex: UK) showed an impressive ability to quickly adapt to the times. Administratively. So one of these 'new old ideas' that I added to My Constitution was to scrap the third part of the Italian Constitution, the part that incept the administrative institutions and appoint them of their functions. To have a detailed incepted institution is too static, too entangling, too slow to adapt; if you consider also the feedback (ie: judicial) it become a black hole, a shithole. A recursive credit crunch machine. +The british way, for administrative needs, seems to be more practical, more dynamic: everything is always open for an immediate change, everything except the institution changing everything. The institution itself is very closed instead, thanks to James Bond and special courts that release secret information to the public on request, if possible. In this way only a small portion of the activities are hidden to the public trust. It sounds reasonable, in a kingdom. + +The EU Constitution instead was written all the way around: by including any kind of management 'best practice' found in one of the 26 EU members and anywhere else in the world and in the outer space. Plus 26 law enforcements - some of which James Bond like - stepping on each other's toes. Probably the only approach possible in a so etherogeneous context but, as I said: a black hole, a shit hole. It ends up that in theory we all should be clones instead of ... just equals. +And the Lisbon Treaty has been even worse: they scrapped the human rights, referendum, etc, and silenced the french and the irish. The german (austrian? swiss?) law student that was addressing these issues - with german precision! He published a federative version of the EU constitution, comparated page by page - simply disappeared from my radar. The same that had already happened with the EU Parliament video sessions after the first in-session rebellion: closed doors, and those videos were aired again after all the games were over (I've seen them in 2013-2014, pushed as "today's news"). +And, if you look at the judicial systems: have you ever seen someone running naked in the streets with a machete in his hand screaming about zombies and UFOs? Well, that one was a judge of one of the 26 european high courts, that has been in office across the EU judicials meltdown. + +Unacceptable: "Farage's (UK Indipendent Party) for President! Send the Avros (again)!". I was yelling the same crap 10 years before to the germans: "PLEASE, FREE THE ITALIANS! SEND THE STURMTRUPPENS (again)! BOMB US! DO SOMETHING!". But nothing happened. They sent some nice guys to run some small business in Tuscany (and I interviewed one in 2007 in Finowfurt, desperate because ... well ... if you are used to open a VAT account in 5 minutes and start doing business in 6... in Italy you're going to fail, but don't take it personal, it's not you). + +Some sort of popular partecipation was added back in 2013, at the very end of the United States of Europe raising process: if you succeed to sign thousands of times, a petition across 26 states, the parliament takes the people into consideration by scheduling the issue in their agenda. A struggle to deliver a paper to the frontdesk of a small office in the basement of somewhere; a simple hands gesture on a monitor to schedule it; about 3 seconds to open the mic, say nothing, close the mic; 50.000 euros to pay the whole (no)thing. A pretty weird mapping of the italian constitution democracy statement (art. 1, 2nd comma: "The sovereignity belong to the people"). +The italian problem was that ... well ... italian politicians never worked: the administrative land units reforms was in a drawer (already approved) since 1990 but have never been actually made because there were no enough seats for all those idiots; and basically the same for any european policy. At the time of EU United States ... Italy was already in Africa rather than in EU, our politicians publicly blaming the Large Hadrons Collider for melting the Alps (as suggested by their vatican's ghostwriters), and the people believing it. + +The same continual failure you can see with the brazillian Marco Civil and the italian Dichiarazione dei diritti in Internet. Decoupling the plan and the exec is too slow. Watch out: don't say it too loud ... when I said that the italian Constitution was not enough for modern times I've been gagged! + +A failure that was clear long time before the Lisbon Treaty: [Vilfredo Pareto](https://en.wikipedia.org/wiki/Vilfredo_Pareto) (maximum economics), [Kenneth Arrow](https://en.wikipedia.org/wiki/Kenneth_Arrow) (impossibility theorem), [Amartya Sen](https://en.wikipedia.org/wiki/Amartya_Sen) (capabilities approach). My father always said that he is doing two of the three impossible jobs: the medic, the father, and the politician. The first can't be avoided unless we find a way to compress medic studies and practice in a few months; the second is 100% a choice nowadays; the third can be eliminated. One paradoxical layer less. + +## Stuck in the middle with you: Ethernet&Ethereal&Ether&Ethereum. + +The games - for us, italians - were over with the constitutional court sentence 01/2014 that declared unconstitutional the parliaments since the 2005 voting system changes, but stated the need of continuity for law&order sake. And the whole judicial system adapted ignoring popular instances of individual rights violations. +Uh? Ehm? Sorry to disturb sir, but I didn't understand ... I have some questions ... honestly ... I'm serious now: what about the Lisbon Treaty? What about United States of Europe? Is Our Constitution valid? Is there a Parliament in Rome? A President? Who is the civil authority that the militaries answer 'Yes Sir' to? What the hell is the legal part of the story!?!?!?? Again: no clue. Any crowd-sourced initiative failed because who collected the ideas never accepted the bottom one: no need of representatives acting as permanent middle-man between landlords-citizens-voters-whatever and the execution. + +So far I've seen: + +* the Personal Computers War that ended when we added an ethernet Card to every Personal Computer. +* the Internet War that ended when we added a firewall to every antivirus. +* the Mobile Phone War, that ended when we added porn to every mobile phone. +* the Big Data War, that ended when we added the capability to add money on every letter exchanged on any telecommunication device. + +[I've seen things you people wouldn't believe](https://en.wikipedia.org/wiki/Tears_in_rain_monologue). But yes, I have an Android phone. + + + +Today, despite all those failures in both the legal and the technology departments, we don't have a clue about how to produce our own law. So now have a look at those three tools: + +* Water: in the name of Bruce Lee ("Be Water") I order you to not use a fucking powerful pocket calculator called Smartphone if you need to find a compromise with less than 5 people. Just buy a bottle of water, sit down in a quiet place togheter with the other 4 people, and COLLABORATE toward a common solution, using a proportional system. The reason why My Constitution started with "Italy is a democracy based on collaboration between the people honouring this paper" is that the other way to solve an issue is bloody and we don't have legal deathmatches. I would like to vote for public certified, military monitored, arenas for deathmatches. Some people need it, some people already does it, and we are their hostages: so, why not? And that's why I'm not a pro-life. I consider my life sacred, but I want for you et all to make your own way. If you have fear of the others 4, just add 2 big militaries in the room to overview the process and PEACEfy emotions. Hardcore censorship. +* [Vilfredo](http://www.vilfredo.org/): I've been having a nice dinner, in an amazing Rome's city center (Trastevere), togheter with one of its developers in 2010. He described his toy to me, and my feedback has been: "it seems working good to you because you tested it in a university-like environment, among you developers only. All the alpha testers had motu proprio toward COLLABORATION: the real personal desire to see it working. Take it out and you'll see it failing because of one asshole, or because of too many undisciplined people bubbling out problems and solutions, or both". Today, 2015, on their webpage they introduce the tool: "Vilfredo allows groups from 5 to 20 people to ask open questions and reach consensus in an easy and fair way". They took my feedback. Now it should work without the need of censorship. +* [Liquid Feedback](http://liquidfeedback.org/): this tool is exactly why in the [Jargon File](http://www.catb.org/jargon/html/index.html), chapter "Weaknesses of the Hacker Personality", you can find: "Hackers sometimes have trouble grokking that the bubble gum and paperclip hardware fix is actually the way to go". But the [Schulze method](https://en.wikipedia.org/wiki/Schulze_method) in its heart, core ... ehm ... yawool ... kernel is a jewel of the crown. It solves the Entscheidungsproblem (decision problem) without creating competition first, in order to fix it after. It doesn't bomb first, and rebuild after, in order to raise the GDP two times. +The downside of it is complexity: it can hardly be computed with a pencil; there's the need of a well trained [autistic guy](http://www.imdb.com/title/tt0095953/) to compute the votes with bare hands. It is pretty interesting for [waterfalls](https://en.wikipedia.org/wiki/Waterfall_model) in traditional voting locations with cabins. I mean: full fleatured anecoic chambers with military grade equipment, special forces on entrance included. And to sum up distributed systems for analysing, publishing, etc. +The whole system around the Schulze method is a messy mix of different technologies packet together in order to (self) real time monitor the voting machine and by doing so avoiding the scandals that we spotted (in Florida) when Bush Jr was nominated (ie: non elected) by using electronic voting machines made as simple transposition of the current voting procedures (that were made for a pencil, not for a computer); and similarly happened in 2006 italian general elections (PM Prodi). +I don't know how LiquidFeedback evolved into the second version; they could have wrapped the entire system in a virtual machine or alike, to allow a security team to real time monitor the underline system running the virtual machine and, by doing so, monitoring the entire voting cabin. + +This is what I got and freely distributed, up to early 2012, trying to keep the italian chapter of the Pirate Party strict on producing a digital tool to write our law without intermediaries by enforcing the once-upon-the-time called [digital rights](https://www.eff.org/). Failing. + +The Pirate Party (Italian Chapter) LQFB's users were 'escaping the tool': LiquidFeedback forced the users to pop up issues, build up solutions, vote them; but they were avoiding this process complaining for lack of freedom of expression, and going back to the mailing lists to freely discuss about the issues. +Failing miserably to empower the beauty of the wiki (the tool itself). +Same had already happened with forums. Same of the email. And the same of the newsgroups. The human bug is to fail the beauty of the discussion toward the solution of a common issue. LiquidFeedback was a chance, and they failed it. + +Some politician even endorsed the innovation attempt, and manipulated the thing to the point that it was not useful any more + +* Pirati5Stelle: [Movimento 5 Stelle](https://en.wikipedia.org/wiki/Five_Star_Movement) exspun-off. +* TuParlamento: [Partito Democratico](https://en.wikipedia.org/wiki/Democratic_Party_%28Italy%29) spin-off. + +Both modifying the LiquidFeedback to prevent users to pop up issues, and both introducing commenting capabilities: they changed an executive tool into a crowd-sourcing tool. We were aiming to remove the politicians from the public process; they were asking us to handle our ideas to them. The whole thing was simply ridicolous. It turned out that the only one using LiquidFeedback properly was a dinner time politics show (AnnoZero) presented by one of the most important contemporary journalists (Michele Santoro) and his team: they were the only one to use it as a feedback tool instead of an exec tool (Partito Pirata) or a crowd-sourcing tool (M5S's and PD's spin-offs). + +So I delivered what I had and quit my last not-paid-full-time-job (ie: mangling LQFB PLSQL to compartiment the voting machines according to the current administrative divisions) in favour of full time dancing + + + +and [chatting](https://plus.google.com/111241598218967792402). [Nash Equilibrium](https://en.wikipedia.org/wiki/Nash_equilibrium). + +I went back to have a look at Partito Pirata in late 2015: they [adopted](https://forum.partito-pirata.it/) a new, brilliant, [chatting tool](http://www.discourse.org/). Worthless. + +Sometimes looks like the mankind can't live without publishing, without show off. Indeed, media companies only are struggling because they can't aggregate popularity, loosing some of the public functions that they got with [Gutemberg](https://en.wikipedia.org/wiki/Johannes_Gutenberg) first, the [Statute of Anne](https://en.wikipedia.org/wiki/Statute_of_Anne) then, the hundreds of laws made in every jurisdiction since then, up to the actual picture in [EU](http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2014.084.01.0072.01.ENG), [US](https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act), and [anywhere else](http://www.wipo.int/). + +# Conclusion + +From my perspective Ethereum is the (best?) result of the third iteration over this modern democracies struggle, that incorporates the contracts discipline and the BitCoin (blockchain) experience. Some of the LiquidFeedback's features (ex: to show on page the database queries so that every user can track his actions in the backend) are embedded into the blockchain system. + +I feel grateful to live at the same times of those guys. They fucking nailed the fucking issue down: dynamism in human organizations. Liquid. +They reduced [SAP](https://en.wikipedia.org/wiki/SAP_SE) to the point that everybody can have one, and many can use it; and by doing so, all the human activities can bubble bottom-up in a very tidy (ie: usefull) way, instead of being top-down directed. + +The human bug remain, but Master (Bruce) Lee would be proud of those computer guys. + +By having thousands of teams working in Ethereum-powered activities, every activity would share the same information protocol, and all of them would be easily interconnected trough Ethereum's contracting capabilities, accounted trough Ethereum's currency, and certified against the public trust trough Ethereum's blockchain. Automagically. To many europeans it looks like an asian puzzling game; indeed it is a pretty well know project/softdev/etc practice. + +And the first project should/could be to produce a common ruleset to protect us all. A kind of Constitution to map the currents humans rights to. A permanent, blockchained, evolutionary, ruleset. + +It is way better than a static Constitution. + diff --git a/_posts/2015-12-20-Timeless.md b/_posts/2015-12-20-Timeless.md new file mode 100644 index 0000000..b32ba69 --- /dev/null +++ b/_posts/2015-12-20-Timeless.md @@ -0,0 +1,75 @@ +--- +layout: post +title: Timeless +author: mfp19 +--- + +Tags: [time](#time) [imaginary](#imaginary) [moneywith](#moneywith) [finance](#finance) + +We had a [problem](http://mfp19.github.io/2015/08/24/Integrity.html), we have a [solution](http://mfp19.github.io/2015/12/15/Solution.html), and we marched to [enforce human rights for all](http://mfp19.github.io/2015/12/17/Constitution.html) + + + +Now we need some beta testing and debug before heading to the first application. + +[Time](https://en.wikipedia.org/wiki/Time) in latin was 'tempus'. What is the [temporal power](https://en.wikipedia.org/wiki/Temporal_power) and why it is said to be in contrast with the [spiritual power](https://en.wikipedia.org/wiki/Temporal_power_%28papal%29)? + +Think about drugs effects: [ketamine](https://en.wikipedia.org/wiki/Ketamine) users report the time slowing down, as well as cocaine users report the time to speed up. Think about autism or people that got a brain damage because of an accident: from their perspective one second can be 3 hours or 2 milliseconds. +And the same happens to all of us, every moment of our lives, with less extent. Basically our perception of time continuosly varies according to the external temperature, the food we ate, the thing we are doing: good times run faster, boring times never finish! + + + +What Stephen Hawking is defining with scientific notation as [imaginary time](https://en.wikipedia.org/wiki/Imaginary_time) is a mostly forgotten well known thing: the time unit is not the same for every particle, brain, life form. + +There is an absolute measure of time defined as a fraction of the sun rotation period, or a multiplier of a crystal oscillation timing; by dividing and multiplying something pre-existing in nature we brought micro and macro timings into our time. The human perception of time. Problems arise when the difference between the timing of two white collars is big enough to have different individual ideas of their own work. + +Lenght is the same: we can use the meter, an absolute measure, that is the platinum-iridium sample preserved in Paris and is defined as a fraction of the Earth diameter; then there are the feet, a relative measure, that vary according to the size of the feet of the people living in that place at that time. +The foot was just the most comfortable way to make our day everytime we had to measure something: how much is my land? The answer was an amount of steps. Because all of us had feet to measure it. Some chinese communities use arms and shoulders to being able to count more than 10 units. And even today, when we need to buy some wire, rope, wood, but don't have a metering tool, we rely on steps or arms (hand-to-nose distance). Problems arise when the difference between the size of two farmers' feet is big enough to have different individual ideas of their own lands. + +We could say that a meter is a foot multiplied by an imaginary number that adapt the entity foot to the real feet of the people living in that place at that time + +> m = f * i + +The same applies to "pounds" and "kilos". And Hawking, in regard of time does the same + +> tau = t * i + +Where "i" is an imaginary number that adapt an absolute reference f or t - meters and seconds - to the actual reality of "feet" and "time". In math "i" is a well formed unknown quantity defined as sqrt(-1). + +I know that sounds weird but ... it works. You don't need to believe anything, it just works. The computer you are using to read this text is built on signals theory that makes heavy use of complex numbers; and it works. Are you reading or not? It works. +If you want to go down to math level have a look at [complex numbers](https://en.wikipedia.org/wiki/Complex_number), and their current uses. +My focus instead is on building up a dynamic, evolutive, human rights framework and a distributed economic system able to support it. + +# Moneywith + +[Time is money](https://en.wikipedia.org/wiki/Time_value_of_money). And once all our imagination is defined as property, 'intellectual property', [white collars in any office become enslaved the same of any blue collar in a factory](http://punto-informatico.it/1920367/PI/Lettere/lavoro-it-non-questione-diritto.aspx), an old style laundry, McDonalds, etc. + +Many translators, journalists, researchers, software developers, and many more, are paid by the number of words they write. Ask them how they feel. +And have a look at the nasty tricks they play to make their day: bloated translations, blatantly lieing news, redundant science papers, etc. Verbosity. +And we spend energy to move that verbosity around. And we make wars to have that energy. And wars produce refugees, crime, terrorism. Produce death. + +From place to place, from time to time, many [philosofers](https://en.wikipedia.org/wiki/Jean-Jacques_Rousseau), [economists](https://en.wikipedia.org/wiki/Karl_Marx), and [rulers](https://en.wikipedia.org/wiki/Joseph_Stalin) have been addressing this issue across property, labor and capital domains. +Those addressing the same reality from the time domain perspective instead, have always been considered [mystic, spiritual, religious, ascetic, freaks](https://en.wikipedia.org/wiki/George_Gurdjieff). And criminals, considering that many of those religious practices were making use of drugs to enter special states of mind where the time is completely relative. And criminals, considering that blue collars have been fighting in the streets everytime a factory closed and they got starving in their own city: Manchester-Liverpool fights hadn't for soccer, they started because a factory moved from one city to the other one creating discrimination in the social texture. + +The modern answer to this verbosity has been an ostinate, stubborn, excess of management. In business schools some books begin saying that a company is ... chatting. Communication. And we've been accounting all this chatting using that error prone mix of property, labor, capital up to now. + +That's [The Bug](https://en.wikipedia.org/wiki/Bretton_Woods_system#The_Bretton_Woods_system_after_the_2008_crisis): tau is applied to entire nations, keeping their financial castles in place, not to individuals, dismantling their bureaucracy. + +In other words if you use Ethereum in the timed fashion most of the times we are used (and obliged) to live in, you'll end up building the sweat shops we all are running away from. Nothing changes. [It already happened](https://en.wikipedia.org/wiki/Scientific_management) every time we tried to granularly account product units, on-duty time, or both. + +How do we change then? Well ... financially. As usual. + +Let's say that "[ecu](https://en.wikipedia.org/wiki/European_Currency_Unit)" is the internal currency and "euro" is the external currency + +> ecu = euro * i + +Now think about the Ethereum's internal currency named Ether + +> ether = euro * i + +Here we go: we drafted a relation between the internal currency and the public currency. + +> Aethernum: eternal peace between temporal (time-sensitive) power and spiritual (time-insensitive) power. + +Or, to make it more practical, the end of [Eternal September](https://en.wikipedia.org/wiki/Eternal_September): there's more people on data networks than off data networks. Even the ones that use just a phone, they are on data networks. They just don't know it. + diff --git a/_posts/2015-12-25-Aethernum.md b/_posts/2015-12-25-Aethernum.md new file mode 100644 index 0000000..08e8c20 --- /dev/null +++ b/_posts/2015-12-25-Aethernum.md @@ -0,0 +1,190 @@ +--- +layout: post +title: Aethernum +author: mfp19 +--- + +Tags: [previous](#previous) [rights](#rights) [example](#example) [parliament](#parliament) [art](#art) [clues](#clues) + +We had a [problem](http://mfp19.github.io/2015/08/24/Integrity.html), we have a [solution](http://mfp19.github.io/2015/12/15/Solution.html), we marched to [enforce human rights for all](http://mfp19.github.io/2015/12/17/Constitution.html), and we [fixed finance](http://mfp19.github.io/2015/12/20/Timeless.html). + + + +Well, some sort of. Theoretical. + +# In the previous episodes... + +At this point we have + +> tau = t * i +> +> ether = euro * i + +And ahead + +> i = tau / t +> +> i = ether / euro + +So + +> tau / t = ether / euro + +Finally + +> euro = (ether * t) / tau + +And if you are producing shoes instead of imaginary products, it become + +> euro = (ether * shoe) / tau + +And if you are buying, instead of producing, it become + +> euro = (ether * shoe) * tau + +Where tau is your brain's time perception. A real scenario is a bit more complicate than that but nothing that our math guys can't crunch. Indeed, this is probably a very simple description of something that every manager does everyday to fill in his own only pockets; and as an overal picture, this is what the financial system does, since ever, in favor of different groups of people according to different kind of laws and contracts. Today, thanks to your 50 euros smartphone and ethereum, after a 'little' security review to remove factory embedded spies and rats, and a bit of training for yourself, you can do it too :) + +The importance of this theoretical excercise is to understand that we can adapt production times, production units, retail prices, wages, and everything, to the single individuals using a rational equation that granularly takes into consideration the single individual's [capabilities](https://en.wikipedia.org/wiki/Capability_approach) and [needs](https://en.wikipedia.org/wiki/Universal_Declaration_of_Human_Rights). Example: Prof. Odlyzko talking about privacy, price discrimination, and the seeds of capitalism's destruction + + + +In other words: this is a qualitative analysys only. To add numbers there's the need to hands on some more dark matter (ex: 80kg body mass in any efficient burner produces 0,2 Kw) and define tau accordingly. ACCORDINGLY. + +What I feel now is probably what [Oppenheimer](https://en.wikipedia.org/wiki/J._Robert_Oppenheimer) felt the night before the [Trinity Test](https://en.wikipedia.org/wiki/Trinity_%28nuclear_test%29). + +Let's see now how we can import [Water-Vilfredo-LQFB-Bitcoin](http://mfp19.github.io/2015/12/17/Constitution.html) into Ethereum to make a coherent universal human rights continual production factory. + +* Water. Our bodies are made out of water already: nothing to import here unless you are a jellyfish. In other words, once the bottom line, the universal framework is in place, there's no way to get out of it because of the very inner nature of the blockchain system. +* Vilfredo. Ethereum has a 'contract' feature. Every work team is created by signing a contract. And every contract 'bubbles' some results. By combining more than one working team you build up a new version of corporates, enterprises, guilds, clans, parliaments, etc. All inside the same blockchain. All nested inside the general basic contract. +* LiquidFeedback. As I said, this tool was conceived as a feedback tool for representatives. By having a universe of Vilfredos confederated within a universal framework, the representatives become obsolete, and this tool can be used as a monitoring, reporting, archiving tool; and for scientific purposes. +* Bitcoin. In Ethereum they exist under the name 'Ether'. The main difference between the two is that the Bitcoin is an universal meter, the Ether is a universal meter blockchained to a contract. + +# Aethernum: human rights. + +> "To be, or not to be? That is the question— +> +> Whether ’tis nobler in the mind to suffer +> +> The slings and arrows of outrageous fortune, +> +> Or to take arms against a sea of troubles, +> +> And, by opposing, end them? To die, to sleep— + +Since 1999 (Seattle's No Global) the common issues were not the money, the jail system, the drugs, the pedos, the good, the bad, whatsoever. Those have always been, and being addressed. Everything, every "best practice", has always been arguable; but those problems have always been addressed, targeted, loved, destroyed. Both from authorities and the people in every street. +The real common issue instead, was how to evolve our formal systems; in the case of the democratic institutions, it's about the parliament(s), the way we vote. And pay. + +But by talking about that we've been tagged [anarco-pedo-terro-satanists](https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse). As usual. The modern hate for The Internet is just the same old hate that had given [fire to books](https://en.wikipedia.org/wiki/Book_burning). +The legend says that [The Hacker Manifesto](http://www.mithral.com/~beberg/manifesto.html) have been written in jail (or right before/after). (Re)Read it now, before someone gives fire to it too: in the very worst case we must be able to rewrite it. + +> No more—and by a sleep to say we end +> +> The heartache and the thousand natural shocks + +Now look at the history of the UN Declaration of Human Rights; a not binding declaration. If you want a constitution start from there, or your own Nation one. And if you don't have/want one (ex: UK), it could be ok too: it's more dynamic. You just need to figure out how that system produce the same values expressed into the others high papers, and map them. + +In any case the UN declaration is a good starting point if you don't have a closer one; just don't start every time from the scratches you have around: that is exactly what happened before (Society of Nations) and after (United Nations) the Second World War; starting from the scratches is the best way to end up in ashes. And you&me in the ash tray. +Everytime I see one of those youth forum for peace&love, as well as one of those xenofobic movements, my legs shake and my teeth rattle... for the same reason: people starting from the scratches. I guess there are some old aged clerics, monks, scientists, all around the world, silently laughing at us. The most beautiful thing of the Dalai Lama is his smile. + +> That flesh is heir to—’tis a consummation +> +> Devoutly to be wished! To die, to sleep. + +In 2010 I tought everything was lost. But when Edward Snowden popped up in 2013, I started to dream again. He made me think to the times, 20 years before, some italians were discussing the obfuscation of the last three digits of every telephone number, on our detailed (paper) phone bills. +And much more: go digging in the italian Privacy Authority archive and you'll find my name on papers where I brought to court Telecom Italia and Alitalia for using my email address to send unsolicited commercial emails. I'm a privacy legionary. And Ed is my hero. + + + +Edward Snowden produced a wonderful new wave of public discussion about privacy: 20 years before husbands and wives were worried about (not) being able to spy the telephone calls of their partners; today anybody (made a porn videochat) was worried about their dick-pics in the NSA datacenter ... same Idiocracy + + + +But he triggered also some important changes in the formal systems. In US the Freedom Act reduced the application spectrum of the Patriot Act. In Italy something similar happened by limiting the amount of crimes that can trigger stealth wiretapping and access to the personal data backlog. And in many other countries [something similar happened](https://en.wikipedia.org/wiki/Edward_Snowden#Reaction) + + + +> To sleep, perchance to dream—ay, there’s the rub, +> +> For in that sleep of death what dreams may come +> +> When we have shuffled off this mortal coil, +> +> Must give us pause. There’s the respect +> +> That makes calamity of so long life. + +William Shakespeare, Hamlet. + +Yesterday we, the Telephone Guys, were worried about the fact that the telephone network (circuit switching) is a nation wide machine that knows at any time how one telephone can reach any other telephone. It is its core business. + +Today we, the IT Guys, are worried about the fact that the data network (packet switching) is a world wide machine that knows at any time how one device can reach any other device. It is its core business. + +To stalk one and every networked device is the [core business](https://en.wikipedia.org/wiki/Routing) of any proactive network. To remove this you must use pure reactive networks. By using pure reactive networks, delays, convergence times, and many other network parameters increase to the point that ... many people could die for not having emergency teams in time. And it could take 5 minutes from inserting the telephone number to hearing the pizza guy on the other side. And for this reasons there's the need of [hybrids](https://en.wikipedia.org/wiki/List_of_ad_hoc_routing_protocols). + +Yesterday, to have our meta-data (who called who) in our telephone bills was just an extension to the pool of people that can access our meta-data: not only the telco company and the cops, but the postmen too. And because the telephone network was a government controlled facility, that pool of people didn't grow much: by partially anonymising the callee-called numbers they protected our privacy from the fraudolent postmen. + + + +Today things got way more complicate. But ... again ... by placing a "Not Sure Squad" at work, we have been able to crack the problem easy + + + +and start a rebuilding process that already lead to some good results. Some temporary patches. + +# Aethernum: an example. + +A continent: Europe. De facto, geographically, Europe is very united; its politics just bullshit. All the planet is 'de facto very united' (and its politics just bullshit). Waters, deserts, mountains are 'naturally expensive to cross' as well. This is the reality that, willingly or not, shaped us all since ever. Start and restart always from there. All the rest is wishfull thinking. Unless we figure out how to make a teleport system, Newton and gravity keep kicking our ass. Plus, there's political bullshit coming from the past: Vatican City, San Marino, Monaco, Gibraltar, Ceuta, Melilla ... + +A parliament: have you ever spent 5 minutes whatching a session of the British Parliament? Other parliaments look like an amphitheatre; semi-circular. The British parliament instead have two rows, opposing each other. The ones on one side send their champion in the middle, he talks with the back row chorus, facing the opponents ... on the other side, the same, alternating. In a very, very, disciplined way: practical. The greek-latin parliaments are 'proportional', the British one is 'bipolar'. The proportional ones work in Federations and Republics, the bipolar one works for Kingdoms. +StarWars parliament instead, works for everyone: it is a sphere. We don't have electromagnetic levitation pods but ... Japanese could have a solution. In the while we can use what we have: cyberspace. + +A constitution: one of the 2-3 important things I added to My Constitution was an automagical rule to increase/reduce the number of rules according to an index (ex: crimes). Try to apply that to the UN Declaration of the HR, and make it binding. I mean, drop any desire, wish, want, etc; start from 'need' only, meter it, and then go to the next rule, example: + +* Need: artt. 3, 25 (combined): "Everyone has the right to life [...] including food". +* Meter: 50 liters of water, 2500 kcal per day. + +Basically, by bind to such metered rule you've just built a bottom line where 'ether multiplied by t' or 'ether multiplied by shoe' results always in 'the right to survive' where 'survive' is defined as '50 liters of water, 2500 kcal, daily', mandatory minimum. + +# Aethernum: previous art. + +In the previous chapter I made an example starting from water and food because of [Maslow's hierarchy of needs](https://en.wikipedia.org/wiki/Maslow's_hierarchy_of_needs). But in 2008 I started from + +> "Art. 1 - My Country is a democracy built on top of collaboration between anybody honour this text." + +replacing the first article of the [Italian Constitution](http://www.senato.it/documenti/repository/istituzione/costituzione_inglese.pdf) + +> "Art. 1 - Italy is a democratic Republic founded on labour." + +The practical reason for adding an imaginary rule (ie: collaboration) on top of more empirical ones (ie: food) is that by keeping adding rules the late comers (ie: the new born) could find very little liberty in their lives, exspecially during downturns, and very little good teachers to explain them what they got at birth. + +> You bet your ass we're all alike... we've been spoon-fed baby food at school when we hungered for steak... the bits of meat that you did let slip through were pre-chewed and tasteless. We've been dominated by sadists, or ignored by the apathetic. The few that had something to teach found us willing pupils, but those few are like drops of water in the desert. + +And because any society can't apply 'tit for that' ('an eye for an eye...') as is. Human societies degenerate already as a result of millions of daily mistakes; it's just NORMAL. By creating punishments and penalties in a symmetric fashion, this degeneration runs faster. For this reason I consider the collaboration - not 'labour' - to be the highest duty for every human. +By elevating 'labour' to the highest law instead, we have the need of a ladder, a gerarchy, etc, for any human activity; military procedures are continuosly imported into the civil society making it more expensive each time, creating incremental complexity and continual need of more expensive judicial systems in order to be able to address more complex symmetric wars. And having an authority that interrupts escalations become compulsory. + +> We make use of a service already existing without paying for what could be dirt-cheap if it wasn't run by profiteering gluttons, and you call us criminals. We explore... and you call us criminals. We seek after knowledge... and you call us criminals. We exist without skin color, without nationality, without religious bias... and you call us criminals. You build atomic bombs, you wage wars, you murder, cheat, and lie to us and try to make us believe it's for our own good, yet we're the criminals. + +To balance this high duty of collaboration that our kids have birth in, I introduced later in My Constitution a 'compulsory change declaration' to be done within the first 50 years of age, in order to be able to be considered an adult: being able to have a VAT number to open a company, being able to speak in public, being able to be a representative, being able to have a gun license for civil reasons, being able to have kids and educate them ... , without the need to be a military. +[To produce and declare a solemn amendment to the current system you were born into](http://www.anythingtosay.com/) can be an alternative way to grant citizenship to people that can't/won't fight. Like me. In Italy the 'civil service' (alternative to compulsory military service) has been adopted in the mid '90ies. Some countries (ex: CH, IL) can't make it because of their demographic size and other reasons; but this general rule can be use concurrently to the military service as well. + +Millions of amendments dumped in a blockchain every year are a powerful evolutionary common system in the executive branch. The same that already happens in the judicial branch of the [common law systems](https://en.wikipedia.org/wiki/Common_law). + +By elevating this high duty/right at constitutional level, anybody - Assange, Manning and Snowden included - would have one holy chance to make his own rebellion functional to build up a better world, at least once in life, without infringing any lower law, without the need of public expenditure for a judicial process, without the chance of censorship, and probably without risking their lives. + +Thousands of instances dropped in the public blockchain daily, that make the traditional representatives and the executives + + + +simply obsolete. + +> Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for. + +# Clues + +By me writing this text in Git (ie: a proto-blockchain), and you reading from it, you've just used a lightweight version of Ethereum to init a general contract that could serve as overall framework to any other future activity. +[As far as I can understand Git itself lack of author and time signatures in its blocks](http://mfp19.github.io/2015/08/24/Integrity.html); this means that GitHub's [operators can manipulate authorship and publishing dates at will](https://en.wikipedia.org/wiki/ConnectU#Mark_Zuckerberg). But for my purpose (ie: sharing the description of something that is not mine) is fair enough. + +> I am a hacker, and this is my manifesto. You may stop this individual, but you can't stop us all... after all, we're all alike. + +[The Mentor](https://en.wikipedia.org/wiki/Bastard_Operator_From_Hell) + diff --git a/_posts/2015-12-26-Profile.md b/_posts/2015-12-26-Profile.md new file mode 100644 index 0000000..53b16bf --- /dev/null +++ b/_posts/2015-12-26-Profile.md @@ -0,0 +1,413 @@ +--- +layout: post +title: Profile +author: mfp19 +--- + +Tags: [justdoit](#justdoit) [mrbin](#mrbin) [env](#env) [timeline](#timeline) [2010](#2010) [2011](#2011) [2012](#2012) [2015](#2015) [crime](#crime) [today](#today) [analprobe](#analprobe) [behavioural](#behavioural) + +We had a [problem](http://mfp19.github.io/2015/08/24/Integrity.html), we have a [solution](http://mfp19.github.io/2015/12/15/Solution.html), we marched to [enforce human rights for all](http://mfp19.github.io/2015/12/17/Constitution.html), we [fixed finance](http://mfp19.github.io/2015/12/20/Timeless.html), and we imagined (again) [how the world could be](http://mfp19.github.io/2015/12/25/Aethernum.html) + + + +Lovely. Now let's try figure out why is not, yet. We, IT Guys, togheter with a bunch of fools. As usual. + +### Just do it + +I hate (many things but also) this sentence + + + +Because we, IT Guys, are already doing IT. You can see a runner falling, you can see a fighter winning, you can see Shia LaBeouf screaming ... but you can't see us doing it. Anything. + +Well, you can see someone's fingers flying over a keyboard that doesn't even produce music; with today's touch technology, not even ear mechanical clicks any more; but many can't distinguish a bank's frontdesk officer entrying data, from Q managing the GCHQ supercomputer + +> James Bond: You must be joking. +> +> Q: Why, because I'm not wearing a lab coat? +> +> James Bond: Because you still have spots. +> +> Q: My complexion is hardly relevant. +> +> James Bond: Your competence is. +> +> Q: Age is no guarantee of efficiency. +> +> James Bond: And youth is no guarantee of innovation. +> +> Q: I'll hazard I can do more damage on my laptop sitting in my pyjamas before my first cup of Earl Grey than you can do in a year in the field. +> +> James Bond: Oh, so why do you need me? +> +> Q: Every now and then, a trigger has to be pulled. +> +> James Bond: Or not pulled. It's hard to know which in your pyjamas. Q. [offers his hand.] +> +> Q: [shakes his hand.] 007. +> +> (Daniel Craig and Ben Whishaw in [Skyfall](https://en.wikipedia.org/wiki/Skyfall)) + +Nor distinguish a washing machine from a computer. It's an [old problem](http://www.catb.org/jargon/html/tv-typewriters.html) that we tried to address in time, in many different ways with varying results, some historical examples + +* [Space Invaders](https://en.wikipedia.org/wiki/Space_Invaders) +* [Blinkenlights](http://blinkenlights.net/blinkenlights) +* [Intelexit](https://theintercept.com/2015/10/05/drone-flies-over-nsa-complex-in-germany-dropping-pamphlets/) + +We can't do much against commercial powers like Casio ("digital clock"), Paramount ("tricorder") and Apple ("iPhone"). Nobody ever liked the word "computer". Except us. Even people that has been using computer since ever, [made the Silicon Valley's marketing department](https://en.wikipedia.org/wiki/Neil_Rackham), and are amused and positive about computers (but not enough for investing on us), don't understand what the hell we do: that's me with one of the Silicon Valley marketing gurus + + + +And we can't do anything against the militaries! They tend to be deadly: the most impressive historical result of mixing Consultative selling and Motivational buying. Those poor guys are our brothers separated at birth. [They are Schwarzenegger, we are De Vito](https://en.wikipedia.org/wiki/Twins_%281988_film%29). + +# Mr Bin, Mario Binary. + +> "First they ignore you, then they ridicule you, then they fight you, and then you win." +> ( Mahatma Gandhi ) + +Given that there's no "hacker university" nor professor, I got the Hacker Bachelor Degree in 2008 by hackers clapping at MOKA2008, for "Sapere Aude 1784 - Episode 0" video (about CCC2007). A small summer camp for IT Guys. The rest of the world was ignoring us and giving for granted their shiny Macbook-powered iInternet. Until they realised that it was failing. + +The Master in 2009 by medics, lawyers and psycologists laughing. + +The cops searching my house and seizing my equipment in april 2010, for me, have been my PhD: the only and most efficient way to both access the judicial system and by doing so, (contribute to) changing a bunch of laws at once; maybe even to trigger what is called 'constitutional exception' in the italian jurisdiction and is capable to invalidate the whole single act (and more than one). The highest of the civil challenges. For free. Theoretically. + + + +In practice they did anything they could, up to 2014 in the Italian Embassy in Bangkok, to not process my case. Today Italian Police advice adults, teenagers, and parents ... to stay anonymous. I and I, win. + +## Mr Bin's Environment. + +> "Pecunia non olet". +> +> ( Vespasiano, the emperor that invented public toilettes in order to tax the piss buyers, speaking to his son complaining of the piss smell ) + +I feel the United Nations in all its departments (WIPO, FAO, IMF, WB, etc) as a very far, overlapping, unconsistent, expensive thing that ... fails. Something that is not mine. Probably the only foundamental branch of it is the Security Council; and it has been considered malformed for many years. Moreover I haven't seen blue helmets - Interposition, god bless you guys - on the news since 1997 (Jugoslavia). + +Similarly the European Union. And the Italian Banana Republic is not much different: when I saw [Laura Boldrini](https://en.wikipedia.org/wiki/Laura_Boldrini) - ex: UNHCR's spokesperson... SPOKESPERSON... ANOTHER MARKETING SUCKER - appointed President of the Chamber of Deputies of Italy in 2013, I've felt the world crumbling. Again. + +> "We believe the most comprehensive and dry definition of Mafia is: a ruthless association working for its associates' profit, that forces parassitic intermediation trough violence, in between property and work, production and customers, citizen and state" (attributed to [Leonardo Sciascia](https://en.wikipedia.org/wiki/Leonardo_Sciascia) from [Mafipedia](https://it.wikipedia.org/wiki/Mafia#cite_note-15); it looks like from "[La storia della mafia](https://it.wikipedia.org/wiki/La_storia_della_mafia)", Milano Barion, 2013, ISBN 978-88-6759-001-8; and [Eric Hobsbawm](https://en.wikipedia.org/wiki/Eric_Hobsbawm) might have said something similar before) + +More intermediaries, storytellers, between facts/data and me. I tolerate journalists because someone have to turn facts in words, pictures, videos, numbers; and I have them in high regard. And I must tolerate translators because life's too short to learn all the languages. But political propaganda (tax payers funded, unwillingly) is too much. I consider marketing people being sick, psychos. This is me learning marketing from the book "Jesus cleans better" (than Dixan) + + + +An entire full fledged system (parliament, law enforcement, judicial system, military; words, guns, courts, tanks&airplanes) acting in front of cameras, in order to artificially represent facts is ... an entire world burning petrol to produce hectoliters of sacred sperm daily wasted in the toilette pipes, only. +Don't get me wrong, to waste sperm in the toilette pipes is good; better than overpopulating the planet! But many years ago I was expecting, by 2015, to have a system that anonymously aggregates the data in my surrondings (me included) and freely redistribute those data in an electronic format, so that all the local geniouses of the world could study all the other's anonymous data (status), in order for each of them to take decisions for each me and each of the other ignorants I live with. One proxy every small group of ignorants like me. [More than one local proxy](http://liquidfeedback.org/): around me I have IT Guys, cooks, medics, farmers, managers, fishermen, cops, sport trainers, plumbers/gynecologists, ecc; and each of them have a set of competencies that enable them to take better decisions on single issues. Better than me. They do it daily already for themselves. So I could nominate my local proxies and they take decisions on their side, for me too, and the rest of the local community. [Simple, linear, control](https://en.wikipedia.org/wiki/PID_controller). + +[Instead I have this multilayered expensive superstate over my head](http://www.telegraph.co.uk/finance/economics/12116429/Crippled-EU-is-no-longer-the-anarcho-imperial-monster-we-once-feared.html), pushing actors on the institutional seats in order to tell me, the convinient version of what the profeetering gluttons are doing. Pushed as a sanitised version: "it's good for you". And moreover in video: the most expensive media to produce and manage, and not directly in numbers so that anyone can interpret on his own. [Recalling the proxies in the case they don't fit](). Prechewed meat. No, it's not good for me: intermediaries between properties and work, between the people and status. It's mafia. Intermediaries are mafia. + +Guinness is good for me instead; but that has always been; it exist way before the current men and women setting up this bloated and redundant framework. My current perception may be because of the resulting nested administrations I'm in (EU-Italy-Lazio-Roma-Town-Family), a local/personal problem; and don't get me wrong, I'm alive and running: in Asia. It's already a success: somewhat. But I feel they did nothing good for me; the technostructure should eliminate itself and it is still there instead. Some functions (ex: military grade protection of "message integrity", as well as other violent activities) must be in common; but I can't understand why all the rest is in place. +I'll never forget the EU forum "The Future of The Internet"; just an example of wasteful crowdsourcing activities giving for granted all that chain of intermediaries in between. + +Anyway, I'm happy that finally, after all the major disasters mankind have been facing in the last 15 years, [UN](http://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/68/167), the [EU Parliament](http://www.europarl.europa.eu/news/en/news-room/20151022IPR98818/Mass-surveillance-EU-citizens'-rights-still-in-danger-says-Parliament), the [EU Court of Justice](http://curia.europa.eu/jcms/upload/docs/application/pdf/2015-10/cp150117en.pdf), have found a few minutes for privacy. Rights have always been recognised at large, only after a fail have been so big that was impossible to not recognise it. And law, in general, can't preceed reality without being an hammer instead of a shield. The more it prevents, the more it is a scam; the more preceed facts, the more is not righterous. + +In Italy, despite the EU claims of "world human rights defenders" [the law was not working](http://mfp19.github.io/2015/12/17/Constitution.html). Unless we invent the time machine; then the cause-effect principle can be inverted. + +The financial system also can invert many things; and it actually does it, everyday, in every household of the globe. In the italian legal system any not criminal offence (and the civil part of a criminal one) can be financially inverted. But ... [that's another story](http://mfp19.github.io/2015/12/20/Timeless.html). + +## Mr Bin's Timeline. + +(TODO: pack judicial relevant elements in the executive short version, move the funny storytelling in the subchapters.) + +* 1978: I was born and everything was fine: it was a sunny day, two catholic Popes died, and everything went smooth until the first girl want for me to use my dick the very first time. She wanted to fuck me. And she was fine; and plenty others after her. The first one that I couldn't manage was a judge in a civil court, that probably didn't even think about fucking me; and me, even less: I don't like coke cans. But she did, and she couldn't; theoretically. The verb "to fuck" is pretty astonishing. +* 2006: I've been judged in a civil trial that I was not an actor in; a stakeholder only. Denied of law mandated hearings. Excluded from the trial. Deprived of my civil rights. Italian language example: [rationale](http://mfp19.github.io/resources/figli_ratio.txt), [economics](http://mfp19.github.io/resources/figli_mantenimento.pdf), [crime](http://mfp19.github.io/resources/figli_reato.txt), [sentence](http://mfp19.github.io/resources/figli_reato_sentenza.pdf). Note: I can't confirm the sentences quoted in the text but back in 2006 the same picture was clear and those sentences confirming the overal legal framework disappeared from the Internet for a few years; you can see this "sententias desaparecidas" phenomenon about Italy at Simone Aliprandi's blog, and about US in Aaron Swartz's movie. I checked the existance of a few of those sentences in today's [high court](http://www.cortedicassazione.it/corte-di-cassazione/it/sentenzeweb.page) [archive](http://www.italgiure.giustizia.it/sncass/). +* 2007: 20th of February, my last message signed with my full name and surname: retaliation against the ban of anonymity. +* 2008: Resigned from the Italian Constitution and introduced the draft of My Constitution, [Requesting For Comments](http://www.ietf.org/rfc.html). +* 2009: Whistleblower: not against someone, but against the public procedures allowing for 'environmental corruption' (of public tenders, tests, etc). + 1. 20090100 - concurrently to [Beppe Grillo's public call to stalk the politicians](http://www.beppegrillo.it/en/2009/05/grillo168_the_pittima_of_parli.html) a new stalking law is passed overlapping the pre-existing 'persecutory acts' in the criminal code; it is one of the [new fancy crimes](https://it.wikipedia.org/wiki/Gabriella_Carlucci) defined without an empirical evidence needed in order to find someone guilty of something. Instead of binding the crime to the actor's actions (italian constitution, art. 25: "no one can be jailed without ... committed facts"), it is bound to the victim's feeling... [any feeling](https://en.wikipedia.org/wiki/Ah,_L'Amour). And my ex girlfriend; the one that 1 year later signed the police report, explained why this law was an abuse; a constitutional level, multilevel, abuse. A few years later we've seen the huge waste of public resources, without any prevention of real crimes, and we still don't know how many innocents have been set to jail, sanitarised with psycho drugs, beaten up, exiled, or whatever happened as a result of the alleged prevention (ie: the criminal use of the criminal code to shape behaviour). + 2. 20090501 - lunch at my gf's home togheter with some of her family friends (left wing activists), who pushed my gf in some kind of Facebook's left wing propaganda to re-educate the masses to the italian constitution (left wing party leader Veltroni's campaign). Unacceptable: I'm a privacy hactivist, Facebook and The Cloud as a whole are off-limits; and the position I see for those politicians is a tent in a military camp inside Rome's Olympic Stadium, waiting for their fair trial. + 3. 20090600 - my gf's professor advice my gf to not show herself at university to disguise curious eyes and gives her a few leaflets (one of those, a few months later, have been the title of the exam he pushed in). + 4. 20090810 - dinner at my gf's home togheter with family friends. + 5. 20090811 - big 'love discussion' (audio recording [here](https://www.youtube.com/watch?v=MTMKeEfEwL4), [2](https://www.youtube.com/watch?v=8evbCaIP-LI), [3](https://www.youtube.com/watch?v=viuUE607VJw)). Please note: + * the audio is on date (20090811), the video has been made the same day of publication (youtube date). + * the whole videos are picturing [an idiot](http://knowyourmeme.com/memes/the-llama-song) - me - instead of a bitch, on purpose (ie: it is the opposite of 'revenge porn'). + * the hood is made of original southamerican [Llama](https://en.wikipedia.org/wiki/Llama) whool, and it is the only good stuff left there at that point in time. + 6. 20090812 - I engage a discussion on mantellini.it about the on-going inter-generational corruption of young university law students and the cost of the completely (fake) public procedures in place in order to access public jobs (that I've been observing in the past 2 years), describing the corruption of university public exams naming one case study complete of names and dates. In the past years my gf togheter a Guardia Di Finanza (Financial Guard) officer, appealed the university internal procedures first, and the Tribunale Amministrativo Regionale (administrative court) after, in vain, in order to debunk the corruption of those public procedures. The truth is that existing appeal procedures, in 60+ years of Italian Republic, never succeeded: all those exams have always been fake, pushing in an horde of underachieving law practitioners (some of those could be one of the Constitutional Court members today), and have never been debunked. Across two generations. Hundred of thousands of exams to access jobs in the universities, no appeal won. Exactly the same pattern occurs in any corruption case involving one of the 9100+ italian judges. And there are very few cases of lawyers as well, banned from their professional guild on the grounds of their ethical code of conduct. + 7. 20090827 - I go to a computer summer camp and talk to her by phone a few times ... once she said "Why you come over again then?" in a way... she was thinking to my behaviour! Not her one! Entangled in the psychoshit since she wrote her bachelor's thesis in 2007 (about the artificial insemination law) and got lost into vogliounbimbo.it forum ("IWantAKid" girls that couldn't pay themselve artificial insemination in Barcellona or Switzerland, to workaround the italian law that prohibited that procedure in Italy). She didn't want to miss a thing: her career. And her parents started to bother too: "what you do in life? What's your job? Bla bla bla". I didn't want to miss a thing: my research. So I turned my head down (another time) and played the good boyfriend (another time): back togheter again! + 8. 20090900 - my gf goes back to see her professor for the very first time; he doesn't trust her (ask to leave the bag in a room, then if she has her mobile with her, then change room, ie: fear of recordings); and she doesn't understand why. I do, but can't tell her; and I was driving (her back home): not the right moment to disclose&discuss. The reason is that the website mantellini.it is owned by a left wing medic - medics tend to beleive psychostories even tough in Italy psychologists are not medics; psychiatrists are instead - and the left wing politicians are EVERYWHERE, even in the [Spaghetti NSA](https://en.wikipedia.org/wiki/COPASIR) (2008-2010: [Francesco Rutelli](https://en.wikipedia.org/wiki/Francesco_Rutelli), then party-wise continuity with [Massimo D'Alema](https://en.wikipedia.org/wiki/Massimo_D'Alema)). Someone might have warned the professor; or he just does it. + 8. 20091220 - my gf does the lawyer's public exam to be enabled in courts; I don't have confirm of her public job at university. Yet. + 9. 20091231 - new year eve party; I start a passionate discussion with some friends ... basically throwing a ton of shit on whatever her party (whatever her party is) have been doing in the past years ... I didn't realise she was sitting on the sofa watching in silence, some sort of disgusted ... she quit me, and leave the party. I don't know exactly what made her angry: for her to come to pick me up, for me to be in late, for me to discuss with her best friend about a judicial case that was on the headlines a few years before, or for me to happily roll The Last Joint Of The Year: the girlfriend-invariant 12th edition of an important ceremony that used to begin at 23:59 of every 31st of December, and ending up as quick as possible. That usually lead to me walking on my elbows and her driving the car. I think the legal case was more interesting: a law professor working at Cassino's university had to run away from that city because there was the risk that the father of one of his female students could shoot him. The reason was that the student and the professor had some good sex at uni but he didn't let her pass the exam. And he did it lawyer style: he brought his sofa, and his carpet from home to his private room at uni (public uni), so that he couldn't be sued for using public money for private activities. By not making the girl pass the exam, he couldn't be nailed for corruption either: no goods/services exchange. Basically even in the case of a good result, he couldn't make her pass to avoid future bribery charges. And if he liked the current status, he would never allow her to change it. Another aberrant case in between 'passion crimes' and 'administrative crimes'; a whole class of cases where the only possible solution is to abolish any passion crime using those as investigative tracks only, and introduce procedures to escape that shithole (ex: the chance to have the test in another university without notice to your university). My girlfriend's best friend was arguing that the professor was a monster, I was arguing that he was an hero: I just don't understand why someone can think that 'sex with the professor' is the same of 'study'. It can't replace it. Probably banging the girl's head against the law books library, pushing from behind, using the right timing, can make something to her head but ... the most probable result is breaking her head, not give her a legal education. At the end, you must open those books anyway. Sex is value added! Not a replacement. I would like to get to the point whether it is illegal or not to have sex with students even if they are 25 years old spolied brats and you are an ageing perv seeking for fresh meat; but I couldn't; my girlfriend's best friend couldn't get the 'not replacement' point. If she would have had a gun, she would had shoot me; pretty like the father of the 25 years old spolied brat in the case described above. They don't get that it is reason why italian graduates are world wide underestimated; as clearly stated, plenty times, from human resources managers I had to cope in my life. And we didn't make any point; because it is a real tragedy and it is impossible to policy: can't be illegal, but usually internal policies forbid it, that brings to the point where internal policies override public laws in one or more individual/common rights. It's a well known pattern in a micro env; very similar to the federations problems of federal/ local balance of competencies, at nation-wide scale. Next life I want a uniform: "Sex Marshall" (be paid for watching private porn all the day long and report to court what I've seen!). Anyway: my girlfriend left (for ever!). +* 2010: Alleged criminal by the whistleblowed (two lawyers). Irregular judicial procedures. + 1. 20100122 - I call her because we had a plane booked for a cheap holiday the day after. I realise that she is not 'just pissed', but 'completely pissed: over'. So I need to recover 'our' pictures I didn't have, try to save my 3 years work on the italian society at internet time (ie: begging her to keep doing her law part at least), and still need confirm the corruption case for my research (scientific method requires empirical evidence). But I had the copy of the leaflet her teacher gave to her before the public exam, with her hand-written notes all around: just in the case they decide to sue me - that is what lawyers do when you sue them: you win your trial, or you loose a defamation parallel proceeding; win your soul or loose everything - I fuck them anyway. Hardcore debunking begins, Al Pacino advices to gain your victory "[inch by inch](https://www.youtube.com/watch?v=myyWXKeBsNk)"; in this case the problem was not piercing 2.20m tall bulls line, or running around it, because I'm so small that I can slide under their legs in the time their neck rotate the head down enough to notice me, but the new unconstitutional behaevioural laws preemptively stopping the coatch to do his job: [Ocean's Twelve LASER DANCE](https://www.youtube.com/watch?v=1_vfXQ71n0E) made "inch by inch", becomes [Tenacious D](https://www.youtube.com/watch?v=XNvard1RFN0)! So I opened a Facebook account to make the game more interesting - not in my name! I was "Macchina Frulla Parole" (my name-surname initials saying "I'm blending, mixing and liquidizing words only") - and I had already piped years before my DNS resolver into as many hubs I could find to raise the entropy, playing wildly with all the snoopers-spoofers-psychos had the guts to play shit in my world: "play on my home ground, the baud and the electron, psycho law assholes". I've been in front of a computer all my life since I was 5 years old: probably I'm not [George Best](https://en.wikipedia.org/wiki/George_Best) but, because of my age, I was a fair [Franco Baresi](https://en.wikipedia.org/wiki/Franco_Baresi). Naturally trained to be resistant. In the following days I called her a couple of times; once we talked in front of her house. No way to get anything: no pictures, no law studies and jargon, no way to see her working at uni to exclude the other option (politician ghostwriter). + 2. 20100213 - I went after her, and I could catch her in a make up session for someone's Facebook's profile: photographic umbrella-lamps in a pub, happy people showing off all around. Awesome marketing chicks; some friends I've been going out in the past 15 years: the uncle of one of them (left wing councellor at another town's council) was in my home a few days before; they were the full Pink Panthers team (of left wing local political activits and attention whores) making their Face-Book using Frascati's mayor's son camera, and another friend (nickname 'Negro' because he is a bit darker than us) making up the pictures. And her, almost crying: "I have saturday only to do this!"; so my attention went from the flashlights to "this" - this what? - that paired with the Italian Constitution rehab spotted 9 months before at her 1st of may lunch; and in line with the medias storytelling. I gave up to let her doing her stuff and she agreed to go out for dinner the day after. + 3. 20100214 - another make up. And of course partly reported on judiciary papers. Do I need to say that we didn't go to dinner? I left her house because her aunty came out and asked to leave. There must have been a bunch of stalkers after me, following the stalking law in courts because they were just making up and making up again collecting anything they could to match the (unconstitutional) stalking law. A law that I ignored on purpose. I was just trying to make them understand that pointing their browser to someone's profile, or reading emails/sms, is their own problem, not the writer's one. And to be a maniac for someone is exactly the core reason why the common law systems emerged the stalking behaviours, and the civil law systems defined the persecutory acts. And fair enough to enforce anonymity on the Internet. So, actually, the one stalked, and mobbed, is me; not her. When I have nothing to do I open a web site and watch some porn - any kind of, it can be two luxurius boobs, a 1 Tbyte equipped server or a sitcom - don't read someonelse's profile. +And the first sentences coming out in 2009 stated the need of a 3-months minimum period of stalking in order to be able to find someone guilty. + 4. 20100222 - On 21th I tried again: without those pictures on her computer (only!!!) I had memory holes I couldn't fill in. I could take them by myself: her laptop was registered on my dynamic DNS service, that OSX version was a colinder (ex: 2 bugs on Samba could do the trick), their wifi SSID could be catched on a LOS mountain nearby, and plenty more entry points. But I hate going techy: that's my job and ... I feel it. Violating someonelse's privacy is not against someone, it is against my job; I simply can't. Not throuh a computer. I telephoned, begged for her to bring an arbiter, or more, better someone that we both trust, so that she would feel more comfortable; so she agreed to meet in a public place (an italian bar: coffe and cakes; on the main square; mid day); and there I figured out that she was not there to give me our pictures or whatever peaceful private solution, but to do something else: judicially turning my private solution practice into a blackmail attempt, as she explained to me in the previous years. I didn't know why, but she was recording our conversation; her problem has been that the conversation went bad when her friend - a nice girl, not a lawyer - agreed with me... and she couldn't reply openly because she was recording! So she told me that her friend was an arbiter, and instead was a witness... a disagreeing witness producing contrary evidence. Please, don't fall on the floor laughing; it is all true. [And sad:](https://www.youtube.com/watch?v=R1ek1jwX4qo) the more I was granting her the benefit of the doubt, the more she was going nasty! + 5. 20100300 - Something weird was repeating: every time I was going out for a beer somewhere, she kept popping out in the same place I was. And the same on Facebook: I had someone pushing posts that in theory shouldn't be there (because I didn't subscribe to those people's profiles) and alike. We had been living in the same monkeysphere for more than 6 years; all our daily-friends were in common. Someone was calling her, or someone was monitoring my comms (ie: tracking the position of my mobile; news articles of the time reported for the real time phones' position nation-wide database to be sold to a US company, some weird mass monitoring to be going on somewhere in middle east, cell phones encryption was already administratively turned off, and cell phones private wiretapping tools could be bought at 10k USD and delivered in Dubai) or both. In any case it was not a coincidence. It was consciusness raising. I could feel the people gently gathering around me to not let me be alone. + 6. 20100403 - precise as a Swiss clock, 3 months after she quit, she signs a report at the police station. + 7. 20100412 - cops search&seize my home. Reading the prosecutor's paper made me realise what she was doing, finally. She had been making up a stalking case. Easy, standard lawyer/prosecutor behaviour: if they can't fuck you by facts - because it would debunk their own shit - they search for another criminal profile to dress you with, and because they have plenty 100% not-empirical criminal profiles (ie: 100% behaevioural) turned into law, they can cherry-pick what kind of delightful monster you are, according to amount of clicks and whatever they imagine, because they don't know what [curl](https://curl.haxx.se/) is; they probably know [Rip Curl](http://www.ripcurl.com/) only. The most popular international examples are current rapes stories (one per psyco-target: Assange, Strauss-Khan, ecc); but there are plenty more in every society, ex: in Italy a few years before there have been a big explosion in the Liguria region ThyssenKrupp's factory, 5 blue collars died, the families sued the factory for poor working safety standards, the management sued the families back the day after blaming the deads for not following the safety rules. A quick search and there the bug is: no empirical evidence (ex art. 25 italian constitution; without a "committed fact" they can't prosecute, so they must hook&wind to create a "committed fact"); more shit over my head (and even more in my pants), but ... just rise the DEFCON level again and [keep listening at Lieutenant Colonel Kilgore](https://www.youtube.com/watch?v=Jts9suWIDlU)! Bombs falling... dig holes... stay low... + 8. 20100600 - the Facebook game works: by telling the story on Facebook they realise to have made a terrible mistake. The preventive measures against eventual revenge porn (instead of arresting her for abusing of the public trust) would have led to reimbursement. The local police station (of her town) send an "invite to report at the police station". The "invite to report" is delivered to my home by one of the local (my town) cops: two days after the day I was supposed to report. The invite ends with "if you don't show off you infringe art. 650 of the criminal code: resistance to a public authority order" (6 months in jail). I don't know you, but when I invite someone I don't threat him in the case he doesn't show off: that's one of the problems of giving a gun to ignorant cops. I ask to the kind cop to call his counterpart (from my home) and set a new date; when he call the cop on the other side start screaming. I don't know what he was saying; I heard the voice coming out loud from the phone, and the only thing that I've seen was the cop in my place to repeat "yes sir" scared. Those (Carabinieri) are not civil police; are military police with civil functions; you can imagine by yourself what happen when an higher in command is angry with a lower rank one. Then I telephoned to my lawyer to understand what to do and he confirmed my doubts: the prosecutor autorithy is the magistrate, not the cops. In theory this compartimentation (ie: magistrate orders, cops do) prevent for them to manipulate evidences and other nasty tricks. Because of the "nemo tenetur se detegere" principle, they can't order anything to the investigated one. Basically that was a trap that the postman (the other cop) unwillingly debunked: wheter I would walk or not in there I could be arrested any time and set to jail straight away. Once in there, I could be killed and any formal check at later stage would confirm the formal procedures. In practice poor innocent people without formal education, just obey and get killed inside the police station or nearby. And they are even too stupid to attempt to deny their actions again, again, and again; even 5 years later: I just checked today (20160313) my paperworks and the "invite to report" I had here in Thailand, is missing. One year ago was still there, in my keylocked closet, inside my house. Anyway, that's not important for two reasons: first, it doesn't prove anything by itself because the cop in my place used the pen to change the date without applying a signature, a stamp, or whatever else could prove the change was not made by me. There was no need to make disappear that piece of paper. Second: now I know that they keep having the same illegittimate will to judge me. In other words, that they have already pre-judged me, ie: the same of before they arrived in my home to search&seize my stuff. Confirming my fear to go back to my place. And I knew it already: I've been here in Thailand surrounded by militaries from all over the world, for 4 years. Three days ago (20160310) I had a dinner with a Carabiniere (military police) here in holiday with his wife, in the resort where the italian government is sending his sons&daughters. They usually are nice guys; the nasty one instead, was the policeman (civil police) that was here the 1st of january 2016 and didn't reveal his identity (note: it is not mandatory by law for them outside the italian republic, but it should be a courtesy with us italians when we ask things like "what you do for living?"; I'll file a complaint from the jail as soon as I go back to Italy!) ... I got him from a few details that characterises our generation but I don't like to debunk them all. Let the idiots play. The idiot in this case is [Angelino Alfano](https://en.wikipedia.org/wiki/Angelino_Alfano), the current ministry of internal affairs; the police (and passports) are managed by that office. The Carabinieri (military police) instead are part of the army and managed by the defence ministry. It's a political game: Angelino Alfano is part of the Catholic Bullshit, the same party (once called "Democrazia Cristiana") that pushed those unconstitutional crimes in the italian criminal code. So you may wonder why the cops involved in my case were militaries and the cops chasing me are civil policeman instead: the reason is that the catholics have been managing the guns industry, and a large part of the italian finances for many decades (since ever?); everything hidden in the Vatican City (ie: 2 squared kilometers with indipendent nation status; indipendent giurisdiction). It's pretty the same of the City of London, Monaco, Delaware, Zug, and the other financial love cabins that every country like to keep in place in order to fake the public records. The entire italian pension system was there in the Vatican City: even the public registry of INPS (the welfare public company) were located in a building owned by [Caltagirone](https://en.wikipedia.org/wiki/Francesco_Gaetano_Caltagirone) (old construction entrepeneur part of the very inner Rome's mafia) and rented by the italian government at pretty expensive costs. Now go have a look at who the husband of Azzurra Caltagirone (Francesco Gaetano's daughter) is: the deputy [Pierferdinando Casini](https://en.wikipedia.org/wiki/Pier_Ferdinando_Casini). If you read his bio you'll notice that he's never been out of a party with the word "christian" in the the name of the party, since 1983; more or less the same of Angelino Alfano (tip: check his father's bio). Among other things they are the major responsables of the anti-muslim propaganda in Italy. To recap: the ones that manage the long term italian savings, hiding behing the priests skirts, are chasing one guy that is asking for fair trial and reimbursement since 2006 and have been doing anything he could to access the judicial system since then, in vain. Did you get it? Ok, another detail: at some point in time before 2014 my ex girlfriend dropped her charges against me in order to avoid an automatic condamn for abusing of the judicial system (ie: faking a criminal case for the sole purpose to suck some money and/or just damage someone; not for justice; if she loose she get a few years of jail and permanent ban from the lawyer profession): pretty weird for someone that feels abused, isn't it? Eheh. But I didn't dropped mine: she sued me (ab)using of my attempts to peacefully resolve our troubles, I invited her to bring arbiters/witnesses, and anything I could to make her feel comfortable; and 4 years later, after 4 fucking years of any kind of mobbing, costs, risks ... she wants to close the games she have sent to shit? No way. Pay back first. When the cop (civil police) telephoned to me on Skype in 2014 pretending to be my new lawyer (from a room in Frascati's police station; I recognised it because I've been there before, and the view outside the window looked like confirming that spot) he said that he had to search for my file because it had been dro... and he choke his tongue. To make them notify the drop of the charges (ie: "archiviazioni") is one of the activities that my girlfriend pointed out a few years before to be necessary for a fair judicial system to be: by not notifying the drops, they were manipulating us all in the mid-long term, and now (after Berlusconi stepped down, after Edward Snowden, after the 01/2014 italian constitutional sentence, ecc) they don't want to pay for the damages occurred in that mid-long term with the same easy they created those damages! That's all. That's why they keep running after us. There were no charges but they needed to re-create them; and that's the reason why I got recorded in all my 2014-2015 skype calls. Anyway, this rebuild process, as I said in the case of the "invite to report" before, is not that important: I shipped multiple copies of the papers I got at the courthouse; whenever I could, from whenever I was, to whenever I could imagine for them to be a safe backup. If I disappear, a copy of the ones I took at the courthouse that day will pop up. And then another one. And another one again. Debunking their last manipulation created to exclude institutional responsabilities. Basically, by chasing me, they have been burning their resources around the world. Only. BTW: the new papers are cool! They removed the word "nullafacente" ("lazy" instead of "unemployed") from my description at the beginning of the court's search order, because it was showing the real reason of those papers (note: ex Ministry of Economy Tommaso Padoa Schioppa: "let's push those lazy kids out of their homes"); and replaced the most ridicolous parts with the ones I wrote in the past 4 years. A pretty good Italian Job. I wonder who's been the poor idiot that had to scrobble all the shit I wrote in 4 years. +* 2011: Searching for a shelter [singing Mikey Mouse](https://www.youtube.com/watch?v=PmILOL55xP0). A few elements gathered around the world (ex: faded Google's stickers on a window in Dominican Republic, other random picks in Australia) and some guess work pictured what I had seen in Italy the year before: rational systems are the same everywhere and once the privacy laws had been annihilated, the investigative procedures are jurisdiction-insensitive because the cultural distance is annihilated as well. So there were all those psychos I've seen when I was a kid (and they were going to psycho-university), suddenly unleashed in public (embedded into new public procedures gone at large, and paid to make the population more psycho), and at very high level. Example: the brother of Massimo D'Alema (the ext Prime Minister, then Spaghetti NSA head, linked above) is a head psychologist in the Rome area administration; the D'Alema brothers, and their psycho accolytes, desperately needed to prove some stalker guilty because most of the signals the prosecutors received were paranoia, and there were millions of public euros already allocated (spent!) for psychologists, criminologists, cameras, and alike. Making us all unable to distinguish a fraud/scam/comedy from a serious danger: thank you Gov! We love you! Good job! This was happening, as an example, in some pubs all around the Frascati area (ex: P.zza S. Rocco): camera on the archibishop's building, hundreds of unaware youngsters smoking weed in its line of sight (and off course, I enjoyed smoking weed in there), fake child-hookers, ecc. +* 2012: Easy Fun. Don't think too much. Easy to say, hard to do: same shit everywhere. Bombs falling... dig holes... stay low: when I saw Google t-shirts around, in the place of Apple fancy cameras, I locked myself at home here in Asia too, crying at [Joan Baez's WhiteHouse's performance "We shall overcome"](https://www.youtube.com/watch?v=yId_ABmtw-w) thinking at how many simple people were hammered... victims... of those psycos. Powerless, helpless, impotent. And keeping wondering who 'we' are. +* 2013: Italian Judicial Debugging. My lawyer quit. Shit smells even worse. +* 2014: Constitutional court, sentence 01/2014: MPs are unconstitutional since 2005. I figured out the story of Aaron Swartz. +* 2015: More italian failures, enough time to gather the judicial results of their practices, plenty evidences keep popping up on the news. The enemy left. War is over. But I digged so much that I can't get out from my hole anymore... + +> A witty and attractive Thracian servant-girl is said to have mocked Thales for falling into a well while he was observing the stars and gazing upwards; declaring that he was eager to know the things in the sky, but what was behind him and just by his feet escaped his attention. ([Plato](https://en.wikipedia.org/wiki/Plato), in [Theaetetus](https://en.wikipedia.org/wiki/Theaetetus_%28dialogue%29)) + +### 2010 + +Plato, and Aristoteles as well, were not naturalists. They were philosophers. [Thales](https://en.wikipedia.org/wiki/Thales) instead was a naturalist: he might have noticed the well isolated his sight from the surrounding light, and walked in the well on purpose, to have a better view of the stars. It is one of the (minor) reasons why we make long shaped telescopes instead of simple glasses. But a uneducated girl, two philosophers - too busy to discuss whatever existed before - didn't get it. As well as [some millions philosophers, girls, ministries, liberal artists and inmates reading their books](http://sandalstraps.blogspot.com/2005/12/thales-falls-down-well-again-and-again.html), after Plato. + +I didn't trigger on purpose instead. I was debugging my environment since I declared myself stateless and suggested a Constitutional review process, in 2008. The ones you've seen on the news in the while is just bullshit: I don't consider both the italian voting system and the italian courts authoritative... since then. Authoritarian for sure: all those pictures presented as new ministries had to be accounted, and paid. Authroritative not: according to my feelings, practical first person experiences in courts, and ... eheh ... the constitutional court 01/2014 sentence; the grandpas squaring the circle. A pretty impressive syllogism in that sentence by the way. + +On 23 of January 2010 I knew I could easily trigger a red flag, but the allegation I was going to trigger would have been just one more of the unconstitutional laws to interrupt. And one more detail of a bigger problem: the obsolescence of the institutions and the fail of the current information systems. Four years later the italian constitutional court (sentence 01/2014) just confirmed it: the problem is that to actually produce the consequences of that sentence, there's the need of another judicial trial that crack down the rulings of the inconstitutional parliaments. One by one. Case by case. Person by person. And they probably have already placed the snipers in front of the courthouses. JFK has been killed ... and he was The President. Among us insignificant Marios, just a fool would go for that. And theoretically I don't need it: [I declared myself apolid, talking to the constitution's warden (the italian republic's President) in 2008](https://www.youtube.com/watch?v=3a8bH0ilu5Q). Grandpas just made the whole thing a bit slower; PhD level paperwork just needs time. Anyway, back to the story. + +My ex-girlfriend (and her law professor) the 3rd of April triggered the cops, so on 12th of April it was my D-Day; I got 4 cops in my place: "holy crap, I must switch to [DEFCON3](https://en.wikipedia.org/wiki/DEFCON)! What the hell... !#@$!@#!#@!". So I asked two lawyers for help; they both have been very kind and by appointing one, I avoided public defenders + + + +USA is not Italy, but the results look the same from the distance: in order to have the perfect citizen - ie: the criminal use of the criminal code to shape behaviours - the rules have grown so much that there's no budget on Planet Earth to enforce them all. The worst thing is that ... italians can't even defend in person, it must be trough a lawyer. In US, as far as I know, the judge may grant this setup on request. We, italians, must accept the risk that the lawyer introduces his coscience, his party, his politics, his mistakes in asserting the security of his communication tools... whatever ... and guess what: 4 years later my (forced) lawyer (via skype; no ID confirm) left my case claiming ethical incompatibilities between me and him. Ambulance chaser. Please, take the 'ambulance chaser' with [Homer's Nuclear Tweezers](https://en.wikipedia.org/wiki/Homer_Simpson): I haven't been able to communicate with him since I left. + +In the 6 months following the search&seize I went a few times to the courthouse: after 1 month to have my case's papers, then another month later to deposit a dissequester request, noticing irregular judicial procedures. Four months later (without any judicial news) I went to the courthouse again to get my laptop back or at least to know that my request was registered, and in the while time it has been a looooooong serie of weird episodes that made me feel like living in a mad-house. Fake cops, fake kidnaps, fake ... everything fucking fake, from the streets to the courts. + +I was trying to understand the new wave of Internet Pedoterrosatanism parnoia, I had spent the previous 10 years writing "bomb bush iraq" everywhere, automating the porn download directly to /dev/null and whatever I could invent; but I didn't realise that they were creating monsters on the road too. Yet. I had no idea how deep was the public shit we were in: public authorities were continually and illegally searching all of us in order to grant money to the psychos, instead of spending those money to protect us. And the people in the streets applying all those behaevioural sciences (body language, neurolinguistic programming, drama-baroque-whatever) in order to monitor/change other's behaviour: spending more time to manage others than to behave themselves. I had already securized the teenagers I had around ("be anonymous, don't go alone at blind dates, telephone to me or in any case tell someone where you heading to") and I was discussing the public policies forcing people to not be anonymous. So I was giving free lifts back home as usual: at bed time, who has the car take home the ones without, the ones asking for a lift, the ones appear to be more drunk, weird and done, simply come first because need more - and avoid those giving a lift to you! - and so on. One night I took a probably-fake-child-hooker up to a dark mountain in the middle of nowhere; and triggered the pedo-part too of those flying anal probes. But that is just my favourite wild nature spot, on the way to her place, and the girl wanted to talk: grass under your feet, stars over your head, all Rome in front of you, and far enough to not blend the stars in its light pollution. And you must remember every single hole in the (off) road in order to reach it in the darkness with a tiny car like the one I had... rainfall digs tunnels in that road making pretty funny the drive with your bouncing lights, because each time is different but the overal geometry stays the same... the more you go over there in the night the more you learn where the holes are, then learn the water flows, then you realise that you belong to that place - and an alleged satanism place on local newspapers. There are the water reservoirs of an ancient roman villa (Cicero's) that are often used by kids for barbecues and parties, those are the satanisms the nearby priests&nuns point the journalists at. +The bad that happens instead is that sometimes you must stop and help some drunkie to get his car back on the road: it's a mountain, with u-turn curves, some weird perspective games, and small wild animals popping out under your wheels; easy to fuck up; and the italian street law mandates to stop at every accident; at least ask if they need a telephone call; so you keep your car on, gear in, ask, call the 113 (ie: the italian 911) or get down and see what you can do more. Or you can get someone crossing naked running away from your car's lights because you interrupted an urgent love session, so you just scream out of the window "sorry guys, but I need to go home!" without stopping the car; and everything goes fine. That road has been the fastest way for my dick to reach my gf's pussy for 6 years: I've been driving my Mr. Bin's car (equipped with my dick at Jaguar's position in front of the car) on that road almost every night and I've never seen something bad going on; 20 years I go there with my friends and girlfriends to talk, fuck, eat, think, discuss, fight, cry, sleep, smoke joints and whatever reason. The people that has been beaten up and killed on those mountains, according to my town's popular hearsay and legends, are the ones that have been brought there to give them a lesson. Brought there, taken there. Good or bad, there's no random pedoterrosatanism on that road; just a bit of local mafia using the darkest and more isolated place in the area to punish people. And they don't do it along the main road, nor to big groups of teenagers making a party. In any case not the satanism reported on the newspapers. My life long experience of the area on one side, the medias reporting rapes and robberies on the other side, the government-mangled criminal stats in the middle in order to scare the people, and then campaining about security public expenditure; Berlusconi's Freedom Party won the 2008 elections that way: painting two bullocks with a dick in the middle, and waving that flag on his TVs. +BTW, I realised NOW why some kids paint a stick with two balls aside everywhere (school benches, walls, etc): their fathers have intimate fear to be raped - or intimate dreams of raping - and teach their kids to have fear of other's dicks! It's some kind of tribal common exorcism triggered by the pre-neanderthal part of the human brain; the one I din't have when I was a kid and I had to develop after being searched&seized: when I was at school I tried many times to paint dicks like my friends used to do but I couldn't, I couldn't paint dicks! Now instead I have a pretty fruedian approach to life all: everything can be explained with food and boobs. Miracle of modern psychoshit. Someone must invert the [Quatsi Trilogy](https://en.wikipedia.org/wiki/Qatsi_trilogy) to show the modern evolution. +Anyway, when I realized that the human bait was shitting her panties, I drove her back to town and left in front of the police station (as she requested); then openly reporting on Facebook her 'daddy rape me' talks, in order to 'cross the Ghostbusters streams' up to the pot melting's temperature: the ones that were stalking me because of their cheap charlie politics (and wages) failed and must leave me alone, or going after her too. Double spending, for nothing. And I want to be paid for all that work: cops stay comfy in their spying box, criminals stay comfy in their bunkers, Mark Zuckerberg gets billionaire, and I've to give them my best pictures, getting drunk, teach other's kids to not take a lift from strangers, save them from their daddies and the Internet's pedoterrosatanists, for free? + +Scared because of all this all around off-side-track manipulation, I mobilized the airforce (ie: got a cheap charlie charter flight for cheap charlie tourists) and switched to DEFCON1 leaving my lawyer behind: "Fuck them, in 6 months I can't even have my computer back; how long do I have to stop living?" + +That's me in the americas mimicking [Colonel](https://en.wikipedia.org/wiki/John_%22Hannibal%22_Smith)&[Faceman](https://en.wikipedia.org/wiki/Templeton_Peck) + + + +"Sberla" is the name given to Faceman in the italian version of the A-Team; it means "slap" because of the italian idiom "slapface" ("to be cheeky"). + +### 2011-2012 (Remote) + +I was (and I am) scared but those cops might have been my [Pengiun Liberation Front](http://plf.zarb.org/): my heroes! Because finally, after many years trying to access the judicial system, I had myself nailed and locked in a court. Wunderbar! And they missed the chance. It's a pity. + +> "It is the duty of the Republic to remove those obstacles of an economic or +social nature which constrain the freedom and equality of citizens, [...]" +> ( Italian Constitution, art. 3, comma 2 ) + +Court members, by being public officers, have the duty to report any 'fumus commissi delicti' (ie: suspect of crimes): by asserting crimes in a court session, you can trigger a whole bunch of parallel trials that you haven't been able to trigger youself (by lack of will, interest, money, attorney, or whatever). + +In my case I didn't want to directly target a judge (of another civil case that I was not involved in), nor the law professor of my girlfriend: both are too big for me. "GOV vs Mario" never works; and the italian version of the american 'class action' is a fairy tale. But doing it by proxy: "GOV vs GOV", "Queen vs Queen", "[Kramer vs Kramer](https://en.wikipedia.org/wiki/Kramer_vs._Kramer)" ... it sounds better, does it? + +So this is me dancing naked to celebrate my PhD + + + +Girls may argue that Jim Morrison was a way better show + + + +and I agree, but ... hey girls: [I'm a Free laugh](http://creativecommons.org/), [Jim wasn't](https://en.wikipedia.org/wiki/Copyright), don't complain! + +And this is me (poorly) reading Shakespeare to celebrate my PhD + + + +Again, the best part is not me, but the piece of marble under my ass that is not talking: it's a piece of an original altar of Roman era. + +And this is me closing my hard times between CCC2007 and CCC2011, the handover to the next generation of rebels + + + +Bells Beach, Australia, 2011. [Point Break](https://en.wikipedia.org/wiki/Point_Break). + +### 2012 - 2014 (Remote) + +At the beginning of 2012 I gave up also with Partito Pirata (the italian chapter of the Pirate Party); an unconsistent group of wankers I was speaking to trough a backoffice manipulated email. In february 2012 I downloaded my email from Gmail using POP3 instead of reading it trough the web panel and ... my emails were stored as "Michele Pedarsi", but the ones I was looking at on the web panel were correctly reported as "Michele Favara Pedarsi". Someone made a wrong [regexp](https://en.wikipedia.org/wiki/Regular_expression) ... go figure who I was speaking to, and where my face has been published about! + +Since I left Italy it has been a continual struggle to set my box free + + + +Aaanyway ... life goes on. So I've spent most of 2013 reading and yelling about Assange, Manning, Snowden and the italian judicial system. And I didn't give a fuck about the lawyer talking on Skype because he was refusing any voice call: no ID, no trust. + +Then finally, in 2014 I got the Aaron Swartz story on YouTube + + + +and fear rised again. Because the italian judicial system's fails + +* law: unconstitutional. +* law enforcement: dumb. +* procedures: fake. +* prosecutors: laughing. +* attorneys: useless. +* judges: no show (to my court; but they pretend to do the opposite). +* constitutional court: unattended. + +were perfectly described in that movie. So I start to dig a bit further in the american legal system to figure out how it comes that I got the same shit being in a completely different 'natural jurisdiction'. And to find some good american ideas that could be useful to fix the italian framework. Backtracking from time to time, and using the UK system to diff the american one. + +Many details popped up and suddenly a bigger picture was clear: UN spawned a whole bunch of departments mangling everything that goes from speech control ("hate speech", ie: censorship) to tourism (and, as an example, greying out new tourist developments from Google Earth); on top of continental departments (EU, US federal, etc); on top of nations; on top of regions; on top of provinces; on top of towns; on top of fractions. All top down. In my home town, I had 7 layers of bureaucrats plus banks, companies, etc, over my head and shoulders + +> Technostructure ... the group of technicians within an enterprise (or an administrative body) with considerable influence and control on its economy. +> ( https://en.wikipedia.org/wiki/Technostructure ) + +That in turn sit on top of the landlords, shareholders, etc. At this point in time a bank should be a computer in a room, only, and me asserting integrity of the system to my clients (that own the money in the bank). The same applies for any public registry and voting machine. Since 2008 I refuse to serve whatever technostructure is more expensive than that: sorry, I can't steal money from the workers. + +Plus: how do I assert integrity of the machines if those machines are off-side-track manipulated from [the board's firmware](https://en.wikipedia.org/wiki/Clipper_chip), up to [the international BGP routes](http://www.zdnet.com/article/bgp-spoofing-why-nothing-on-the-internet-is-actually-secure/), and [whatever anybody does](https://en.wikipedia.org/wiki/Hacking_Team)? I can't lie to my clients. And to my self. Not on duty. Not for money. + +### 2015 (Remote) + +The adults were so busy in pursuing me that them - the kids - just did it: Bitcoin has been a masterpiece. And its reception a success: [if Wikipedia is correct](https://en.wikipedia.org/wiki/Legality_of_bitcoin_by_country), all the countries have been very fair in its reception; even the limits (ex: China) and the prohibitions (ex: Ecuador and Russia) I've spotted are very ... I'd probably have done the same thing. + +Example: Ecuador denied the use of Bitcoin because in the middle of a dollarization process; by having the experience of my grandma during the euro transition, I agree with the Ecuador gov: it's just bad timing, they need more time to settle the ongoing process before opening a new one. +And something similar appened in the other countries. Probably the most discouraging allowances were the ones from the most liberal markets, example: Australian government said "There’s no law against that, so we do have competing currencies"; that sounds like a special corpse private picking up a fight with a Red Cross medic while aliens are invading the Earth. + +I couldn't partecipate because of the strong propaganda in place and my digital tools heavily monitored, manipulated, etc. Even few weeks ago (september 2015) I start to talk about these things with a funny guy in a bar and suddenly he said: "Why did you get searched eh? Did you make DarkNets?". He's been brainwashed; I can't help him anymore. Darknet? Try to define 'darknet' to yourself, before talking about it with others. And he even asserted to be an IT security specialist!!! Eheh. Cisco Certified Lamerz. 3073. + +Now read again about all those news about [Tor](https://www.torproject.org/) pedodrugs markets - ex: [Silkroad](https://en.wikipedia.org/wiki/Silk_Road_%28marketplace%29) - and go figure whether they are real cases or not. Mission Impossible. + +In any case, it has been better for me to stay away from anything would look like money. And despite the fact I didn't get any (considerable volume of) money from anyone, I wonder why I keep getting my SSL sessions resetted everytime I try to access my bank account. I got, bank-to-bank only, just enough money to survive, from my family. But still ... I'm monitored. + +Last week I received a fake mail on my mobile phone during a conversation about the n-work-opportunity I got, and when I declared this off side track manipulation to my peer, the content of my gmail account changed (again) to remove the traces of the manipulation: email's headers before the disclosure contained more than one rcpt-to, after the disclosure one rcpt-to only. + +It's the Google bullshit, babe. The first email I wrote&sent from gmail to gmail (2003) was manipulated in the backoffice; the weird thing was that ... the manipulation was not a bad one: the content of the email was the same, but one of the adjectives I used had been changed with a better one; I used a popular idiom, slang, but the mail received on the other side was the formal version of it. Anyway ... enough to not use gmail and stay away from Google itself. +I was lucky that the receiver was the one that invited me to the public beta of gmail, and he had his computer on the same desk of mine. Most of the people never had a chance to catch this subtle crimes. + +And I kept going like that as much as I could. Spending my life to get out from that shit. In vain. + +When the cops came to my house my friend I was sharing my mailserver with ... said he didn't want to get involved so ... I turned the server off and went hunting into the eagle's nest: today I have a gmail account and google+ waver. + +Even today, very few people are able to figure out that I'm not acting, nor fighting, just running, from nothing and everything + + + +> Journalist1: "Sir, why are you running?" +> +> Journalist2: "Why are you running?" +> +> Journalist3: "Are you doing it for world peace?" +> +> Journalist4: "Are you doing it for the homeless?" +> +> Journalist5: "Are you running for women rights?" +> +> Journalist6: "Or for the environment?" +> +> Journalist7: "Or for the animals?" +> +> Forrest narrating to the old woman: "They just couldn't believe somebody to do all that run for no particular reason." + +I'm sensitive to all those topics but honestly, all I want is a life without the Vatican University to profile me at 11 years old (Frascati, VillaSora, 1989). +Nor a psyco-teacher asking me to fill in questionaries in an Australian school at 32 years old (Melbourne, Holmesglen, 2011). +Or a girl checking - literally - my ass hole while I'm asleep for whatever reason I don't know about (Thailand, my room, 2012). + +> Forrest narrating to the old woman: "Now, for some reason what I was doing seemed to make sense to people." + +### Today (Remote) + +[I'm tired to be manipulated by the italian militaries](http://www.bgpmon.net/how-hacking-team-helped-italian-special-operations-group-with-bgp-routing-hijack/), and for them to hide behind 'the hackers': I'm an Hacker and I've never stolen a Bit, nor a Coin. Fuck off. + +I want the same thing of 20 years ago, 10 years ago, and today: for my communications to be PRIVATE + +> "Freedom and confidentiality of correspondence and of every other form of communication is inviolable." +> ( Italian Constitution, art. 15, comma 1 ) + +And public money spent to enforce this. Not to enforce Ducks' Hunts in order to being able to hijack more taxes. Plus: I'm still waiting to see my 'natural law' published + +> "A law is published immediately after promulgation" +> ( Italian Constitution, art. 73, comma 3 ) + +here. On this media. The Internet. Because it is faster in reaching a wider part of the public + +> "By saying 'immediately after promulgation' the Constitution mandates the government, which is denied of any further decision, having only to choose the fastest way to publish the law" +> ( [163/1963 Const. Court](http://www.giurcost.org/decisioni/1963/0163s-63.html) ) + +They didn't know what '[integrity of a digitally encoded message](http://mfp19.github.io/2015/08/24/Integrity.html)' is, but the law publishing principle is still valid unless the Constitution is changed, by the people + +> Sovereignty belongs to the people and is exercised by the people in the forms and within the limits of the Constitution. +> ( Italian Constitution, art. 1, comma 2 ) + +Why this doesn't happen? Doesn't Just Happen? + +# Three-piece psychology and 1950's technobrain + +This general disability to understand what we do, makes any behavioural approach to us ending up between two philosophical concepts: ataraxia (ie: absence of movement) and apatheia (ie: absence of emotion). Dumb or perv. Dumb and perv. Dumb xor perv. Dumb not perv. Perv not dumb. + +Those, translated in contexts different from semiotics - ex: psycology, medicine, criminology, philosofy - easily become syndromes, deseases, personal offences, offences to the public order, and even minor and major crimes. Mileage varies according to local culture. This is me "Usual Suspect" + + + +The title is a bit complicate to explain; the video a bit more: I'm confirming to be a stalker according to the current legal framework, so that the captchas get interested, but they had to wait the 3 month threshold in order to be able to get a condamn at judicial time, and I had more time to confirm the missing pieces (ex: get back my pics, see my gf working at uni or for the Partito Democratico, ecc), before being in court and spawn a whole bunch of parallel processes. Simmetric Multi Processing; our brain is an amazing tool. Being a prey is scary: kids, don't do it at home! I did it just because I had no way to access a court without paying money (that I didn't have) and I ruined my life! In theory the italian Constitution mandates the right to a defender, but in practice it is denied (because of money and/or because of impossible formal procedures, in some cases too detailed, ie: too expensive). In Italy we have a special court called "Tribunale del Riesame"; it used to review the authoritarian acts (ie: search, sieze, arrest, jailing). When Google popped up (ie: the network switched from personal computers back to cloud systems aka mainframes) all the laws (ex: privacy) have been rewritten to analize everything in the backoffice (ie: they check your telephone calls in the telco company datacenter before you are notified of being under investigation, not on your device at court time), so that nobody reviewed any more the authoritarian acts. +When my girlfriend was doing her 2-years apprentship she popped up one day talking about this "Tribunale del Riesame" saying that it was "just a way to access the papers before going to court" (ie: to have more time to study them and prepare your defence). +So, about 3 years later, when her father made me a ring (crossing between homes and mobile phones) ... I've felt free to call him back (cross-crossing between homes and mobile phones) to say goodbye because I've never had the chance and he was a nice guy I've loved. And this gave the (previously unconstitutional, then undeclared and denied) mass-surveillance facility the chance to assert stalking; because there were no telephone calls at her home before that one, so they needed to create one. The metadata (logs) were recorded by law (european data retention directive); not the contents of the call (ie: "Sorry Mik, I made the wrong number", "No problem, I took the chance to say goodbye to you"). And without the "Tribunale del Riesame" there was nobody reviewing the authoritarian act of spying me, so the prosecutor authorized, and the law enforcement proceeded to the search&seize. At the time there was 98% of the people ignoring, denying or accepting surveillance; plus 2% of the people (cops, robbers, politicians, courts and IT Guys) not accepting it. I was one of those in that minority, since childhood. And I still am: this story, about an italian in Italy, is somewhere not in Italy; actually, it maybe a server in Italy but probabilities that one company is buying energy-hungry services in Italy is very low (because electricity there cost a shitload). +So I had the shit of surveillance over my head, but no "Tribunale del Riesame": I went there after the search&seize to access my papers and send them to my lawyer in another city, and the storytelling of that day is in the Epifany page. In a perfect world, the shit of surveillance would be ok if and only if ... the search&seize is at the same time of "riesame" (review); in the real world the italian cops have no IT Guys to rely on, nor sealing bags to protect the collected evidences, nor procedures to analyse the evidences at later time. So basically once your data is in their hands ... you Go-At-See ("you fucked"; check the other pages of my I/O to figure out what "goatse" is): by law enforcement and/or by mobbers. They make you an aberrant case, out of you. What follow after is that ANYBODY in the world can abuse of you until you get a new identity and money, or whatever crappy end-of-life. KIDS, DON'T FUCK UP AT HOME (IN ITALY) WITH THIS SHIT. NOBODY CAN PROTECT YOUR PRANKS. There's no "Tribunale del Riesame" ("Review Court"), you'll get busted, and suffer, and ... whatever... because they don't want to take into consideration what you got on your iPhone; ie: the datacenter is administratively considered to be safer than your device, because you could tamper it to delete evidences of you being guilty, so your side of the story is not taken into consideration. It took them 5 years in order to debunk me abroad, and change the documents I took with me. But that's just a lucky coincidence given the huge amount of good people I've met. Others got jailed or killed before. Gatto avvertito, mezzo salvato. + +But it is not really necessary to understand; those videos are just landmarks in time, doorstoppers. It's an inter-jurisdictional cloud-based judicial enforcement of my rights. As it happened 5 years after, a bobbit requested a timeline of the events: I had the doorstoppers. In the whiletime nobody understood why I was so keen on having my pictures from my ex gf, and why I didn't want to remove my videos from YouTube; it has been a 5 years long torture: my mother, my father, my brother, my cousins and friends, law enforcement emissaries, political parties offering hats ... all the social bullshit you can imagine of ... all going down to the 'revenge porn' route (and me: 'no, it's a personal full disclosure'): to avoid the revenge porn is secondary - Superficial - the primary issue instead, is to keep the anonymity on the internet. No name, no target. And I challenge you to find the full name of my girlfriend using only the stuff I produced and published. Only locals could, but that was lawful since 1972 law to access public records (even the fiscal ones) for anyone living in the same town, and ... it is pretty normal everywhere: "hey, did you hear the news? Winston and Cassandra just divorced!", "Oh, that's a pity; they were so cute! AND WHAT ABOUT THE KIDS?!?!?!?", "I've no idea about the kids but the other day she was throwing shit out of his corner shop!", "Oh, that's good... we finally can make a new offer to rent it!". +The thing that complicated everything was her sign on the police report: the italian judicial system shouldn't be involved at all. It costs public money, it's painful indipendently from its result, and it's dumb. Moreover it is a pasta colinder: your story goes anywhere between the Vatican Library (20km from my home) to the new NSA datacenter in Utah, trough Dubai and Hong Kong and at the end you must say thank you to the english. Basically this is the result: [DON'T CLICK HERE, YOU'VE BEEN WARNED](http://goatse.info/). + +> The goatse.cx lawyer has informed us that we need a warning! So.. if you are under the age of 18 or find this photograph offensive, please don't look at it. Thank you! + +They might have confused the word "Warning" with "Disclaimer" or "Landing Page" but ... I admire the guys that wrote that disclaimer. The warning is on the top of the page on a top-down reading tool: it would work in the case of a [CGA display](https://en.wikipedia.org/wiki/Color_Graphics_Adapter). It is the same of writing "adults only" on the top of this page; but there are not hot pictures right under. You must be willing to read, and read, to get some of my piss; opening the eyes and pointing a browser is not enough. The concept of censorship, self-censorship, and responsibilities changed so much that ... well ... most of the living humans can't figure out yet. + +Anyway, happy that the picture is back again for adults! It has been censored world wide for a while. The first time I've seen it I was at high school! For me it worked as a constant 'censorship meter' wherever I went, whatever I was doing. Searching for it might have been one of the psycho-traps I've been triggering. You need guts nowadays to enforce freedom of speech without having a gun and being living in a self-sufficient lunar biosphere. Once - just after reading the last news about NSA spying us all - [I went up to the roof and enlarged my ass to the moon to see if Aliens were gay](https://en.wikipedia.org/wiki/Four_Lions), and to show my ass to NSA satellites; but I've been lucky again: no UFO took advantage of my position and I just dropped an ass-pic into the NSA archives. [Mission Accomplished](https://en.wikipedia.org/wiki/Mission_Accomplished_speech). I don't like those kind of risky experiments but ... after [Gary McKinnon](https://en.wikipedia.org/wiki/Gary_McKinnon) have been arrested, there's no way to check what the hell the militaries are doing up there. I was secretly supporting [the german guys](https://en.wikipedia.org/wiki/Fernsehturm_Berlin) in their project to send a civil space station up there. So, from time to time, in the while, I send a present to the militaries + + + +Because of all those (lack of) reasons (ie: behavioural why-the-fuck-are-they-called-scientists?) living with you all can easily become a reciprocal continual pain. So, sometimes is good to cheer up. Two modern high profile examples + +* [Italian Police's advices for parents](http://www.commissariatodips.it/da-sapere/per-i-genitori/navigazione-sicura-e-consapevole-dei-minori-su-internet.html) +* [UK Police's advices for parents](http://www.nationalcrimeagency.gov.uk/crime-threats/cyber-crime/cyber-crime-preventing-young-people-from-getting-involved) + +On both websites there are references to beheaviours hardly related to a computer + +* resistant when asked +* irregular sleeping patterns +* more socially isolated + +can be nothing and anything. Are you happy when you are asked? I mean, when someone disturb your solo-doing to get something from you... do you feel happy? I mean, don't consider the beloved ones, the boss at work, and the rest of the world in the good days only... do you like to be asked? + +Hey, teacher, leave the ki... + + + +ehm... eat a [peperonata](https://en.wikipedia.org/wiki/Stew) for dinner and count how many days you won't be able to have regular sleeping patterns. I call my austria-born aunty from sicilly on purpose for this experiment: you'll get an original, genuine, scientific, math precision, sicilian made, german-spoken solidity, peperonata for you and the sake of our little experiment. And if you don't keep regular sleeping patterns in the next 3 days ... you must eat the metal and plastic parts of the server you published that bullshit on. The entire cabinet. Cooling liquids included. And the patch cord up to the patch panel (according to IEC standard; not ISO/OSI: it's longer). + +Jokes apart, one of the most authoritative world's think thanks is the Royal Society. It's somewhere there, pretty close to Scotland Yard; UK Police can find their phone number easy. And [they asserted that it is fundamental to teach information technology at school](https://royalsociety.org/~/media/Royal_Society_Content/education/policy/computing-in-schools/2012-01-12-Computing-in-Schools.pdf). I mean: in Italy we are handicapped people because of the existence of the Vatican City and the resulting Wannabe Brokers. English don't! British cops have a chance! + +In fact, after figuring out that prohibiting to play with math is a bit... inverted - the teacher in Pink Floyd's video is making fun of the young boy for making poems and pushing him back to study math, not the opposite - UK Police [apparently removed](http://blog.quintarelli.it/2015/12/lerba-del-vicino-secondo-uk-da-ragazzo-esibivo-i-tratti-caratteristici-del-cybercriminale-in-erba.html) + +* Are they interested in coding? Do they have independent learning material on computing? +* Do they use the full data allowance on the home broadband? + +And the Italian Police upped to the very top of all their pages the advice to parents, teenagers, and kids, to stay anonymous. They must have realised that it has always been pretty easy to motivate a kid toward arts and beauty; much more difficult to do the same toward math and engineering. We start to talk 1 second after we get out from our mothers but it takes a few years before we start to fight against the [Sorite's Paradox](https://en.wikipedia.org/wiki/Sorites_paradox). + +Or - FINALLY! - they could have realised that the [Analogue Hole](https://en.wikipedia.org/wiki/Analog_hole) is too big to be policied. Because it is a loophole in which rationality moves faster than the policy makers change ratio: one of the most important ancient institution of the world - [UK's House of The Lords](https://en.wikipedia.org/wiki/House_of_Lords#House_of_Lords_.28Expulsion_and_Suspension.29_Act_2015) - just introduced the 'power of recall' - the chance to fire a life-serving Lord, aka velvet lynching - in the attempt to run faster; italians did ... let's say "something similar"; poor guys, I don't feel cruel at the moment. But that loophole is even faster than the wannabe-policy-maker kids to have birth and grow. So those underachievers keep pushing us all (cops&robbers included) in the AnalHogHole: wikipedia can't tell you what it is because of the UN Hate Speech policies and the rest of mouthwashing traditional procedures. But I can: it is when the money finish and they realise to have made a mess. They simply can't run after everyone claiming to be mobbed, stalked or whatever distributed attack feels; because the more they run after, the more they create it. The more they record failures, the more they create autism and attention-deficit: NEW SYNDROMS!!! Prevention is the AnalHogHole. + +At the italian front line we have also those human masterpieces as well + +> "there's the need of a longer lasting school, in the afternoon more teachers to keep the kids busy at school because when they go home, if they are in a normal family they connect to the internet, Facebook, the network, pedos, sick people, mentals; if they are in a mafia family, they absorb mafia culture" +> ( Nicola Gratteri, Public Prosecutor at Procura della Repubblica del Tribunale di Reggio Calabria; [AnnoUno, episode “Er Sistema”](https://www.youtube.com/watch?feature=player_detailpage&v=Q6_Y2RXMLzU#t=5642) ) + +If you hear him, you feel like The Internet is a kids massacre; the Apocalypse. Easy to remove 2 sentences from a website, a bit more difficult to remove a prosecutor (or any other officer) from his chair + + + +With (serious) respect talking: I wonder why the english keep electing a life-serving majority in their upper chamber and open the chance of firing them after, instead of limiting their service to a few years in advance, and renovate their mandate limitless in the case they served well. Continuity is needed, but people continues too much already. In the italian constitution the equivalent entities are called 'senators' and there's a mandate to elect a limited (numbered) amount of, for life service; the republic's president choose them according to their contributions to society. And it doesn't work either: they are so old that often their minds are gone, their bodies can't speed up to parliamentary speeds or they just retired so long before that ... don't really know what is going on around them. Evidences of this failure can be seen in the current judicial system output. + +Probably the same crap went on about every where in the western societies: [US](http://code.org/), [France](http://www.academie-sciences.fr/pdf/rapport/rads_0513.pdf), ..., [EU](http://www.informatics-europe.org/images/documents/informatics-education-acm-ie.pdf): police cracking the best students happily singing "Simple Man" + + + +I'm used to it ... it's an older and deeper story ... and I love that song. But the results are pretty scary. + +As I've learnt from other hackers "Paranoia is a Virtue", and I'm pretty sure that many officers need it daily for their investigations; it is where any hypotesis come from, and saves their butts in limit circumstances. It's a research tool. And an early warning trigger; expecially if you are the one supposed to not have fear (ie: the warning trigger for all the rest of us). But whenever they point at the Internet they are hammering the wrong nail. + +And let's not speak about "keeping someone busy": to do it since the childhood is the best way to produce a generation of natural born cocaine addicts. People that can't stay still 5 minutes without going mad. Unable to think, meditate, pray. People that after a car accident instead of waiting 7 seconds to calm down, look around, and check, before opening the door to meet the other side of the story... grab the wrench and go straight forward to "have a little not-talk to the one that broken my car". + +Here's my 2010 version of [Dumb and Dumber](https://en.wikipedia.org/wiki/Dumb_and_Dumber_%28franchise%29) (note: "Tu non capisci", it. for "You don't understand") + + + +And after many years of research and discussions, consultative buying and selling, with high levels of paranoia involved, I still haven't found + + + +a way to tell others what I do, why I do it, and what I want. Who am I? Mission impossible. + +These people - these psychos - is entangled, trapped, into a sort of muddy kind of medieval [Aether](https://en.wikipedia.org/wiki/Aether_theories) ... the evil twin of Ethereum. They are unable to catch the big picture of the human paradox, continuosly ending up in unconsistant results in order to be able to metabolize their (our individual) misery: syndromes, deseases, personal offences, offences to the public order, and even minor and major crimes. Imaginary ... bullshit. + +That's why the world could be, and it is not. + +At this point in time they should have discovered that the profiles machine-collected in the past 15 years are "fading away" as a result of the human being ability to learn from his own mistakes and make new ones. Our evolutionary attribute. I hope they stop profiling us as well. But doesn't look like. +I defended myself changing my habits (eat, drink, sleep, sex, ecc) from time to time; but my personal bounduaries are too close to fake my profile enough (ex: I don't have sex with men, I need to sleep a minimum amount of hours, ecc); and the result have been: ruining my health, being reclassified in another profile, get more psycho-treatment (diversified); because of my 'erratic behaviour', 'bad character', ecc. As well as more news from friends about fake 'social profiles': text, audio, video, chats. The more time passed, the more frequent people alerting about the italian "[CTO](https://en.wikipedia.org/wiki/Involuntary_commitment)", the more fear: thank you guys but ... before living my hometown I've spent a few hours talking with one of the guys psycho-treated like that (soft pills melting in his mouth and so on), but he was not crazy. He accepted to be considered crazy. [A pretty smart guy](https://en.wikipedia.org/wiki/Hair_%28musical%29). + +Just do it. + diff --git a/_posts/2015-12-27-PastaCiccia.md b/_posts/2015-12-27-PastaCiccia.md new file mode 100644 index 0000000..c32e834 --- /dev/null +++ b/_posts/2015-12-27-PastaCiccia.md @@ -0,0 +1,207 @@ +--- +layout: post +title: Pasta&Ciccia +author: mfp19 +--- + +Tags: [hatespeech](#hatespeech) [pastaciccia](#pastaciccia) [currency](#currency) [royalties](#royalties) [censorship](#censorship) [surveillance](#surveillance) [5eyes](#5eyes) [9eyes](#9eyes) [minitrue](#minitrue) [outcome](#outcome) + +We had a [problem](http://mfp19.github.io/2015/08/24/Integrity.html), we have a [solution](http://mfp19.github.io/2015/12/15/Solution.html), we marched to [enforce human rights for all](http://mfp19.github.io/2015/12/17/Constitution.html), we [fixed finance](http://mfp19.github.io/2015/12/20/Timeless.html), and we imagined (again) [how the world could be](http://mfp19.github.io/2015/12/25/Aethernum.html), then we [figured out why is not](http://mfp19.github.io/2015/12/26/Profile.html) + + + +laughing too + + + +to exorcise our pain + + + +Let's imagine that for some undetermined reason the whole world agree on [this version of the story](http://mfp19.github.io/2015/12/26/Profile.html#behavioural): sick marketing psychos, spokespersons, politicians, puppets, and a large variety of + +> profiteering gluttons + +broken the world. Reductio ad absurdum. + +# Maltagliati&Frattaglie + +Maltagliati is a kind of pasta. The only page I've found on the english wikipedia about Maltagliati, is the [Spätzle](https://en.wikipedia.org/wiki/Sp%C3%A4tzle) one. It looks like Wikipedia need an help on the etymology part: "spezzare" in italian means "to break" and the german word sounds pretty similar. Maltagliati means "badly cut", in other words: "spezzati" (that means "broken"). Hacked. Now look at the Spaetzles, at the tools used to make them and ... then listen at the sound of "spezzati" and the sound of "spaetzles". Then go asking to the Ladin People that still live in Tyrol, wheter this is a good catch or not. I also don't understand why Wikipedia mix the short versions ("buttons") with the long versions ("noodles"). And they make also a wrong mapping to the italian Gnocchi ... that indeed ... should be mapped with the Knoedel - Canederli - the tyrolean gnocchi. + +Frattaglie is a kind of meat that Wikiquotes translates with "offal, giblets". But I'm tired to play with the words by now, so, while the Communication Scientists try to figure out if "ciccia" (ie: the title of this post) is hate speech or not - because it is in use both for selling "meat" to an unwilling kid at dinner time, and to nickname a "girl" - we go back to work. + +## Hate speech + +In other words: I hate to speak. But I have to. Pidgeon English + + + +## Royalties&Rights + +> [The English Constitution](https://en.wikipedia.org/wiki/The_English_Constitution) + +> The right to be consulted; +> +> The right to encourage; +> +> The right to warn. + +> [The Creative Commons](https://en.wikipedia.org/wiki/Creative_Commons) + +> Attribution +> +> Share Alike +> +> Non Commercial && Non Derivative + +The good part is that the BY-SA-NC-ND licence doesn't exists: [BY-SA-NC or BY-NC-ND](https://creativecommons.org/licenses/). + +## Censorship + +* https://en.wikipedia.org/wiki/Sorites_paradox +* https://en.wikipedia.org/wiki/Continuum_fallacy +* https://en.wikipedia.org/wiki/Inscrutability_of_reference + +I prefer this ones + +* https://en.wikipedia.org/wiki/G%C3%B6del's_incompleteness_theorems +* https://en.wikipedia.org/wiki/Zipf's_law +* https://en.wikipedia.org/wiki/Imaginary_time + +The first triplet is more acceptable by arts pupils; the second by science pupils. + +Both the triplets assert an amount of falsity in the language itself; making the censorship, any form of it, just ... idiot; an abuse not because of constitutions and legal frameworks, but because of natural unconsistency; it is a bit deeper than 'human rights abuse'. If you add on top the huge amount (a number 'close to infinity') of internet corners ... and households ... why do we practice mass-enforced or institutional enforced censorship, gagging, etc? It should be clear that it benefits single individual only, in single circumstances only. That usually means there's a crime cover-up in the surroundings. + +## Surveillance + +The MOAB. + +### The Five Eyes (UK, US, Canada, Australia, New Zealand) + +The UK&US govs and their tech giants are playing "scaricabarile" (it. "barrel-unloading") ... shitstorm? Self bullocks-slashing? Responsabilities dropping? Who knows ... and who cares. + +> GOVs: our legal framework was built on top of the chance for the government to spy the people. +> +> CORPs: if you spy the people they drop our tools and we don't profit. + +And viceversa. + +> CORPs: our profit was built on top of the chance for the people to profit from electronics. +> +> GOVs: if you profit from the people's profit, we cannot spy. + +They look like my father and my mother after divorce. And viceversa. + +### The other 9 eyes (Denmark, France, the Netherlands, Norway, Sweden Germany, Belgium, Italy, Spain) + +The only new feeling I have is ... being thankful that Brazil, Russia, India and China exist; because EU haven't been able to do anything more than guilty silence (it. omerta'); with very few exceptions + +* [Maximilian Schrems - Irish High Court - Court of Justice of the European Union](https://en.wikipedia.org/wiki/Max_Schrems#.27Europe_v_Facebook.27_lawsuit) +* [Hans de With - Bundesverfassungsgericht](http://www.ip-watch.org/2015/12/02/german-intelligence-services-oversight-body-files-action-against-government/) + +From Italy we got [this puppet](https://en.wikipedia.org/wiki/Maurizio_Gasparri) saying that our (unconstitutional) agencies (AISI/AISE/Copasir) are 'not efficient' + + + +when he was Ministry of Communications he [openly signed a law without reading it](https://en.wikipedia.org/wiki/Censorship_in_Italy#.22Freedom_of_the_Press.22_report); in that video instead is licking the balls to [ROS](https://en.wikipedia.org/wiki/Raggruppamento_Operativo_Speciale) (Italian special forces, of the military police), the ones that [manipulated us world wide](http://www.bgpmon.net/how-hacking-team-helped-italian-special-operations-group-with-bgp-routing-hijack/), and among other commendable things tortured this guy + + + +[to make him guilty of a bomb that killed the second in charge of the anti-mafia squad](https://en.wikipedia.org/wiki/Via_D'Amelio_bombing) one month after the first in charge was bombed as well. + +Note: this story is interesting because it popped up (again) after 25 exact years; it is useful to think about the 'national security secrets' ... I've always appreciated the fact that USA had a public law/procedure about that; their people have always been sure that after a certain amount of years they would be able to write their history without lack of any detail. I don't know how the whole thing is protected against time screws... ehm... the chance that those secret docs are produced in the future, to change the past, so that present choices are manipulated. Orwell docet. But the blockchain system can address this issue as well: if you push encrypted top secret docs inside the blockchain, and preserve their passwords only (to be released the 75th year after the facts, according to the current public rule); the docs are original. The only possible thing to happen is that the blockchain system is violated (ie: found unsecure), the blockchain blows (ex: termonuclear war), the passwords are stolen from the militaries, the passwords leak from military facilities, or the people of the future agree to release those documents before the 75th year deadline. The docs stay original, integer, safe; no post production of fake history. + +But don't name those things when you talk with Carabinieri (ROS); they prefer to remember [Salvo D'Acquisto](https://en.wikipedia.org/wiki/Salvo_D'Acquisto) ONLY. Reliable people. In any case, the whole thing is way better than [the previous one based on war machines](https://en.wikipedia.org/wiki/Wassenaar_Arrangement). + +[A cherry, mon chéri](https://en.wikipedia.org/wiki/Wassenaar_Arrangement#2013_Amendments) + +> Google and Facebook criticized the agreement for the restrictions it will place on activities like penetration testing, sharing information about threats, and bug bounty programs. + +The + +> profiteering gluttons + +that more abused of crowd-sourcing (ie: to make it rain peanuts, instead of paying wages), were complaining. Eheh. + +## Cryptocurrency + +Ethereum is just one of the several efforts to enable complex financial functions in a cryptocurrency. I like that one because it embeds Turing-complete programming framework - enabling to realtime evolve the smart contracts - but others may be "incorporated" at some point in the future: Namecoin, Mastercoin (now Omni), Colored Coins, Counterparty, Ripple, Cripti, NXT, and BitShares. Just to name a few. + +Some of those cryptocurrencies offload the cpu and load the memory, some others carry names or contracts. The technological domain (a triangle: cpu-memory-goodput) is not a problem: handheld devices are powerful enough to support end-to-end encryption (that in turn bypass inherent wireless unsecurity), wireless technologies too. The only question marks regard performance; and they can be answered on the go. + +I see danger in all of them because their ability to replicate things like "bonds", "futures", and a whole world of fancy financial inventions: contracts/promises that became moral hazard and creative destruction many times already in the human history. + +With very few exceptions I didn't hands-on any of them, yet; [I can't, yet](http://mfp19.github.io/2015/12/26/Profile.html#2015); my opinion is pretty empty of value. But this point was clear as soon as Bitcoin was out: it was a minimum tech for wider bunch of different uses. I've spotted DigiCash at the end of the 90s; I've spotted Ripple at middle 00s; BitCoin has been the most solid one. Theoretically. + +# Outcome: "tutto u cucuzzaru!" + +> It works like that: +> +> - one kid is the farmer and starts the game: "This morning I went to the pumpkin field and I saw 4 pumpkins missing!" +> +> - every kid is numbered, and the n. 4 must answer without any pause: "they were not 4 cucuzzi missing, but X cucuzzi!" +> +> - number X will then repeat the same, choosing another number to call another kid. +> +> - the special call "all the pumpkins" (it., sicilly slang: "tutto u cucuzzaru") call the farmer. +> +> - During the game it is permitted to confuse and to cheat the player looking or pointing at him as if you want to call his number but changing the number. +> +> - the game goes one questioning and a penalty is applied to every mistake: an object is given to the farmer and returned at the end of the game; or the kid is excluded waiting until the last kid in game wins. After, it is possible to start again. + +In the case something like Ethernum-based technostructure would be "raised to constitutional level" (the whole information system made of it) - full stack: from the chip's opto-isolator to the electronic currency flowing - I would probably be the first to welcome NSA/GCHQ/BfV/AISI/etc by having a monitor account in "my company" using this protocol: "What You See Is What You Get". More allowances must be discussed using the Ethernum contracting capabilities. + +That said, the only thing that don't look very clear is this: I don't give a fuck about asserting principles. Those were already asserted [300 years ago](https://en.wikipedia.org/wiki/Sapere_aude), before, and after + + + +And in particular, about anonymity, about 20 years ago + +> "I worry about my child and the Internet all the time, even though she's too young to have logged on yet. Here's what I worry about. I worry that 10 or 15 years from now, she will come to me and say 'Daddy, where were you when they took freedom of the press away from the Internet?'" ( [Mike Godwin, Electronic Frontier Foundation](https://freenetproject.org/about.html) ) + +Principles are just the civil way to solve a litigation, that brings to [reimbursements, to invert abuses](http://mfp19.github.io/2015/12/26/Profile.html#environment). In other words, things like this + +> "Schrems is also suing Facebook in a class action suit [...]. Participation in the suit is presently limited to 25,000 Facebook users, although other users can still register an interest. Schrems is suing the Irish subsidiary of Facebook in the Vienna courts for €500 in damages per participant." + +are ridicolous. Parassites. It looks like 25000 cancer sick people to sue Phillip Morris because of cancer, after [100 years of incremental war on cigarettes](https://en.wikipedia.org/wiki/Ashes_to_Ashes:_America's_Hundred-Year_Cigarette_War,_the_Public_Health,_and_the_Unabashed_Triumph_of_Philip_Morris). Note: I'm a smoker. + +These instead, are not + +> "[His](https://en.wikipedia.org/wiki/Mark_Zuckerberg) personal wealth, as of December 2015, is estimated to be $46 billion" +> +> [charity for](https://en.wikipedia.org/wiki/Chan_Zuckerberg_Initiative) "up to $1 billion in shares in each of the next three years". +> +> [Telecommunications regulators in India](http://bits.blogs.nytimes.com/2015/12/23/indian-regulators-suspend-facebooks-free-basic-services/?_r=1) have ordered the suspension of Facebook’s controversial program to bring free basic Internet services to mobile phone users in the country. [...] Facebook and its partners are violating the principle of net neutrality [...] the program offers free web searches using Microsoft’s Bing service but Google searches incur a charge. + +It means that that's not charity, nor philanthropy. And if you read it vertically: "His charity for Telecommunications regulators in India", it is even worse. + + + +Finally, this states that Facebook was a scam + +* http://curia.europa.eu/juris/document/document.jsf?text=&docid=169195&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=80225 + +And the same applies to any on-line data-related business activity. Google included. + +We - the hacktivists, only - want those money back, only. On our desks + +* Without the need [to apply at some kind of dark office](https://privacyinternational.org/illegalspying), [to step as foreigners into a lesser rights jurisdiction](http://www.thenewamerican.com/usnews/constitution/item/17008-fourth-amendment-and-foreigners-does-it-apply), [from remote by using an industry-standard computer instead of anyone](http://www.theregister.co.uk/2015/12/22/silicon_valley_expected_to_launch_counter_attack_on_snooping_bill/), and without being profiled ([AGAIN!](http://mfp19.github.io/2015/12/26/Profile.html#analprobe)) first + + + +* Without Daddy Zuckerberg to bind them to a contract before delivery: we'll finalize the money later, according to our comprehension of [capabilities and needs](http://mfp19.github.io/2015/12/25/Aethernum.html#previous); [not by proxy](https://en.wikipedia.org/wiki/The_Giving_Pledge). + +Twenty years ago I was there, I've been here all this time doing [the same thing](http://mfp19.github.io/2015/12/26/Profile.html#analprobe) ([again](http://www.parliament.uk/business/committees/committees-a-z/joint-select/draft-investigatory-powers-bill/news-parliament-2015/journalists-lawyers-mobile-companies-evidence--/), and [again](https://www.openrightsgroup.org/blog/2015/how-the-investigatory-powers-bill-will-affect-internet-service-providers), and [again](http://arstechnica.com/tech-policy/2015/11/uk-isp-boss-points-out-massive-technical-flaws-in-investigatory-powers-bill/), and [again](http://arstechnica.com/tech-policy/2015/11/the-snoopers-charter-would-devastate-computer-security-research-in-the-uk/)); and I still haven't found time to make a kid because I'm worried about not being able to be anonymous myself, in order to keep him anonymous as well. Safe. I call it "social responsibility" + +> You cannot escape the responsibility of tomorrow by evading it today. ([Abraham Lincoln](http://www.brainyquote.com/quotes/quotes/a/abrahamlin101733.html)) + +That is the opposite of "social network"; the opposite of monetizing other people. + + + +Don't worry Zucky - "it. zucca, zucchina", "en. pumpkin"; "it. zucca vuota", "en. empty head" - there's no need for you to go to Europe to be sentenced - you're not Edward Snowden - because we don't want you; we want your money. All the ones that we refused since Google inception, because of our ethical concerns about privacy. + + + +Giv-u-flex, buffone! + diff --git a/_posts/2015-12-28-Checklist.md b/_posts/2015-12-28-Checklist.md new file mode 100644 index 0000000..faaf1a1 --- /dev/null +++ b/_posts/2015-12-28-Checklist.md @@ -0,0 +1,67 @@ +--- +layout: post +title: Checklist +author: mfp19 +--- + +Tags: [relax](#relax) + +We had a [problem](http://mfp19.github.io/2015/08/24/Integrity.html), we have a [solution](http://mfp19.github.io/2015/12/15/Solution.html), we marched to [enforce human rights for all](http://mfp19.github.io/2015/12/17/Constitution.html), we [fixed finance](http://mfp19.github.io/2015/12/20/Timeless.html), and we imagined (again) [how the world could be](http://mfp19.github.io/2015/12/25/Aethernum.html), then we [figured out why is not](http://mfp19.github.io/2015/12/26/Profile.html) and [where to find money to make it](http://mfp19.github.io/2015/12/27/PastaCiccia.html) + + + +> ... but they also find the hidden threats in our world, and they make us fix it. + +- [ ] ~~Eradicate Vatican City from Rome~~ ~~Edit 2012, Plan B: send S. Peter sq. to Jerusalem~~ Edit 2013 (my israeli friend didn't like the idea to host the chatolics too), Plan C: build a wall around Vatican City; equip full auto armed drones to patrol the wall and ballistas to trow in food and antibiotics from time to time. Wait for middle-east to peace off. Then switch back to Plan B. + - [ ] Add 2013: Visit Auschwitz-Birkenau and Dachau to derive some good ideas. + - [ ] Add 2013: Ask dutch, japanese, koreans and singaporians how to build proper high density housings. + - [ ] Add 2013: Buy a steamroller to cram all the catholics inside Vatican City. +- [X] Define 'I' +- [ ] Define 'We' +- [X] Hack my family +- [X] Hack my nation + - [X] update the constitution + - [X] trigger constitutional exceptions + - [X] change voting system + - [ ] mandate publishing the law on The Internet + - [ ] mandate publishing of previous judicial sentences on The Internet + - [X] wait for arts (liberal and not) practitioners to come home +- [X] Hack my continent +- [X] Hack United Nations + - [ ] Reform the General Assembly, make spherical its parliament. + - [ ] Reform the Security Council, randomise it. + - [ ] Erase any department, commission. Urgent: delete hate speech and turism ones. + - [ ] Add 2013: send Laura Boldrini back to UNHCHR and be sure that they don't trow her back to us again. +- [ ] ~~Remote control my lawyer~~ Edit 2013: Get rid of my lawyer and find another one. +- [X] Stay away from my natural jurisdiction: find a shelter +- [X] Identify another place to settle down +- [ ] Change job +- [X] Find a girlfriend +- [X] Hack the judicial system of my natural jurisdiction + - [ ] re-introduce justice in the judicial system + - [ ] make the trials cheaper + - [ ] make the trials shorter + - [ ] Add 2014: parallelise the second (merit check) and the third (formal integrity) grade of judgment to shorten timings (example: Aaron Swartz movie) + - [ ] make a lawyer optional + - [ ] re-introduce juries + - [ ] anonymise courts and juries trough computer-aided double-blind procedures + - [X] make court members liable + - [ ] mandate notifications of 'archiviazioni' + - [ ] reimbourse 'misure cautelari' +- [ ] Guess the right courthouse and apply for a 'good character' certificate +- [ ] Guess the right courthouse and deposit the 'good character' certificate to get reimbursement +- [ ] Find something useful to do with DNA +- [ ] Print my ID and change identity +- [ ] Print my money and fuck off the banks + - Add 2012: BitCoin! +- [ ] Move to the place and settle down +- [ ] Go back to the gym: kickboxing or alike +- [ ] Study hamiltonian math and answer the question "why the fuck do I believe in quantum physics?" +- [X] Wait for our enlightened presidents&popes to fix the world +- [ ] Read any of the best books ever +- [ ] Write a book +- [ ] Make a kid (or find one) +- [ ] Be Happy + + + diff --git a/_posts/2015-12-29-Antelitteram.md b/_posts/2015-12-29-Antelitteram.md new file mode 100644 index 0000000..6079e7e --- /dev/null +++ b/_posts/2015-12-29-Antelitteram.md @@ -0,0 +1,44 @@ +--- +layout: post +title: Antelitteram +author: mfp19 +--- + +Tags: [h](#h) + +We had a [problem](http://mfp19.github.io/2015/08/24/Integrity.html), we have a [solution](http://mfp19.github.io/2015/12/15/Solution.html), we marched to [enforce human rights for all](http://mfp19.github.io/2015/12/17/Constitution.html), we [fixed finance](http://mfp19.github.io/2015/12/20/Timeless.html), and we imagined (again) [how the world could be](http://mfp19.github.io/2015/12/25/Aethernum.html), then we [figured out why is not](http://mfp19.github.io/2015/12/26/Profile.html) and [where to find money to make it](http://mfp19.github.io/2015/12/27/PastaCiccia.html). Finally, some [relax](http://mfp19.github.io/2015/12/28/Checklist.html). + +Awesome. + + + +But I understand that all that crap is verbose and a bit ambigous + +> "disambiguate something to show clearly the difference between two or more words, phrases, etc. which are similar in meaning" +> +> ([an Oxford dictionary](http://www.oxforddictionaries.com/definition/learner/disambiguate)) + +So let's clean up a bit this fairy tale. + +# Beware the "h"! + +> Ante litteram := Before the term existed; before the term was coined; used after a term applied anachronistically. +> +> (Wikiquote) + +In italian the "h" is mute; teachers at kindergarden teach: no sound, no onion smell flowing out of our mouths, no mosquitos comin'inna. + +But "h" is not mute everywhere! Shame on me, I realised this for the very first time at 34 years old: I welcomed with "Hi horny!", my female friends, for a few months - some of those walking away disgusted - before a british girl figured out that I was truly convinced to be saying "Hi honey!". If you consider the UN hate speech crap, and Google Translate translating 'harassment' in swedish with "lesser rape" - yes, RAPE - you could end up in jail because of your education. Natural born h-raper: damned teachers! Don't get me wrong, I appreciate good education but: RAPE!? + + + +Look at this one + +> girlfriend: "why do you call her hairy pussy? BEHAVE!" (slap) +> +> boyfriend: "WTF, again! I swear: I don't know how her pussy look like! I'd lik..even didn't know about that word in your language! Do you really have a word for that too? Cool" +> +> (a true story) + +This and many other ... ehm ... cultural shocks: slaps, knocks, and a wide variety of other unpleasant results just because of the damned "h"! And because of this, I have a bunch of h-biqous words to disambiguate. + diff --git a/_posts/2015-12-30-NotActivist.md b/_posts/2015-12-30-NotActivist.md new file mode 100644 index 0000000..035e0b3 --- /dev/null +++ b/_posts/2015-12-30-NotActivist.md @@ -0,0 +1,66 @@ +--- +layout: post +title: NotActivist +author: mfp19 +--- + +Tags: [hacktivist](#hacktivist) [connections](#connections) [rats](#rats) + +> [#include "asm.h"](http://mfp19.github.io/2015/12/29/Antelitteram.html) + +# Hacktivist != Activist. + +Look at the "h". Hacktivist. It's not the activist: there's an "h" in front! + +Hacktivists are not politicians, journalists, missionaries, adventurers, artists, whistleblowers, militias. Hacktivists might be incidentally, from time to time, [according to individual fantasies](http://mfp19.github.io/2015/12/26/Profile.html#behavioural), activists. But hacktivists are not activists. H: be sure to not had onion for launch and spit air just before saying 'activist'. It works. + +Hacktivists don't focus on [world peace, homeless, women rights, environment, animals, politics, and whatever is currently on the news](http://mfp19.github.io/2015/12/26/Profile.html#2015). Hacktivists are sensitive to those things like many other people - someone more, someone less - but those are religious matters - individual code of conducts - with their dignity and best practices. There's another word for that kind of activism: "martyrs", not hacktivists. + +Incredibly, in Italy some people have been able to bake the same all-inclusive political mudcake even on Edward Snowden's story instead of an association dedicated to privacy + + + +When I saw it - a Partito Pirata's fail replica - I've been throwing shoes all around for a few days. It's a privacy-only story, and [they pushed in their stirring pot everything they could](http://www.cilditalia.org); flooding, hiding, disguising, parasiting, one of the most important civil call to arms of the last 30 years + +* 1999: the first experimental eavesdropping in the italian TCP/IP peering points (geographic data hubs). +* 2001: amendments to the 1996 privacy act to allow profiling and marketing. +* 2003: the first [manipulated email I've spotted in my invite-beta gmail mailbox](http://mfp19.github.io/2015/12/26/Profile.html#crime). New mods to the privacy discipline to allow deeper profiling and go figure what else. +* 2005: bypass computer security (ex: encryption), digital rights associations [raided](http://www.statewatch.org/news/2010/dec/01norway-italy-seizure.htm) + +> [there were seven arrests in May 2005, which a judge later deemed to be "unfounded"], led to the copying of the contents of the A/I server hosted by a commercial company that did not inform its client. A year later, on 21 June 2005, A/I found out about the operation, which may have resulted in the entire telecommunications traffic passing through their servers, and its contents, having been under surveillance. + +* and again in 2010 + +> On 6 November 2010, on request from the Italian police, the Norwegian police seized the data on the Norwegian servers of Autistici/Inventati (A/I) + +because of + +> The group's analysis of what happened focuses on two key aspects: firstly, the "relationship between neo-fascists and the institutions" in Italy, dating back to collusion and cover-ups during the "years of lead" in the 1970s and 1980s; secondly, on how the measure was so disproportionate that it may be interpreted as a case of "political intimidation" against A/I. After noting that a "protection system" prevented the truth about neo-fascist terrorism in the "years of lead" surfacing, in relation to more recent incidents, they speak of incongruence in sentencing against convicted fascists and anti-fascists. + +* 2013: [state-encouraged BGP hijacking](http://www.linux.it/~md/text/state-hijacking.pdf), that is 'the activism equivalent of' scamming the international community, [have been the cherry on top of the mudcake](http://www.bgpmon.net/how-hacking-team-helped-italian-special-operations-group-with-bgp-routing-hijack/) + +> The Raggruppamento Operativo Speciale or ROS is the Special Operations Group of the Italian National Military police. The group focuses on investigating organized crime and terrorism. Hacking Team sells its RAT software known as Remote Control System (RCS) to law enforcement and intelligence agencies, ROS included. + +Between 2007 and 2012, someone tried to hijack both the trademark ([RG N. 72111/2011 — TRIBUNALE DI MILANO](http://www.partito-pirata.it/2013/03/ordinanza-contro-pirateparty-it-e-marco-manuel-marsili/)) and the services of Partito Pirata (hosted by Aruba Spa, the company quoted in the HackingTeam/ROS story). I've guessed - among other hipotesis - the state-encouraged hijack and hand-off the whole activity (in my case I was playing with LiquidFeedback while digging into PLSQL); others didn't, and gave for good the results of 2013 italian general elections. +I'm an hacktivist, other's don't have the "H" in front. + +The computer history is full of sad stories; enough to have its dignity and associations. Barnaby Jack is the first death-before-DEFCON I've heard about; many instead have been threatened and/or arrested the day before, or the same day, to prevent/interrupt their disclosures. [Many](https://en.wikipedia.org/wiki/Alan_turing) [died](https://en.wikipedia.org/wiki/Karl_Koch_%28hacker%29) in [many](https://en.wikipedia.org/wiki/Phil_Katz) other [sad](https://en.wikipedia.org/wiki/Freenode#Rob_Levin) [circumstances](http://hackaday.com/2008/09/20/mark-hoekstra-has-passed-away/). And those civil rights melting pots deny this dignity on one side, while the institutions deny this dignity on the other side. We call this kind of attacks "Distributed Denial of Service". You can call them "Distributed Denial of Rights". + +And hacktivists die without any kind of representation as well. **After 800 years of individual rights** + +> XXIX. NO Freeman shall be taken or imprisoned, or be disseised of his Freehold, or Liberties, or free Customs, or be outlawed, or exiled, or any other wise destroyed; nor will We not pass upon him, nor condemn him, but by lawful judgment of his Peers, or by the Law of the land. We will sell to no man, we will not deny or defer to any man either Justice or Right. + +**and after 300 years of "representative democracies" to extend those rights to anyone** + +> Believe me, dear Sir: there is not in the British empire a man who more cordially loves a union with Great Britain than I do. But, by the God that made me, I will cease to exist before I yield to a connection on such terms as the British Parliament propose; and in this, I think I speak the sentiments of America. ( [Thomas Jefferson, November 29, 1775](https://en.wikipedia.org/wiki/United_States_Declaration_of_Independence) ) + +**they lack of representation.** + +Count how many IT systems are in use - from 1970 digital wristwatches, via computers, to modern peacemakers - then count the IT guys in the parliaments. How many did you find? How many digits? 1? 0? + +In the italian parliament there is a computerised voting pad per seat since 2003 (or alike), working IT guys used to account for 1/20th of the italian population (in 2003), but none (out of 800 MPs) were IT guys. When italians complaint about the MPs not being on their seats - ie: they were working behind the scenes, sending one per party in the two parliamentary houses just to mark presence and push the buttons - they changed the electronic voting pad: today's working IT Guys are 1/120th of the italian population, IT MPs are 2 (as far as I know) but the MPs can trick the voting pads as well. Plenty [comedies](http://www.cbs.com/shows/big_bang_theory/) about IT Guys, instead. + +[It](http://www.cilditalia.org) looks like the vatican city having 15% of the italian population in their churches, and getting 85% of the yearly compulsory religion tax revenue.** + +Isn't this [1-bit picture a bit strange](http://www.marcuse.org/herbert/pubs/64onedim/odmimages/64ODMFrenchEnglish.jpg)? The quality of the legal framework is the main result of this strange picture. + diff --git a/_posts/2015-12-31-NotPublish.md b/_posts/2015-12-31-NotPublish.md new file mode 100644 index 0000000..5af8d58 --- /dev/null +++ b/_posts/2015-12-31-NotPublish.md @@ -0,0 +1,102 @@ +--- +layout: post +title: NotPublish +author: mfp19 +--- + +Tags: [publish](#publish) + +> [#include "stdio.h"](http://mfp19.github.io/2015/12/29/Antelitteram.html) + +> IV. Initial Experiments +> +> The software for the ARPA Network exists partly in the IMPs and partly in the respective HOSTs. +> +> During the summer of 1968, representatives from the initial four sites met several times to discuss the HOST software and initial experiments on the network. +> +> ( https://www.rfc-editor.org/rfc/rfc1.txt ) + +Nothing was public: host to host; everything private. And it took a few decades (1968 - 1995) before publishing this public information itself + +> Domain Name:IETF.ORG +> +> Domain ID: D36473-LROR +> +> Creation Date: 1995-03-11T05:00:00Z + +And despite I met my first RFC around 1999 to partecipate the IPv6 experiments, this is the first time I've read it: 47 years later. + +# Publish != Public. + +I've spend a lot of my time honestly trying to explain "host, socket, handshake, connection" ([protocols](http://www.ietf.org/rfc.html)), to "politicians, journalists, missionaries, adventurers, artists, militias". In vain + + + +The main problem I've met is that a computer (mobile phone included) is considered to be a commodity: a washing machine. Not an extension of the individual. Even the militaries - used to make an extension out of a knife and a rifle - don't grant the same dignity to a computer. People get this after a personal disaster only: loss of memories, loss of the smartphone, getting SWATted, or rising of deep ethical dilemmas after driving killing drones + +> Whence is that knocking? +> +> How is ’t with me when every noise appals me? +> +> What hands are here? Ha! They pluck out mine eyes. +> +> Will all great Neptune’s ocean wash this blood +> +> Clean from my hand? No, this my hand will rather +> +> The multitudinous seas incarnadine, +> +> Making the green one red. +> +> (Macbeth, Shakespeare) + +Even today, *most of the people don't know they are publishing something*. Don't know they are publishing something every time they send a private message to their beloved just because it is unencrypted (plain text), or its encryption is intermediated (not end-to-end), or its end-to-end encryption is bugged by authorities, or their devices are 'defective by design', or there's a lone wolf bothering. *They publish private messages.* And they even don't ask themselves questions about the identity of the postman; the authority that certificates the integrity of their private messaging. + +But *many people guess, and hope, that by making a public message - example: advertising - they are speaking in public*. Despite the fact that there are 2^32 different hosts: more hosts than people. It could take 20 years before I'll be able to see their ads. The marketing industry went from pay-per-view (of the ad-banners on our website) to pay-per-click, to pay-per-buy (of a product in the shop advertised on our website); then google popped up, changing those passive practices into deep profiling; melting marketing with a wide variety of crimes. And it is still failing. And selling bullshit: the illusion to sell more. + +And here we are: in 2015, the current legal frameworks built on commerce don't take into consideration the reality of those tools - what is public? What is private? - and there are heaps of overlapping disciplines (ex: patents, trademarks, copyright, surveillance, privacy, freedom of the press, freedom of speech, espionage, amnesty, safe harbour, political asylum, dual use, [maltagliati&frattaglie](http://mfp19.github.io/2015/12/27/PastaCiccia.html)) abused everywhere for whatever reason + +> We must 'penetrate the Internet' +> +> "ISIS is using the Internet better than we are using the Internet, and it was our idea," +> +> ( [Donald Trump: We must 'penetrate the Internet'](http://edition.cnn.com/2015/12/15/politics/donald-trump-penetrate-the-internet-gop-debate/index.html) ) + +Or just bad translation + +> Hands off our Internet +> +> No country should interfere in other countries internal affairs or support activities ... that undermine other countries' national security, +> +> ( [Chinese President Xi Jinping: Hands off our Internet](http://edition.cnn.com/2015/12/15/asia/wuzhen-china-internet-xi-jinping/index.html) ) + +I don't know anything about US and China but this is a better public representation of that meeting + +> Xi Wants Internet Cooperation +> +> Amnesty International's East Asia research director, Roseann Rife: "This is an all-out assault on Internet freedoms." +> +> Xi: "Cyberspace shouldn't be a battlefield, there should be no double standards in safeguarding network security." +> +> ( [Xi Wants Internet Cooperation](http://www.usnews.com/news/business/articles/2015-12-16/chinas-xi-calls-for-cooperation-on-internet-regulation) ) + +Because instead of talking about 'sovereignty' of the current leaders, talks about cooperation between the people; [freedom](http://mfp19.github.io/2015/12/25/Aethernum.html#art). + +The adoption of the internet technologies didn't happen in sync everywhere; every society has its very own history, [timings](http://mfp19.github.io/2015/12/20/Timeless.html), chances, and needs. And every time a new mass joined - by cables and language - the connected one, the new comers were ... ehm ... enjoying the new toy, at all levels: government agencies, engineers, medias, kids, tourism and wedding agencies. Producing the freedom feeling, and battlefield feeling. Arts pupils got the first feeling, tech pupils got the second. Arts pupils embraced the law, tech pupils tried to change it. + +And the + +> profiteering gluttons + +embraced patents, copyrights, big data, etc. + +> Religion has actually convinced people that there's an invisible man living in the sky who watches everything you do, every minute of every day. And the invisible man has a special list of ten things he does not want you to do. And if you do any of these ten things, he has a special place, full of fire and smoke and burning and torture and anguish, where he will send you to live and suffer and burn and choke and scream and cry forever and ever 'til the end of time! +> +> But He loves you. He loves you, and He needs money! He always needs money! He's all-powerful, all-perfect, all-knowing, and all-wise, somehow just can't handle money! (George Carlin) + +Probably Donald Trump don't have much confidence with numbers but his accountants must have. It would be a disgrace for all of us if we would have to pay a royalty for any time we use an egyptian number (1,2,3...) instead of a roman one (I, II, III...) because it was their idea. It could be even worse to go back to imperial numbers and measures! + + + +In any case there's no unique mapping between private/public and published/not-published. Unless you watch at the internet protocols in use: "host, socket, handshake, connection" ([protocols](http://www.ietf.org/rfc.html)); first. + diff --git a/_posts/2016-01-01-Standing.md b/_posts/2016-01-01-Standing.md new file mode 100644 index 0000000..fbe97f3 --- /dev/null +++ b/_posts/2016-01-01-Standing.md @@ -0,0 +1,257 @@ +--- +layout: post +title: Standing +author: mfp19 +--- + +Tags: [rationale](#rationale) [tech](#tech) [art](#art) [hardcore](#hardcore) [example](#example) [evidence](#evidence) [do](#do) + +Old stuff [documented](http://mfp19.github.io/2015/12/28/Checklist.html) for UIkipedians, [disambiguated](http://mfp19.github.io/2015/12/29/Antelitteram.html) for all, and atomized for [superheroes](https://en.wikipedia.org/wiki/Atomicity_(programming)) and [superevils](https://en.wikipedia.org/wiki/Atomicity_(database_systems)). + + + +My new year's promise: if I find a safe way out from this [RAT-trap](http://mfp19.github.io/2015/12/26/Profile.html), I'll push all this brainwork in a blockchain to ensure persistence as well. + +(TODO: move all the jokes to Profile) + +# Rationale + +> Non bis in idem, which translates literally from Latin as "not twice in the same thing", is a legal doctrine to the effect that no legal action can be instituted twice for the same cause of action. It is a legal concept originating in Roman Civil Law, but it is essentially the equivalent of the double jeopardy (autrefois acquit) doctrine found in common law jurisdictions. ([Wikipedia](https://en.wikipedia.org/wiki/Ne_bis_in_idem)) + +# Tech tools + +Hashing algorithms (MD5, SHA, ecc) have been around for a while. First time I've seen one was some american university's website software distribution in mid-90s. + +Git uses an SHA-1 ([fragile](https://en.wikipedia.org/wiki/SHA-1#Data_integrity)) hashing system that ensures accidental corruption only. And GitHub is cloud-only distributed, not public-trust enforced. It means that in a world of (labour) scarcity, I'm not ensured "[against well-funded opponents](https://www.schneier.com/blog/archives/2015/10/sha-1_freestart.html)" and [BOFHs](https://en.wikipedia.org/wiki/Bastard_Operator_From_Hell). + +Best practice reference: BitCoin uses an SHA-2 system, recursively blockchained using a real-time distributed pseudo random seed; pretty hardcore stuff. And for military grade persistence is possible to oversize the financial SHA-2, using SHA-3, and a bit of poisonous noise before the hashing process. Just to name a few of the infinite mods. Sweet. So, why the judicial system doesn't use those tools? + +Well ... a quick answer: law practitioners are like kids, they need pictures in comfortable PDFs. Can't use text files and mime encoding; so they will never realize that the best way to confirm the authenticity of an High Court doc is not an USB smartcard reader on a Microsoft Windows consumer computer - 2010 access to italian High Courts - but an hash instead. +And pictures are high addictive drugs: once they get used to Mac OSX, they can't live without. Moreover after you painted a graph to make them understand; you must explain it... because they can't understand numbers as well. Basically - without adding some math in their university courses - are the most expensive worthless professional on Earth. We shouldn't allow them to touch a computer, a smartphone, or whatever have blinken lights on it. I'm not kidding; I tested it. My ex-girlfriend was not so idiot before I bought her a Mac. + +What do you think it happens when you tell to one of those fancy lawyers going around a courthouse with [moleskines](http://www.moleskine.com/), [parker's](http://www.parkerpen.com/) fountain pens, wearing leather/velvet gloves, walking with broomsticks in their asses in the attempt to look like the cops and the beefs inbetween the cops, that they won't have any more that amount of disposal money because they are unable to do their job and the IT Guys must pay their legal consulences instead of the opposite? I mean, the opposite of what they have been doing in the past century: pay IT Guys to fix their computers; and before pay the interns to make photocopies; and so on up to the Assyr-Babylonian paper makers. + +I can tell you what happen: in 2007 I've been screaming to a lawyer in a courthouse "Lawyer, watch out your computer!" ... and the people around me "Are you crazy? Why did you threat him?". That is what happen. You get lynched by all the parties around. And if you keep going yelling at them too, you have the bad attitude; they can't understand why you are yelling. And slam you outside of their mental processes. Ignored. +Lawyers will never give you enough time to explain that the formalities in their docs - ie: recurring text patterns, ex: "High Department of The Stocazzo Courts" at the beginning of every single High Stocazzo's Document, and "Almighty Law Associates" at the end of it - make the encryption schemes weaker because parts of the encrypted docs are well known and recurring. Their formalities are weakening the real security and damaging their clients. They see the envelope of a reserved letter and feel safe; can't realise that I see the next postcard stolen from a postman. +Their fucking ego of having their fucking names embossed on every single fucking document they produce ... is fucking sending innocent people to jail ... there's no way for them to listen. Moreover the industry is serving money-making alternatives (ie: "the cloud") instead of the personal, individual, security enforcing one. +At the end of the process we - IT Guys - must find a way to bypass them, or agree with the gov "Ok, bypass them: no defendant any more, just constitutionally mandatory puppets". + +Threat him? Shall Bruce Willis be cursed, up to the 13th generation to come, because of [Die Hard 4](https://en.wikipedia.org/wiki/Die_Hard_%28film_series%29) scene of the terrorists holding a gun over the hacker's head, and him cracking the nation wide military information system in 30 seconds. + +We can't do that ... it doesn't work like that. That's just a movie. In a real time-sensitive situation the hacker would shit his pants, fail, being shot right after because useless; and the terrorist would fail right after. It takes us years of previous knowledge, months of research&development, expensive equipment, and pretty dangerous social engineering, to capture the flag. +Who's actively working on the same kind of tech may be able to go down to weeks scale because of the previous learning, equipment and insider jobs; but still ... weeks, not seconds. And in any case, according to my experience, a gun never helps: in both cases I got a gun over my head I was just dumb frozen like a duck with the hands around her neck, my eyes stuck on the barrel like one of those medical eyes tests, and instinctively trying to slowly move out of the line to see if the barrel follow or not. Brain looping "WtfWtfWtfWtfWtfWtf...". The first time took me a few minutes just to understand that it was a bank robbery. One week after I was still thinking. And the more I was thinking, the more the clear view of me beating up the girl at the frontdesk to help the robber and send that gun away faster... was clear. Next time I do it: better my flacky than a bullet, Horney! + +When I was yelling at that lawyer - the one that ignored my early instance years before the beginning of that fake trial, and ignored my telephone call a few months after the trial begun - I was referring to the fact that they can't even write; their current understanding is very limited. Based on what their consultants said. And the consultants are biased - all in the same way - by academic and industrial training. A very specific professional insult, not a threat. +I've never been thinking to spend my next few months sitting in a car under someonelse's lawyer office, to get docs that I already had photocopied years before; or for whatever else purpose. It's stupid, because I would not had any profit from it. And I hate to dig into Microsoft Windows's internals. It took me months, maybe years, to understand why it has been cosidered a threat; it was so far from my mind that ... I simply couldn't get what the hell was going on. Same of the robbery and the gun over my head. + +Following the exhaustive answer using the 3 years later replay. This time me hammering the court, the stakeholders, and whatever in the middle; not the opposite. + +# Art tools + +In the [Amazing World of Italie](http://www.imdb.com/title/tt0211915/) there are not working courts; no way to get persistence. This is what I've found in 2006 and [I've personally confirmed in 2010](http://mfp19.github.io/2015/12/26/Profile.html#2010). A certain amount of mistakes are just NATURAL; even in high profile, expensive, environments (military, judicial, etc). But the news look even worse: + +* [this 2011 paper about "The doppio binario in Italian criminal law"](http://www.law.unc.edu/documents/faculty/adversaryconference/doppiobinario-english-pelissero.pdf) seems to be Google Translated, ex: he writes "state of right", the raw translation of "stato di diritto", that in english is what you get trough the "rule of law". Another problem is an ambigous existence of both the words "freedom" and "liberty", but the paper uses "freedom" only. And there's no date nor paper-ID number. But it is a good, young, perspective written in english. + +> The aim of my report is to explain the reasons of the deep crisis of the Italian double track system, which raises problems of compatibility with constitutional rights and with the European Convention on Human Rights provisions, especially after the European Court of Human Rights’ decisions about German preventive detention (Sicherungsverwahrung) were pronounced. + +It looks like germans went down hard (ie: preventive detention) where italians went psycho. The common issue is "preventive"; because it gives a future fact for granted. + +> Outside these principles, the application of undetermined deprivation of freedom represents an unacceptable wound to freedom spheres and it risks to start a dangerous spiral of development of the preventive control, that deprives or reduces freedom in an abnormal dimension of "Bigbrotherisation" of criminal law and social control. + +Freedom and liberties are compressed and decompressed daily in a best effort fashion by every human on Earth. The word for that is "compromises". But the "spiral bigbrotherisation" is interesting. + +* [the dicember 2015 strike of the criminal defendants](http://www.camerepenali.it/cat/7170/proclamata_l%E2%80%99astensione_dal_30_novembre_al_4_dicembre_2015_.html), and a few lawyers-shoot-dead preceeding the strike, is another evidence of continual failure of the judicial system. A few excerpts + +> Against any extension of the "doppio binario", 41 bis and art. 146bis c.p.p., openly against the constitutional principles of fair trial + +The "spiral bigbrotherisation" became lack of fair trial. + +> We took part to a debate between "accusatory" and "inquisitory" models, two cultures and two judicial procedures that fought each other in the 90s + +The former makes you innocent and someone else must prove you're guilty. The latter makes you guilty and you must prove you're innocent. Smoking guns included: the "spiral bigbrotherisation" exists because of the security expenditure that in turn aims to produce evidences to have more smoking guns and less uncertanty at judicial time. But this uses of photos and videos are ... insane as well. Ask your pediatrician how many times he received a dick-pic of a baby (from the baby's parents!) to check the rush on the skin of their kids; or ask yourself what happen before and after what you see in a video. They are just two common examples of "incomplete" elements - the picture have no resolution, the video have no continuity - we think can prove something and instead don't. And allegation of pedophilia to pediatricians are nothing! Some cops took the challenge to stick a camera on their uniforms and ended up badly... I mean... deadly, jailed, etc. It must be done, but properly ONLY. Carefull with that axe Eugene. +And the same happened with the italian judicial system: an accusatory system is very fragile against preemption, and an inquisitory system is very fragile against simpler people. By having an accusatory system preempted by mass surveillance, the italian institutions clamped innocents on the sole purpose to fill in the rehab procedures. + +> From the complexity and fragmentation of this debate, emerged a new "Bigbrotherised" judicial process, completely deprived of its value, that abuses the accusatory model, in an authoritarian fashion, and allows an incremental annihilation of the defensive function + +Probatory media (resulting from the increased availability of camera phones and public cameras) are (made up) and distributed before the judicial procedure starts, making a public fiction before the fictio iuris itself: when the person arrives in court it is already convicted or - if for some reason can't be convicted - will suffer any kind of off-side-track retaliation (military, cops, criminals, organised mobbers, and solo psychos). Because of this some lawyers are suffering for being worthless and being target in turn, of retaliation as well. Some others - ambulance chasers - simply abdicate their defensive role to make their day. +And judges themselves can't do much because they make the paperwork only, relying on the law enforcement for any fact checking. The same law enforcement that imagined the story according to their [behavioural common sense and training](http://mfp19.github.io/2015/12/26/Profile.html#behavioural); or, in some cases, because of [connections between police and criminality](http://mfp19.github.io/2015/12/30/NotActivist.html#connections). + +By introducing forced delays between facts and court trials (ex: new prevention measures cited on the "doppio binario" paper above) the law enforcement can [re-dress the same person multiple times](https://en.wikipedia.org/wiki/Opera_dei_Pupi), according to whatever happen in that "probatory period", to switch their dress between different criminal profiles; this desperate need to make someone guilty and the existance of multiple crimes and multiple approaches to define criminal the same act, produces a 'doppler effect' on the "redressed pupos" minds, and eventually induce to commit real crimes. +Those probatory periods find legal grounds in psychological assessments contrary to the 'empirical principle' stated in the italian Constitution (art. 25), and find ex-post empirical evidence in the crimes eventually committed after the preventive hammering. + +That's why persistence ("[Guess the right courthouse and apply for a 'good character' certificate](http://mfp19.github.io/2015/12/28/Checklist.html)") is pretty hard to get with legacy tools. There is (was) the urgent need to adopt&adapt a new way to enforce documents [integrity and persistence](http://mfp19.github.io/2015/08/24/Integrity.html). The distributed filesystems, blockchains, etc, are those tools. + +But the judicial system itself is 100% refractory to any kind of computer-related procedural change: the lawyers union itself in that call to arms, among the other issues, states the need to oppose to reforms of the judiciary procedures where the new procedures introduce the chance for special cases to use videoconferencing tools. And the same kind of resistance from the judicial system stakeholders (judges, prosecutors, attorneys) popped up any time a computer-aided procedure has been attempted. + +Moreover, [unconstitutional RATs](http://mfp19.github.io/2015/12/30/NotActivist.html#rats) ensure the grounds for the impossibility to rely on computer-aided fair trials: judges may end up reading false documents because the law enforcement itself served those at a later stage - after redressing - to bypass the courts and persecute the individual according to their first surveys. This is the bottom line every time a phone call is involved; or more (ex: a document is electronically produced, manipulated, served). + +## Hard core euristics: law systems crossroad. + +The attorneys union states also: + +> the right to be heard within a reasonable time and the presumption of innocence risk to be deleted [...] also by the break-in of the international courts, where is possible to note the friction between the continental law proper of the italian system and the common law governing the european jurisdiction. + +**That is partly true** but it should be welcomed as a [positive innovation](http://mfp19.github.io/2015/12/17/Constitution.html#constitution), given that the italian previous art ("cases") would be used for the future evolutions of the new born common law system; to grant cultural continuity. **And it is partly false** as well: a common belief among the english is the european law to be the continental law. + +Who's wrong? None. None is wrong. + +To understand there's the need to remember two things that took me 8 years to understand: the Magna Carta, and the artificial nature of the italian constitution and its republic. The Magna Carta was + +> First drafted by the Archbishop of Canterbury to make peace between the unpopular King and a group of rebel barons (Wikipedia) + +and stated a bunch of rights (due process, habeas corpus, etc) that the king would grant to those barons, calling them Freemen (because of their properties, their slaves, and their army). At the time the process didn't exist and the gallows were privileges for few lucky bastards: torture was more trendy. +Since the 13th century, the things evolved in a very natural way in UK (ie: never conquered, never conquerors; just messing around from time to time and [re-confirming the Magna Carta just after every hard time](https://en.wikipedia.org/wiki/Fundamental_Laws_of_England)) extending those rights to more and more people until they became universal rights. Even today some of those ancient formulas are in use in royal ceremonies and judicial proceedings: "who's standing?". And they jealously preserve this feeling of being individuals - Freeman - even if today most of them have no property and no army, live on rents, and probably have to go down to the blood for the military service only. In the same way of the rest of EU and north America. + +The italian constitution instead was loosely derived from the Statuto Albertino - the previous royal statute - under the Allies supervision, in an emergency condition where it was impossible to think at being freemen: after a war that have been lost, after the king left the country, after [almost 100 years of repression of the republic idea](https://en.wikipedia.org/wiki/Giuseppe_Mazzini), and so on. Today's italians were not born as Freemen, but as equal men with defined rights (first part of the constitution) inside only the constitutional framework. The Constitution - after the basic rights of all the citizens, not every individual - assert the existance of family ("atom of society") and religion ("to make peace with the Pope after Rome has been annexed to the Kingdom of Italy"), then defines in detail every institution composing that framework; and the way to change it. This is artificial, very likely the german one: both countries has been rebuilt recently. But germans don't have special police with public officer status, holding guns and manipulating the private communications: just preventive monitoring. They did it properly; maybe not perfect but fairly working for the purpose of monitoring: right or less, no people has been dressed up to fill in psyco-paths in public procedures (just incarcerated!). + +**The british kings had to make peace with their people granting them rights, the italie-crats had to lick the balls to the pope on french, spanish and swiss requests. That's why the italian constitution was written by a tyrolean (Alcide De Gasperi).** + +This difference indeed became smaller in time, by increasing the amount of cases that finely shaped the common law, and by increasing the number of laws that heavily bloated the civil law. Often because of the sign of international treaties that were perceived internally as "international law", "continental law", "european law"; on both sides: **foreign crap shitting on "our" law**. + +This difference can be seen today in the way the so called 'rights' are perceived, in the nature of the two passports, in the commercial law (es: "Societa' Anonima"), and in the Anonymous movement: in UK is not possible to be anonymous, you can be a Freeman (with your name, face, heart, balls and ass) and stand in front of the courts granted to you, or be transported to Botany Bay; and this standing brings to new cases that shape the law and eventually trigger parliamentary discussions toward new acts. + +In Italy there's nothing to stand for, because the rights pre-exist the people, are recognised ex-post by the constitution (art. 2), and named one by one; the parliament give the new law to the President of the Republic for checks against the constitution, the courts signal factual abuses to the constitutional court, the constitutional court abrogates them. In all this cumbersome and expensive process, the individual doesn't exist: there's no Freeman, there's an idea of citizen built by composing rights at judicial time. The rights are already there: why are you standing for, you idiot? I'm standing because those rights are not enforced; our parliaments, and law enforcement, enforced the compression of rights. Annihilation of rights for some unfortunate people. + +**The UK system evolved naturally to be artificial. Italian system is artificially created to be natural.** + + + +And this generates a bit of confusion. Just a little bit. But the end result is pretty similar in both countries: an excess of policies. It can work in both cases; it works if only all the citizens are perfect. Otherwise it costs too much and ... well ... some costs must be externalized and/or some people killed, at home or somewhere in the world. We didn't go to Mars yet. And we don't know how to bring down the good stuff from the moon, yet. We are good at inventing stories and killing people instead! + +## An example: art. 612 bis of the italian criminal code, aka "stalking law". + +There's a tiny little truth in the complaint by the italian lawyers ([against what they perceive as being "common law"](#euristics)): some of the european directives, european parliament rulings, and young law advisors studing abroad, introduced overlapping disciplines in the italian criminal code; fragmenting the historical debate between accusatory and inquisitory systems. And producing damages, an overall turmoil; probably deadly. + +> confusion of the defense of the accused, with the defense of the crime definition itself, creating inadmissible discrimination + +Example: "stalking". In the italian criminal code there was an entire chapter called "persecutory acts", grouping a bunch of well defined crimes: one act defined, one mandatory minimum and maximum; each act a crime. Those actions pre-defined in crimes, are the atoms of the stalking beheaviour emerging from the sum of all the previous sentences in the common law systems. + +The common law system let it be open to further evolutions; when a detail of a new stalking episode makes sense, there's a new sentence, a new case study is written in the university books, and some previous cases might be reviewed. +The civil law system doesn't: it checks facts against the pre-defined crimes book. + +In both systems the beheavioural training of the law enforcement plays a major role in producing false positives/negatives; that's why the italian constitution mandates an overall bound to empirism (art. 25 - "... committed fact."); that in turn creates some problems in punishing administrative (ex: contracts) and beheavioural (ex: "passion crimes") descriptions of facts. Basically the constitution denies jail (torture, and death) for any "pure information crime", unless an oath (or stronger promises) has been made before (ex: military). + +Then both systems proceed to computing the right penalty. + +By introducing a new article (612 bis) in the codes there's an overlap between that single article and the entire chapter it has been inserted in; this creates problems at the moment of computing the penalty because the italian system gets the proved crime with the higher penalty (ie: the most offensive one), sum the others (proved, if any), sum the repeated ones (if any) up to 6 times, then adjusts the resulting sum to reality according to overal righterous punishment principles - the entire algoritm is complex, arguable and subjected both to changes and to the individual judge arbitration - but the overlapping article (612 bis) include all those articles in the same chapter ("persecutory crimes"), summing up multiple penalties for the same act: again a double-track ("doppio binario") problem, this time at penalty kick time. + +Because the italian civil law system is not an evolutionary system like the common law, new details and mistakes, are not immediately taken into consideration, expecially if the defenders are not taken into consideration: it produces a ton of false positives (innocents in jail) and false negatives (guilties set free). +Plus, there's no way to explain this to law practitioners. They are all malformed, in the same way, at university times: they tend to ignore reality ([protocols](http://mfp19.github.io/2015/12/31/NotPublish.html#publish)), confusing the reality with the fictio iuris they produce in court: the process is a slow motion fiction of reality, only. A good fiction, but not reality. +Moreover the static definition of the crime typical of the civil law, produces those judicial mistakes for prolonged periods of time: it can take years before the parliament goes back to the same topic, or one judge raise a constitutional exception. +In the case of the new ([behavioural](http://mfp19.github.io/2015/12/26/Profile.html#behavioural)) stalking discipline, between 2009 and 2014 + +* about 30% of the people abused for investigation purposes - the "misure cautelari" ("prevention measures") described in the ["doppio binario" paper](#art) - were not even set to court after the preliminary investigation: no "fumus commissi delicti". There was not steak, nor the smoke of it. Just the paranoia to be stalked or the open will to abuse of the law enforcement and the judicial system to torture someone. Many of my friends quit smoking week thinking that it was the cause of their paranoias; I disagree; but if that's the case... woooooah... wooooooah... how many chicks felt stalked after a party? To tell you the truth, after the cops came to my house I got pretty paranoid and ... I understand the constant feeling of being stalked. I'm stressed without a clear reason; emotionally unstable; ecc. Weed only calm me down; but sadly I'm not smoking despite the fact that I have two medics in my family - brother and father - the italian law admit weed for medical purposes, but both of them desperately need for me to be declared sick, because of two different reasons bound from the constitution down under the word "family". So they prefer to see me suffer. +* about 60% of the remaining cases were set to court after preliminary investigations resulted in acquittals. +* the 10% of proved stalkers, showed the failure of the policy change, for facts that were already effectively managed by the law enforcement trough unformal warnings and formal restriction orders. The old grandma recepe is there for a reason. +* the stalking law - that superseeded the old grandma recepe of unformal warnings and formal retriction orders - didn't save women from getting killed (because of the restriction orders): [women themselves assert no murders reduction](https://www.change.org/p/la-legge-612-bis-stalking-non-tutela-le-donne). As I said many years ago, there's the need of more public dorms for endangered people (male or female), not Consultative Psycho Sales. Better to live in a prison-like place than "to die or to sleep. No more." (the dignity that Shakespeare express here is ... ethernal). +* the stalking law was restricted, by definition, to the cases of pre-existing love affairs (fuck friends, engaged, married): what about the investigative journalists? Private detectives? Hackers in march? We, hackers, knew we couldn't make anything for it since 2009: my lawyer&girlfriend - that in 2010 sued me - explained in detail the crap behind the law; another lawyer explained to us all the fictio iuris behind this new bunch of laws (ie: purely information based, no empirism; they all give for granted that the person trust a monitor or the integrity of a paper document). In 2014 the stalking law has been modified to include any case of stalking (not the "love affairs" only), moving the "love affairs" (fuck friends, engaged, married) clausole from a condition to proof guilty, to an increase of the penalty in the case of being proven guilty. That, in turn, limit the chances of journalists, detectives, whistleblowers, solos, to investigate (ex: "why my roof is dipping? Let's have a look at my neighbours' habits"): a modern Newton could get arrested because the apple tree was in the neighbors's garden, and the neighbor's wife felt observed when she lay naked close to the swimming pool. + +At that point, dirty deeds have been made to avoid a waterfall of new trials for reimbursments: the whole stalking discipline was introduced to save on judicial costs, the open fail (and its reimbursment) would invalidate this effort and openly show the failure of that policy, and the failure of the people that produced and signed it; people that have already spent the public money for their activities. Activities that the constitutional court already turned into crimes: why those politicians are not in jail? It happened for immigration&drugs ([Bossi-Fini Act and Fini-Giovanardi Act](https://en.wikipedia.org/wiki/Gianfranco_Fini#Government_experiences) laws as well; and in both cases the texts of the laws were dictated from the American Chamber of Commerce in Rome (as well as the trademarks/copyright/patents reforms passed a few years before; evidences already disappeared, can't link anything). + +> confusion of the defense of the accused, with the defense of the crime definition itself + +is created on purpose by MPs defending their parliamentary acts, and the way they allocated the public resources. There are plenty examples on YouTube, and some of those videos have been pushed under our - activists&hacktivists - eyes only, [relying on the tracking capabilities of the tools in use by the police forces](http://mfp19.github.io/2015/12/30/NotActivist.html#connections). For similar political reasons something similar could happen to Freeman standing in any common law system. And it happened already: the suicide of Aaron Swartz shows clearly the hammering process before the suicide/murder. + +## One case of empirical evidence: mine! + +I understand perfectly lawyer's call to arms - and Aaron Swartz's struggle - they are right about the awful results: courts turned into hammering machines instead of houses of justice for any et all. But they keep escaping the technology paradigm change - from pen to computer - as well as the other law practitioners (public prosecutors, judges, etc). Basically they are forced into failing procedures and solution providers are underachiving, producing a continual public expenditure without evolution; no benefit. + +In december 2009 I took my ex girlfriend (lawyer) at the public exam to get the lawyer license; I've spent 2 hours of my life that early morning, in the queue outside the building together with other 500 of them, in order to deposit in advance (for anti-cheating checks) the 30 kg of books they need to do that exam. +The books they need are the law codes only (100 grams); but they spend hundreds of euros to buy the fully commented version of the codes (30 kilograms: I pushed that trolley myself that morning! 30 kg). This creates two problems: the authors of the not authorised books sell less; who can't afford the full commented versions of the codes isn't on par with the rich ones. + +Then there's evidence: an Amazon Kindle cost 59 euros, but they are not allowed to use it; the idea to provide pre-serviced devices at exam time instead of checking a ton of BYO books each time is very far from the institutions governing that procedure. But let's go on with the story. + +That day, the more I was looking at them, the more I was nervous: "are those youngsters our lawyers? I mean, fully conscious, 100% prepared, 2-years mandatory tracked practiced, lawyers? I must escape this place. The level of environmental idiocracy is too high". +And that was not even a courthouse; it was just an expo area where the government run those exams each year; when I saw the courthouse the year after, I got ... honest intimate fear: same fancy people around a few cops and fewer handcuffed beefs. It's just, unjust. Someone call "monkeyhouse" the prison; I call "monkeyhouse" that place, the law department at uni. At university time some of them are brought to a jailhouse for visiting purposes: don't do that, lock them in instead. Before is too late. +One time, after leaving from a party with some of them, my gf to me: "Those are my professional society, you can't assault them like that!". Professional society? Assault? I've just tried to explain to a bunch of spoiled brats - that in theory, according to their certificates, should be more skilled than me on this topic - the difference between the function of the words and the words themselves; and the more I was digging into the topic the more they were interested at my fancy quotes, instead of their function in the current discussion. This process usually leads to deeper and deeper philosophy, chronicles, ecc. You start with the trendy comedian joke of the day, and you end up with death sentences issued from mafia boys; or viceversa. But I didn't assault anybody; the semantic value of my words probably; my body not. I just go emotional; have a look at someone in the death row once, and then you'll be too. +But again: how could they perceive the difference from my words and their semantic value if they consider an assault any deeper coscience? Who enabled them to work in a courthouse without being able to feel that the jail itself is an abuse? We, every kid, study Cesare Beccaria at high school; how do they forget it? I can forget it; they, lawyers, CAN'T! + +The ones that today - five years later that morning and that party - are calling for a strike, might be some of those insignificant spolied brats I've seen that morning at their public exam, and I've "assaulted" at that party. + +When I've been clamped down (by the cops, on demand of 2 of those lawyers!) I was on the point to prove that there has been continuity between the "6 politico" - en. "a C for all"; a motto that closed the 70s university riots by making everybody pass their exams producing fake bachelors, masters, ph.ds - and the next generation; expecially in family-driven professions. I could prove, even granting the benefit of the doubt, at least 40% of all university level italian certificates were ... unconsistent; in other words: 40% of our upper class, underachieving. And I've already collected all the procedural changes to fix that. I started this personal research 3 years before someone tought that I could be stalking my girlfriend because of her golden pussy; at the beginning I was following the careers of some engineers but ... the law practitioners were both more ridicolous and more urgent. The 2011-2015 papers describing a filthy judicial system is just a generational confirm of that urgency. + +And this decadence, this intergenerational continuity - in place mostly because the lawyer profession is granted by having lawyer parents - could be broken by introducing new procedures so that the family ties would not be able to push those compulsory monkeys in front of our faces (the bloody day we need one). She, my girlfriend, couldn't do it; she hadn't lawyer parents. I could make it instead of her, for myself, et all: backstab the father. The one that enabled those idiots to be lawyers. That is the same father that enabled many IT guys like me, to serve the lawyers, the prosecutors and the judges, the broken IT systems that they are using. +The main reason why my lawyer girlfriend and I split, she sued me, to protect herself - and her law professor: in the italian judicial system to prove corruption of the "rule of law" both the parties must be proven, or none - and my lawyer quit as well 4 years later, is that them - the lawyers - keep spitting the same old latin sentences (it. brocardi) that Julius Caesar was spitting before getting stabbed by his son: dura lex sed lex, ignorantia legit non excusat, and so on. Those two regard the limits of the law from the accused perspective; it's their way to massacre a (still) innocent, in order to self-elect necessary part of the judicial procedure. + +And if they don't; or can't; who is going to fix that? + +It doesn't matter what the case about: administrative, criminal, civil, whatever. What they consider to be "tools" are those old latin sentences that properly identify the concepts on top of which the legal system is built. Words, not the pens and the papers. Words only; the computer is just a washing machine, and the pen just a words painting tool. Pidgeon Lawyers; it can't be; not the lawyers. They can't confuse hardware and software. The 2015 version of those (new) bullocks continue, about the pens and the papers + +> the way fundamental technologies are in use today is an ambigous and irrealistic relationship with the judicial procedure. + +The judicial procedure is what have to be changed; but they are right, the technology they are mandated to use is simply irrealistic. They identify one issue: instead of "adding value to operations" they are forced to use technology to increase the "economic efficency" of the judicial machine. Instead of producing a paperless digital version of the documents to increase efficency, they are forced to be passive spectators of "remote proceedings" trough videoconferences and the disappearing of the accused ones from the trial. And they are right, but still ... words only. And in 2015, just bullshit: they probably are complaining that using an iPhone to take a picture of the university schedules was easier than opening a pdf produced by the courthouse; instead of complaining that the courthouse is using a pdf instead of an hashed plain text file. In 2010 I pushed myself into their judicial shit - HANDS-ON HACKERS! - and in 2015 I can't accept their complaints. + +The perception of "value added operations" is exactly the same existing 20 years ago, when, at the end of the 90s it has been introduced the chance to have a digital copy of the judiciary documents: the whole digitalization process was so bloated by their law procedures, that at the end of the day there was the need of 400 euros per CD/DVD of documents to cover the digitalization costs of the public administration. +And you can't imagine what's inside those DVDs! I'm not talking about pictures of murders and other stuff that you don't really want to see; I'm talking about the tech side of the story. Once my gf, during her apprentship period, got me one of those judicial DVDs asking how to search something inside there. +Let's not talk about the fact that they were using an 80s tech to carry that information; at the time that procedure was made, the CD/DVD media was the only one, easily accessible on the market, able to grant integrity because the media can't be burned twice (ie: the content is an original clone of the master inside the courthouse archive). +And let's not talk that there were no anonymisation practices: me, the lawyer assistant, shouldn't be able to read the names, the places, etc. +Let's talk about the files on the media instead: er432c2-1, fd46e2as, ..., index.html. Inside a maze of nested folders. The content of the index.html: "er432c2-1, fd46e2as" (each one linked to the file). +Her request: "I need the picture of the dead body". My answer: "well, open Finder (MacOS X file manager) and look which one is the dead body one!". Her reply: "They are a thousand pictures! It takes me 30 minutes to find that one!". Answer: "Ok, but you need to call the coroner, not an IT Guy!". Reply: "I called my IT boyfriend, not an IT guy!". Answer: "Thank you Horney, I like to be your superman but ... I'm not a magician and my laptop is not a time machine! Tell your senior that he can buy a pattern recognition software to scan and tag those pictures so that the task is brought down from 30 minutes to 10 minutes each time; then call the lawyers association and ask them to push on the coroners association to make them write a small tag to the pictures at production time". Everything arguable, as usual; the point is that tagging is an activity that increase the amount of time the operators are in need of. And scanning the paper documents too. So that at the end of the story the DVD cost 400 euros, the paper version 14,62 euros. +The point is not the 400 number (if the high costs are properly accounted and billed at the end); and is not the huge amount of time to search evidences to defend yourself (if the judicial system serve you the data to do it yourself and the people to assist you). The point is that all those ifs in between parenthesis are not matched. + +In 2010, after 3 years of struggles to access the judicial system, I went to get my documents to understand what I was accused of. I had no money at all. Just 3 euros for the bus ticket: 1.5 to go, 1.5 to come back. I had to leave my driving license to the kind tobacco guy in order to buy 14,62 fucking euros of fucking duty stamps to know the fucking allegations I was fucked with. And go back the day after, all the way trough from my little town to Rome's city center, to get back my driving license, spending another 3 euros. And the day after to send 2 kg of paper to my lawyer in another city: by using paper instead of digital docs, I couldn't send those docs to my lawyer by telecommunications, saving money. And I was with that lawyer because he accepted to freely endorse my case. +So the lawyers are right: that use of technology increase costs and extern those costs on the weak part of the story, instead of adding value to their job (defense). But five years (2015) later I read, again, the words "value added" instead of "cost added", despite the 20 years already spent by (some of the) 3 millions italian IT guys telling those fucking law practitioners that they were messing up because instead of changing their procedures, they changed the computers! + +Back to the story. The same day of bartendering my driving license for the duty stamps mandatory to access the allegations pending on my head ... I've been assisted by a cute old woman that worked as paper-documents-pusher between two rooms far about 25 meters from each other. One room was the documents registry, the other room was the photocopy room. The procedure works like that: the registry's young woman handles the master files to the cute old woman, she puts the master files on the trailer then pushes the trailer to the photocopy room, and once in the photocopy room she gives the master files to the young photocopy woman. +Now, give up the detail of the two young women sitting behind the armoured glass barrier, comfortably pushing buttons on the keyboards, in an air conditioned environment, and the old woman doing the hard job all the day long pushing the kart up and down without pauses in the hot corridor; that's already enough to invite the old cute woman to get a coffee with you, and use your smartphone to trigger a bomb that blows the entire building while you are at the bar with the old cute woman talking about her cookies recepe, to kill everything inside the courthouse except the cute old woman, and setting both of you free from that burden. And give up also the detail of me bumping all around the trailer like an idiot rabbit because I was nervous to know why the hell 4 cops broken in my place a few days before. +Focus on the big picture instead. That Rome's courthouse building is nicknamed "bunker room" on newspapers because it is the court where many of the big mafia trials occurs: the security measures inside there exceed the standards; there are no physical threats (theoretically). +The two rooms (archive and photocopy) are 20 meters far from each other, the maximum utp cable lenght is about 90 meters for both civil and military standards. But in the bunker room of the capital city, in 2010, there are no cables between the registry room and the photocopy room. There is a old cute woman pushing a kart. +And I swear, I thanks whoever hired that old woman in that place because I couldn't make it without her! She has been the only one to explain what to do in there! All the others inside the offices: "are you a lawyer?", "No", "Are you a student?", "No", "Who the fuck are you then?", "An accused one but...", "Fuck off then! We are busy". The lawyers talk about "disappearing of the accused one from his trial". Here you go. + +This was in 2010. In 2011 Berlusconi was thrown apart, Mario Monti popped up from nothing and nominated Prime Minister, then Letta and Renzi. In this time frame they tried to enforce new rulings to produce an administrative/civil electronic procedure that failed miserably because some law practitioners (attorneys, prosecutors, and judges) were refusing those electronic tools. The law for civil trials switched from "paper work with digital courtesy copy" to "digital work with paper courtesy copy", result: a nuclear detonation. Some lawyers got busted because of their digital work, some others because of their paper work. Some people got busted because their lawyer's devices couldn't read the (security ennanched) pdf files used in court. Some courthouses issued a new internal policy to override the public one, to repel the fucking rebel lawyers: rebels to the local policy, loyal to the public policy. Lawyers more loyal to the rule of law, than public prosecutors and judges! And they ended at "tarallucci&vino": who must pay for the courtesy paper copy? The courthouse or the prosecutor office? Probably the accused ones are still paying 14,62 of duty stamps to get their paper work. And the rich ones 400 euros for the DVD version but they don't have a dvd player any more: they do it just for fun. + +We arrived (alive, surprisingly) in 2014: I went to my embassy in Bangkok to ask for having a certified communication with the prosecutor office in charge of my case because my lawyer disappeared and I didn't trust the one introduced by my mother; a nice guy but his last words were the same ones of the previous one: "dura lex sed lex, ignorantia legis non excusat, sorry but I don't want to go into the direction you pushing for". So I don't need him; another clone is useless; just the number 4: my girlfriend, my girlfriend's professor, my first lawyer, my second layer. I was dreaming of [Piero Calamandrei](https://en.wikipedia.org/wiki/Danilo_Dolci#Tried_for_libel), I got a clone of Ally McBeal, 3 clones of Perry Mason, and I'm pretty sure that If I ask for a military court I get a clone of JAG. There's more courage in a brothel. + +Anyway... life goes on. In dicember 2015 I acknowledge from that lawyers's union call to arms, that the government introduced videoconferencing for special cases. That is what I asked for in the embassy one year before. + +Those fucking lawyers are complaining for it and, as I said, they are right: the reason why I saved sub-penny after sub-penny for a few months, in order to be able to go to Bangkok from the small village I was, is that ... I was having someone monitoring my private talks with my mother, the new lawyer, and anyone else, about those issues and everything else; real-time monitoring: the camera driver was resetting (and the light blinks) at the beginning of every call. After a year or a bit more, every time I was pushing defence elements into the conversation they (cops? militaries? some IT guy playing the cracker game?) were even actively trying to skip defensive evidences. So the LED close to my laptop's camera was blinking everytime there was the need of more footage, but not the one that included "uncomfortable evidences" (ie: that my story come up faking other's stories). +All this during the 2014-2015 investigations of the Mafia Capitale scandal that those lawyers are using as an example of fair trial destruction: basically when the right-wing Rome's mayor Alemanno step down in favour of the new left-wing mayor Marino, the new council figured out that some money went missing into fake charity foundations, civil associations, work cooperatives, business companies, and around the world as usual. +One of the friends I've been talking with in Rome at that time was working for the head of Rome's provincial police; one of the policemen arrested in that scandal, and probably the most important deep throat of the whole investigation. It's just normal: a 12% GDP nation wide scandal in a 4.5 million people capital city, makes some of your friends working in one of those companies involved in the scandal. +And I have friends here also: some of them came here years ago with all their savings to escape from that shithole we were living in, some others got money from companies and public programs to foster international relationships. One of them, a few decades ago have been involved (sentenced and cleared) into some kind of tax fraud investigation for being one of the stakeholders of a company having some criminal stakeholders as well; in november 2015 came to me upset telling me this story and I was ... worried, but laughing, because I didn't know why he was telling me. And go figure what else the others might have done in the past. So the "follow the money" investigation practices thrown that shit on us as well. Any you can imagine about: from being named "spy" from an israeli friend, to being named "spy" from my embassy's officer, and being confused with an israeli after; threatened of death multiple times; being named "big boss", "mafia capitale", "schiavone" (a mafia boss shoot down a few years ago); having fake profiles in Facebook and someone talking to my friends using fake instant messaging accounts. I've been dressed, redressed, etc. In every other single individual's mind. +Probably according to who was making my Facebook's profile; the one I've never had. Or to the ones that overridden my video profile on YouTube with fake videos (some probably made in my grandma's house I left in 2005; but the videos might have been made around 2014, in any case after 2007... I've never made a video before; I've never had a camera before!). I don't know exactly what you can see outside [the APNIC area](https://en.wikipedia.org/wiki/Asia-Pacific_Network_Information_Centre#Economies) but the whole thing is pretty scary; it's 5 years that I get hammered with that, since the cops stolen (but they prefer to say 'seize') my memories. All of them! The difference between a seize and a robbery is that the seize leaves you a receipt (that in the case of computers is a bit more complicate but ... a sealing bag and the receipt on place would have been appreciated). So I spreaded those memories around the world: there are exact copies of the stolen memories on disks around the 6 continents. The copy contains - a part from my personal stuff since I was a kid - a copy of the whole italian population 2005 tax revenue (leaked in 2007 on eDonkey; integrity have to be proven but after a rapid check looked good to me), an american anarchic manual downloaded from Geocities in 1997 (I tested some of the bombing recepies but not the killing, raping, ecc, ones), pointers to some tape backups (I've been told having the entire italian 1999 stock market), but no porn ... sorry guys ... I'm not a collector. Anyway, if you find it, it's my stuff; and don't bring it back! Someone will kill you before! Or after! And don't publish it! Probably those files are already hashed (ie: identified) a NSA facility somewhere in Italy, Germany ... (add random countries). Dig a bunker, to keep it safe! I don't needed it. They screwed me anyway. And I have my memories, the ones I love, in my mind. + +So the layers are right: someone is abusing of his control over our private communications to make up their stories; publish them (triggering more public mobbing on the victim); and whatever. But they are also wrong. + +The reason for me to go searching for my closest embassy is that my embassy, in 2014, is supposed to have extraordinary communication tools, to support their legal operations, included citizens's judicial procedures. In the embassy, by disposing of my body, they can ID/Process/Arrest. And they carefully avoided that. The prosecutory action is one of the two top sovereignties of any order, administration, country, nation; and italian institutions are not able to execute it. + +One year later (2015) those fucking lawyers talk about "value added" (ie: "cost added") instead of asking for text files, mime encoded media content, and hashes to certify and remotely confirm the genuinity of an act: the cheapest way to implement a courthouse, a paperless judicial procedure, and a remote judicial procedure, at once. Same judicial value, less cost. And all those tools - real tools, not just words - exist since the 80s. Bitcoin and it's blockchain, as well as Ethereum, is just a new smart repacking of the same tools. + +Because of these reasons, and because from the lawyers perspective I'm enough law-ignorant to need them between me and my constitutional born 'natural judge' - the officer in the embassy: "it's my job, I'm a lawyer and a public officer: why you did those things?", "Mem, you are the embassy frontdesk officer, not my natural judge: the one I'm trying to talk with" - I end up this story of my life with another story of my life. At least, at the end, after reading a lot of crap that probably won't make the italian judicial system any better because they don't have IT Guys instead of lawyers in their offices, there will be a smile. + +When I was 'barely 18' I used to make fun of Apple-powered designers working in my office because they had one button only on their mouses. A bit less then 10 years later I was using an Apple iBook because of its processor (IBM G4) and its Openly-Repackaged-Free-Software-Made operating system; and I appreciated having one button only on my mouse: I'm a console guy, the windowing environment is just a comfortable add-on and Afterstep... ehm... Mac OS X was very comfortable. +Within 1 year The Newly Steve Jobbed Apple started the iTunes Music Store and removed the file sharing capabilities of iTunes; another year and the IBM cpu was gone too: I've found myself entangled not only back into Intel's crap, but into Apple's crap too. From one thing - my memories on HFS+ - to another thing - using Final Cut Pro for my video experiments - it took me about 7 years to get out from that proprietary shit again. Saving 1 euro, by 1 euro, to build a decent info system at home, completing on-going activities to carry on, family troubles, divorces, etc. +I've spent the 2009 saving money to pack a cheap charlie server under the roof of my house to make it unaccessible to robbers (and it worked against the cops instead), consolidate all my memories (including showing my childhood toys on my laptop's camera to dematerialise them, in order to be ready to move out from that insane place at first chance). And at the end of the 2010 memory consolidation process, guess what? Searched&seized at home: my entire memory since I was 15 years old stolen, exposed, and at risk of deletion (note: the judicial standard procedures of the time involved the deletion of the seized memories). And it took another 5 years to get rid of all those Web puppies, the Big Data puppies, the italian Chopstickers2000, and the rest of the + +> profiteering gluttons + +Snowhite was luckier with her assignment: to take care of 7 very-small-sized bavarians it is waaaaaaay simpler than commanding 8 billion people to keep their hands off My Internet. :) + +Note: I almost forgot to report the promised accuittal evidences. Eheh, sorry. Despicable me. My Minions have been terrible recently so I got A BIT stressed. Evidences are two: + +1. In the atoms world: you can start from my birth certificate, going all the way through my life and find thousands of evidences that I've been working for privacy in the digital era; one example: the italian privacy authority ("Garante per la protezione dei dati personali") archive have plenty of my name in it up to 2003. Then the government changed the law (renovating the same act every 6 months to bypass the parliament) to open wild marketing calls and we couldn't act in court any more. About the specific case all the 'episodes' mentioned in the court papers have a more plausible explanation; and Occam's Razor is a primary tool. Every single time I popped up in front of my ex-gf was to confirm the ongoing intergenerational corruption story of my country: once I went to her work place to confirm that she was working in the university thanks to the public exam she&professor faked, twice to confirm that her Facebook profile was part of the Partito Democratico's agenda, and after I figured out that someone was making up the stalking story, once to trigger the court/cops/whatever-will-be-will-be. I couldn't afford to cite myself. And all those episodes, packed togheter, configured the crimes to the eyes of those, and only those, that want to see one. It is a bit more complicate than that - and I've been a bit more nasty using YouTube to PASSIVELY trigger reactions (ie: I didn't push the videos; they were a backlog only) - but placing everything on a timeline would prove me innocent (and her guilty of abusing of her profession; the italian lawyer's union to kick her out; and probably a courthouse to make her paying all the costs... up today). + +2. In the bits world: the italian version of the european data retention policy mandating the telco companies for 5 years of telephone backlogs to be kept was in place. And there are no telephone calls to her home; nor emails to her workplace or whatever. Pretty weird for a passion criminal. But that's not evidence even in the fancy behaevioural world. The real point is that the stalking law of the time was mandating (in order to prove guilty) that the vitcim had to change habits, and after receiving hundreds of messages from me she changed her telephone number. She first tried to record a conversation using her mobile phone (the same I did catching her talking about her fake exam at uni) but ... her friend agreed with me and she ... almost strangled herself when her friend agreed, so I noticed the way she was holding her smartphone exposing the mic, and realised the trick. She was recording. After I started the wild SMSing to trigger the case in court: it was a good chance to (also) force the telecom companies to do their job (ie: filter out spam instead of producing it for business purposes). And for the people to stop bothering about (one kind of the) "Internet Stalking". Again, things are a little bit more complicate than that but ... placing them on a timeline makes sense. No need to say that I've never made a porn movie; not with her, nor without; but, actually, if you find one please... please... I pay you for it! I want to place it on the blockchain to be sure that my memories don't get scrambled by mobbers :) + +Since then I haven't been able to find anyone both able to understand (because of his law education and tehcnological experience) nor anyone willing to spend enough time to check my background, the empirical elements on both the atoms and the bit contexts, and place all the elements on a timeline. That's in theory court's job. + +When I say that I'm a white collar slayer, there's a reason. And when I say that the cyberspace is my love ... there's another reason. And when I say that I'm an idiot, there are plenty reasons. Probably the first one is that I never made a graph/picture/draw of all this shit... in italian we have an old joke we spit in the face of anyone that look like didn't understand what we've been saying: "do you need a graph of it or words are enough?". I should have made one. + +# Do + +Other Freemen I don't know. [Personally I'm not standing because the law was malformed, the law enforcement not brave enough to discuss it, and the court didn't deserve its role](http://mfp19.github.io/2015/12/17/Constitution.html#hacktivist). +I spend must of my day sitting on my ass studying some IT stuff and writing this "tools". Coping with the compulsory immigration rules of the place I'm living in. At the beginning I was waiting - the italian judicial times: years, not days - for my lawyer to make me talk in court - because I didn't want to reveal the trick before using a telecommunication tool - when he quit ... just living, searching for another way to clean up that crap, get my reimboursement, and leave that shithole for ever. Not only the place "italian peninsula", but also the administration that sit on top of, and massacres, that land! + +So yes: **I'm some sort of standing**. In a modern way: sitting because I couldn't find a court for standing; and not to the blood because I'm not a military. I searched for international courts in order to have UK-like common law procedures, using the italian previous cases to fill in those procedures: it is the trend that those lawyers are complaining of ("continentalization of the civil law system"). And I searched in vain. But I guess **I can stand both in a UK court and in an italian one: being judged two times for the same fact.** [It would be fun to challenge both those Lords of the Law, using a time-division atomic principle](http://mfp19.github.io/2015/12/20/Timeless.html). + +It isn't fun because they - law practitioners - don't take into consideration the sub-artistic reasoning. [Protocols](http://mfp19.github.io/2015/12/31/NotPublish.html#publish). It's pretty scary indeed. The lawyer profession was started at a time nobody could read and write; the very few able to do it were selling this capability in courts (lawyers), banks (accountans), and streets (ex: writing letters for the poor people): they were pen&pencils technicians. What are they today? + +Example: a telephone call is built on top of two legs, caller and called, one initiates, one receives. Any caller can be barred, filtered out, both network side and called side; the stalker can be filtered out without even telling him. And without the need of data retention policies to judicially assert the facts ex-post. Easy, smooth. The internet works in a similar way up to TCP/IP (it's just a bit more complicate to understand). But if politics don't want for courts to go there, they won't take this obvious empirical fact into consideration. And it is worse than that: if the offender caller set himself anonymous, they would start to mangle the issue from the legal perspective... using words... and pencils... artistic scam, AGAIN! + +It's not simply underachieving. It's a forced whole community suicide [Drinking Kool-aid](https://en.wikipedia.org/wiki/Drinking_the_Kool-Aid). The world evolved (and demographics scaled) thanks to the uses of these technologies too; by walking backward like a sea-horse - and forcing us all to do the same - without waiting for a natural, peaceful, reduction of the human population ... they drove us, at high speed, into a gallery where a drunken oil-truck driver just hit a fireworks truck. And this is jurisdiction-insensitive, it has been a global process: country more, country less. Now look at my Google+ profile and ask yourself why it is indexed in the wrong chronological order: I didn't make it like that. Who mangled it? Then spit on your Google device. And search my name in it and ask youself why the first post coming out is a 3 years old post calling for amnesty for ex-private Chelsea Manning. Not all the soldiers are able to wave their scars from their souls; and not all of them can think to the idea that one of the military contractors' laptop could have gone lost during the war operations (leading to the leak of 'Collateral Murder' videos: Manning might be innocent). To not even mention that sometimes even the ambassadors are killed: don't shoot the fucking messenger! In other words I could be dead by now. + +Politics apart: in the UK system my case would result in a new acquittal case because of the empirical evidence, in the italian one in a constitutional exception that would partly abrogate a law. My problem is that the italian judicial is deeply broken; I can't bother the english judicial; and the international courts are malformed, not recognised, have much worse issues to fix (ie: murders, refugees, terrorists, etc), or simply don't take into consideration italian cases because the italian system didn't make its part at first producing an amount of human rights abuses too big to be processed. + +Otherwise it would be fun. Someone says "Biting the pillow", i prefer "Keep Standing". + +No "double track"; no "doppio binario". [Non bis in idem](#rationale). + diff --git a/_posts/2016-01-06-Epiphany.md b/_posts/2016-01-06-Epiphany.md new file mode 100644 index 0000000..66b3c1d --- /dev/null +++ b/_posts/2016-01-06-Epiphany.md @@ -0,0 +1,481 @@ +--- +layout: post +title: Epiphany +author: mfp19 +--- + +Tags: [index](#index) [structure](#structure) [corruption](#facebook) [_this](#epiphany) [btw](#btw) + +Once [the merge is done](http://mfp19.github.io/2016/01/01/Standing.html) + + + +there's the need of something that closes properly the previous [synthesis](https://en.wikipedia.org/wiki/Synthesis_anarchism) before going back, in the next years, to incrementally clean up and expand the whole repository and turn it into a clear and comprehensible english lecture. There's the need of another synthesis. + +Any time I get this feeling, my mind goes back to 1 hour spent with James Joyce's nephew in Dublin; he was having weekly Free lectures at Joyce's home to help young students in decoding the [Ulysses](https://en.wikipedia.org/wiki/Ulysses_%28novel%29). Odisseo, using the greek name because I always say of myself to be greek to the ones that want for me to be christian (ie: I don't like the game of came first; whether it is the patents law, the religion wars, or whatever). I wish I had the chance to understand their language. When I left that place I had only one tought: "I didn't understand anything; but one day... oh yeah... one day... I'll read the Ulysses too, and it must be in english". And walked away with an undefined good feeling in my heart. Once back home I bought a copy of it, and I left it on my library for the right time; a time I would have had enough life to understand what the crazy old guy wrote at the end of his life. Another Mission Impossible. Life's too short. + +> An epiphany (from the ancient Greek ἐπιφάνεια, epiphaneia, "manifestation, striking appearance") is an experience of sudden and striking realization. ([Wikipedia](https://en.wikipedia.org/wiki/Epiphany_%28feeling%29)) + +# Index. + +1. [Sah sah sah ... Test](#test). Aug 19, 2015 +2. [Integrity](#integrity). Aug 24, 2015 +3. [Solution?](#solution) Dec 15, 2015 +4. [Constitution?](#constitution) Dec 17, 2015 +5. [Timeless](#timeless) Dec 20, 2015 +6. [Aethernum](#aethernum) Dec 25, 2015 +7. [Profile](#profile) Dec 26, 2015 +8. [Pasta&Ciccia](#pastaciccia) Dec 27, 2015 +9. [Checklist](#checklist) Dec 28, 2015 +10. [Antelitteram](#antelitteram) Dec 29, 2015 +11. [NotActivist](#notactivist) Dec 30, 2015 +12. [NotPublish](#notpublish) Dec 31, 2015 +13. [Standing](#standing) Jan 1, 2016 +14. [Epiphany](#epiphany) Jan 6, 2016 + +# Structure. + +A brief summary per each chapter. + +## Sah sah sah ... Test. + +In this chapter the author - me - respect the tradition to say "Hi" in the most computer-fashioned way. It is a chapter a bit dry. Essential. Zen. + +The tradition predates back to the oscilloscopes tubes times, when ageing scientists used to get excited for turning a light on. A light that could be the detonation of the first nuclear bomb (without the feared chain reaction that could have burned the entire atmosphere), an hatch opening on the first lunar landing vehicle, or the statistical presence of the Higgs' Boson in a Large Hadron Collider made out of 9 nuclear power plants and an information system never seen elsewhere before. Lights that indicated respectively: survival, hope of future survival, chance to make that hope true. But normal people can't understand why a light can make navy officers and scientists [excited](](https://en.wikipedia.org/wiki/Jackass_Presents:_Bad_Grandpa)). + +In this case we are observing a common case of post-C "Hi" transposed in a post-git and pre-bitcoin era. Did the author want to entirely skip Perl, ColdFusion, Java, PHP, Google, Facebook and RoR? (I'll wait the next 42-47 years for a a future archeologist to solve this dilemma, and a UIkipedian to stick a quote here in place of this sentence.) + +Probably the author should have titled "Foobar" instead of emulating a mic test; but the mic test keeps the door open to change a lecture into a speech, worst case: after a thermonuclear war computers doesn't work any more and someone have to tell good night stories to the kids! + +## Integrity. + +> In information security, data integrity means maintaining and assuring the accuracy and completeness of data over its entire life-cycle. This means that data cannot be modified in an unauthorized or undetected manner. ( [Information Security](https://en.wikipedia.org/wiki/Information_security#Integrity) ) + +Findings: + +1. Without documents integrity there's no reason to produce documents: birth certificates, driving licences, diplomas, police reports, court orders, banknotes, property certificates. Any could be fake. Think about one of those, one only, to change every time is handled to the next hop, so that one person see something, the next see something else, and so on, until the last one issue a death bounty truly convinced to have made a righterous sentence. You've got Facebook in countries where hearsay trigger investigations and there's the death penalty at the end of the process. Something so obvious that I feel shame to have abused of your time by using 5 rows of text. +An example of the chance that a document could be manipulated ex-post, is the pdf files after introducing in their specs the chance to link to external resources (early 2ks?). In a blockchained version of the same documents, this can't happen because the ID of the following document is a result of the contents of all the previous ones and their moving; there's no way to fake them all, and there's no way to validate a fake one ex-post. Even torturing the small IT guy, he can't do what has been asked for: any attempt to crack one of the blockchained docs would trigger a waterfall of errors that in turn would trigger an unpredictable waterfall of alarms. Any message corruption would result in getting busted faster and harder by an unpredictable amount of people. With the exception of professional killers, mafia boys, and their lawyers - because it takes longer to figure out they can profit from it as well - the rest of us should be in the streets asking for the blockchain to become true. One only request to our governments. And it didn't happen: why? + +2. Unfortunately our devices can't grant message integrity: by using blockchains on top of unsecure devices we could produce something even worse because any Anonymous owning the device can assert whatever in the name of someone else (and the judge would give it for true, because his IT Guy tell him that the system is perfect, and [Titanic](https://en.wikipedia.org/wiki/RMS_Titanic)'s engineers said the same thing). As well as currently existing multiple national interests (ex: one per country), togheter with business assets (ex: all the companies concurring in the same market), produce a world legal framework impossible to decode: in some countries (notably USA) militaries inject bugs in the companies's products because their legal system was built on top of those surveillance practices; for them is just NORMAL administration, in a well established system able to arrest 1 person every 40 seconds even for minor crimes (ex: mariuana); performance wise, simply impressive. In some other countries (ex: Italy), by not having the companies at home, governments can't policy the companies producing our devices to push state surveillance, so they rely on "cloud services" (ie: accessing data in a "unauthorized or undetected manner" and moving data in another jurisdiction, example another NATO country), and contractors to produce in-home spying tools (ex: Hacking Team). Plus psychologists in courthouses to scrap any defensive evidence (relying on preliminary elements preventively spyed on those same devices, only). Others don't even attempt to spy: their cops break at home, seize the devices, and eventually torture (ex: jail before fair trial) to have the passwords. In every case the result are devices we can't trust (see [resources](#resources) for a summary of the past years). And this is an overall blocking problem not for commercial reasons, but for evolutionary reasons. We developed those tools in order to scale up to 8 billion monkeys: we simply can't live without anymore because our performance would be underachieving. The continual, parallel, attempts to bypass the technology - by any non-techy - is preparing a war big enough to quickly decimate the human population. + +3. The italian [Laziogate scandal](http://unamericanaaroma.com/2012/07/23/to-rome-with-dignity/) is a good case study because it is smaller than the whole story of "message corruption", and concerned the illegal access to ... central public register of births (!!!) in order to ... win elections (!!!): the most important registry, for the most sluggish cause. The scandal itself is just a small insignificant detail emerged from the ... explosion of the old italian internal security agency SISMI: [SISMI and CIA kidnap a muslim imam in Milan](https://en.wikipedia.org/wiki/Abu_Omar_case), some kind of shortcircuit between black ops and judges prompted the [SISMI-Telecom scandal](https://en.wikipedia.org/wiki/SISMI-Telecom_scandal) in which about 5000 VIP people, since 1996, were illegally surveilled. If you keep digging you'll find cops, military police (Carabinieri), financial police (Guardia di Finanza), etc, manipulating people in order to trigger the production of fake documents, up to 2007 reform of the agencies SISMI/SISDE into [AISE/AISI](https://en.wikipedia.org/wiki/Agenzia_Informazioni_e_Sicurezza_Esterna), the destruction of the files (instead of having public trials), and so on. So don't dig that season: as the american chick stated on her blog about Laziogate ([first link above](http://unamericanaaroma.com/2012/07/23/to-rome-with-dignity/)): "Usually I could care less about politics here in Italy. You’d need a freaking Ph.D. and then some to even touch the tip of the iceberg in trying to understand it all, anyways". I (sadly) have that "freaking Ph.D." too, and my advice is to just take for good that the whole italian information system was broken: that's the only interesting point about "message integrity". The whole italian story is a fake. Trough message corruption and partisan backtraces (ex: simple untold truths, plausible deniability, etc). A whole story of message corruption. Laziogate just an insignificant detail (of message corruption) involving an italian politician [Francesco Storace](https://en.wikipedia.org/wiki/Francesco_Storace) alleged (and acquitted about 6 years later) of manipulating that very important registry (births&deaths! And I've spotted the prosecutors offices denying data first, and publishing fake data after behing debunked of denying data!). White Collars's High Shit trough the abuse of a centralized registry: the italian voting system required to collect a certain amount of signatures in order to register the candidates for elections, they've been collecting signatures one year only, photocopying them, and re-using the same copies every year; the result was a continual use of signatures of dead people, people that changed party in time, ecc; Alessandra Mussolini forked from Storace's party and he (or someone else) tried to access those registries to mangle the issue and don't loose votes; in any case to not use the same photocopies of his ex-same-party girl. Or go figure what else. But those registries were public! The italian privacy law mandated privacy for private registries only! The problem was that Storace himself (as well as ALL the others) couldn't make this issue public because of the bottom line of using fake signatures to register for elections. I shortened the story a bit; some details are not useful but can be found again for a few more years (ex: the 'public' attribute of a registry was not in the 675/96, it's a detail asserted by the italian data authority Stefano Rodota' at later times, after SEAT-PagineGialle scandal and the proposals to create a public registry for mobile phones too; it's a bit complicate but ... the point was that public registries could be abused with marketing calls, private phones couldn't). +Ridicolous the detail itself. Ridicolous the reactions (judicial included). Ridicolous that he (and we) got a judicial answer 6 years later (just to rehab his picture). It's all pretty ridicolous. +And there's no need to dig that story because in the new exciting season of "Who Wannabe Suverign in Italy?" history simply repeated: after a new shower of scandals (MOSE, EXPO, MafiaCapitale), they just admitted (2015) the failure of the new extraordinary AISE/AISI system that followed the SISMI/SISDE ones. Basically the pre-existing politicians self-elected spokespersons of their parties, pushed their kids in the public ranks, and extended surveillance to anything that moves in spacetime (ie: not just 5000 VIPs), trough the 'cloud services' (ie: accessing data in a "unauthorized or undetected manner" and moving data in another jurisdiction, example another NATO country), making up the entire 2007-2015 public history, judicials included. And many law practitioners - even today - didn't realize it! Don't even suspect the chance for their documents to be manipulated off side track, in their mailboxes, by militaries, the prosecutors offices, Google/Facebook/Whatever officers, solos, or alike. Lawyers, attorneys, managers, use plain text gmail accounts on bugged devices, instead of end-to-end encryption and a public blockchain on armoured devices reviewed by indipendent security escrow companies: a self-encrypted, public, general purpose, registry, built on top of a distributed/decentralized recursively hashed archive. Cops are playing Duck's Hunt. Mafia too! And we are the ducks :) +Nowadays in Italy we can't distinguish institutions from mafia any more, but to be fucking honest, the italian republic should offer honorary citizenship to that muslim guy, and the Vatican should have included him (kidnapped in Milan, transferred to Egypt, tortured, and acquitted!) in their christian saints calendars (if he wants to): San Antonio da Padova, San Daniele di Steccania, San Gennaro di Bisceglie, ..., San Hassan Mustafa Osama Nasr, San [Adamo Bove](http://www.beppegrillo.it/eng/2006/08/the_freeway_overpass_makes_90.html), San [Costas Tsalikidis](http://jimmarrs.com/news_events/news/nsa-wiretapping-whistleblowers-found-dead/), San Edward Snowden. Mandatory minimum: he (unwillingly) help to figure out the entire nation-wide scandal! Peace. But I'm a dreamer... + +4. Did you get why there's no "message integrity" in our tools? A blockchained version of the public registries would not allow those "unauthorized or undetected" mods to public registries. It would not authorize Google, Facebook, OpenID - their operators, the militaries, the fraudolent politicians - and all those websites asking if you want to use one of those registries to identify yourself on another website, to let someone (a Google operator or a public officer) to corrupt the message, any message: birth certificates, driving licences, diplomas, police reports, court orders, banknotes, property certificates. Because they would not own the entire registry. The same for any criminal: the distributed nature of the blockchain makes worthless the idea of tamper it for profit; and the need of a blockchain can't fade out away: in a prison sigarettes are used as currency, on an island shells are used as currency. Indipendently from who you are (cop or robber), you would need to support your part of blockchain anyway. It already happens: some of our industrial system is owned by (retired?) mafia guys. +Go now to have a look at birthdate of MD5, SHA and the other tech the blockchain is made of. And remember that those techs have been considered weapons (ie: ammos) up to the end of the 90s. By pushing those techs trough the most powerfull distributed engine (ie: o'businessah! o'monnee!), the institutions delayed for decades the wide adoption of safe tools; right (ex: pre-existing war issues that forcibly override civil processes, compulsory human development timings, etc) or wrong (ie: profeetering gluttons on command). Did you get why [the hackers manifesto was written at jail time](http://phrack.org/issues/7/3.html)? + +## Solution? + +> Announcing the Open Library ( [Aaron Swartz](http://www.aaronsw.com/weblog/openlibrary) ) + +The (childhood) dream of many, from a martyr: a fully distributed system. This one instead is a (naif) distributed file system + +> InterPlanetary File System (IPFS), is a content-addressable, peer-to-peer hypermedia distribution protocol. Nodes in the IPFS network form a distributed file system. ( [IPFS](https://en.wikipedia.org/wiki/InterPlanetary_File_System) ) + +its financial tool + +> Abstract. A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without the burdens of going through a financial institution. ( [Satoshi Nakamoto](http://article.gmane.org/gmane.comp.encryption.general/12588/) ) + +the new contracts law + +> Ethereum is a cryptocurrency platform and Turing-complete programming framework intended to allow a network of peers to administer their own stateful user-created smart contracts in the absence of central authority. ( [Ethereum](https://en.wikipedia.org/wiki/Ethereum) ) + +Findings: + +1. [Paul Baran](https://en.wikipedia.org/wiki/Paul_Baran). This idea of distributed telecommunication system keep popping up since 1964 because mankind simply need it. No activism, no hacktivism, no politics, no nothing: it's just the most efficient, reliable, resilient way to build a scalable information system; scaling from single individual monkey, to the entire universe. The only weird thing is that there are modern "inventors" claiming patents on this 1960 idea. They keep reproducing the same patterns at different scales and filing patents at the patents office for the same thing: message passing, renamed. From the electron (nanometers scale) to satellites (kilometers scale) it is always message passing and it has always the same solutions. Why do we still grant patents and royalties on patents? + +2. IPFS is a Yet Another Distributed File System with some interesting features: hashing and caching every file, using private devices as a whole data bin. P2P. If we consider the new parallel silicon memories (ex: SSD) - ie: there's no need to organize information in series, to stream it on a tape or a rotating disk - we can easily imagine IPFS to be the only one FS standing in a few years. Look at ZFS for an example of parallel FS (I know... I know... but I like that stuff; it's good jargon). + +3. Bitcoin is a bag containing billions of unique identifiers written on silicon. Digital Cash. In the same way paper banknotes are billions of unique value identifiers written on paper. Cash. The only difference is that bitcoins are bound each other, their owners, and blockchained to the whole infrastructure; the banknotes are bound to banks and govs (and their costs; bloated). Three the problems ahead: our silicon ([our devices](#resources)) is not reliable because bugged ex-ante (by mistake or spy games), bugged ex-post (by mistake or spy games), or impossible to defend (exactly like a wallet on a well dressed person); people can't distinguish electronic currency from digital cash; abusers tend to look at bitcoins value (in dollars and euros) to Wannabe Millionaire, instead of appreciating it as a token (ie: a valid monetary reserve). And of course, it spawned a huge amount of legends. Example: "the chinese got all the bitcoins!"; they are the 25% of the human population, and they produce 60% of the human products... it's just NORMAL for any eagle-eye sitting behind a monitor, to notice that the majority of the bitcoin transactions are on the wires from wherever to China. It would be surprising in the case they were on the wires to Norway (0.1% of world population) or Israel (less than 0.1%)! That's why I called "abusers" all those eagle-eyed people: they confuse the metering tool with the metered distance. And I wonder if those transactions are real: I've been digging a bit in the software code but I was searching for the SHA algo to account the number of ops; I didn't even try to build the binaries. + +4. Ethereum is a very minimal contracting tool suitable for any kind of contract: from constitutions, to business, to marriages. Ethereum sits on top of the huge hash-base produced by the Bitcoin project: the decentralised (not distributed!) nature of Ethereum can overcome some of Bitcoin's current limits (ex: bind financial resources to a single well defined purpose instead of let them go around as universal value reserve). And exchanging "gas" instead of bitcoins overcome others (ex: transaction rate too slow). Ethereum produces a strong registry that can be made public in parts or as a whole, evolved, and metering any information exchange from inception of the contract to the closure. And this metering is (in the same way Bitcoin is) a very predictable energy function. The only connection with the steel&fire economy is electricity. No labor, no money, no other legacy entities: that part come on top according to individual and common laws, traditions, habits, philosophies, religions, languages. I didn't list politics. As far as I've been searching I haven't found any culture on Earth that can't make use of that tool; the only dramatic limits are the judicial practices that involve torture (jail included) and death penalties, but those are sad old well known problems that have not much to do with an information tool. + +5. The developers themselves are warning all around the young age of their projects; nobody at this early stage can assert the integrity of a system. Please, don't take this text as a technological assesment of quality for IPFS and Ethereum: I've only red a very little of their website. I'm just a believer. The day I've money to incept a project or I'm hired into an Ethereum-driven one, I'll do some math to understand the implications of using a limited (huge) set of hashes, and I'll tell you more. By now I just trust the younger reservoir dogs for searching water in the desert. + +4. Finally, code may be law... ehm... still... which one!?!? + +## Constitution? + +> Many forms of Government have been tried and will be tried in this world of sin and woe. No one pretends that democracy is perfect or all-wise. Indeed, it has been said that democracy is the worst form of government except all those other forms that have been tried from time to time. ( [Winston Churchill](http://hansard.millbanksystems.com/commons/1947/nov/11/parliament-bill#column_206) ) + +Findings: + +1. Winston Churchill is one of the men I'd really like to ask if it is worth changing the democracy we had with the one I feel the need of. + +2. Despite the huge differences among the europeans, there have been an all around top-down program to eradicate the europeans' constitutions (and alike) to produce a single (un)overdefined european top-down administration. The chaos level in the judicial systems raised to hell; actually, the hell raised up to Earth. The resulting blockade to access the judicial systems (Justice?) is well-known. The amounts of human rights violations is unknown. The whole process underachieving. + +3. Civil law countries tend to produce and reproduce an infinite amount of useless books and extern (transport, exile) who can read them. Common law countries tend to bash, judge and jail/extern whatever is not in line and in time with the rule of law. The Internet has been used as a tv-enabled washing machine to be placed in front of the shithole in order to watch free Pr0n while sitting on the water closet. As a result the most hybridized systems (notably France) are - sadly, because those are wiser - paying the judicial bill. + +4. Some of the functions of old tools (legacy parliamentary works, and different kind of electronic decision-making tools: LiquidFeedback, Vilfredo.org, ecc.) should be ported into the very last tools popped out from universities and summer camps in order to produce a true mass driven legit safeguard against abuses. One of the hands-on examples of Ethereum is to build up a [democratic autonomous organization](https://www.ethereum.org/dao). + +5. Every single person can spawn its own "constitutional work" using this tool instead of the legacy way I produced mine in 2008. By using the same minimal tool, any future integration attempt with other legal work (individual or group) can be easily merged providing a semantic map: none of those persons or groups are treacherous, because permanently exposed; public. It's the beauty of the technological standards. Previous art: the TCP/IP (stack of) protocol(s) produced trough the RFC system in a multi-stakeholder fashion. + +6. The dilemma between having or not having a constitution for granular well-formed human rights can be considered solved: the Ethereum smart contracts capabilities can make any constitution totally fluid. The questions still open are about its contents only: what can be raised at constitutional level without treading some beliefs and at the same time keeping the overall figure economically achievable? + +## Timeless. + +> One might think this means that imaginary numbers are just a mathematical game having nothing to do with the real world. From the viewpoint of positivist philosophy, however, one cannot determine what is real. All one can do is find which mathematical models describe the universe we live in. It turns out that a mathematical model involving imaginary time predicts not only effects we have already observed but also effects we have not been able to measure yet nevertheless believe in for other reasons. So what is real and what is imaginary? Is the distinction just in our minds? ( [Stephen Hawking](https://en.wikipedia.org/wiki/Stephen_Hawking) ) + +Findings: + +1. The theoretical base is given by a well formed theory (quantum mechanics) and the spectacular Stephen Hawking's popularization of the "imaginary time" concept. It took 60 years to mass distribute the results of the previous big theory, the electron. Don't be in a hurry for understanding the new one. I've been reading about it in the past 30 years with the eyes of a kid, then with the eyes (and math) of a teenager, then with the eyes (and math) of an engineering student, then with the eyes (and math) of a man ... and ... I didn't yet. + +2. There are plenty empirical evidences that show general asyncronicity among human beings: drugs, rapid crossing of timezones (ie: jetlag), prolongued isolation states, etc. Once given - again, in my case by trust not by knowledge - Hawking's words for good, the financial theories can be applied to single individuals (ie: can protect himself from those) instead of groups of individuals (ex: family, nation, central bank, etc). + +3. The blockchain system can serve as a networked stabilizer for any recognised spacetime abuse in the legacy legal and financial frameworks (ex: insider trading and plenty financial products, different kinds of scams, etc). + +4. In the chapter an example is given using some legacy simpler theories and elementary math: "ecu = euro * i", "ether = euro * i". + +## Aethernum. + +> Panta rhei (from ancient Greek, en. "everything flows") + +Findings: + +1. Despite its volatility and the overal problem of having secure devices, the Bitcoin is a well established monetary reserve. The Ethereum Foundation bought bitcoins (value reserve) in order to sell Ethers. The Ethereum blockchain uses "gas" (a fraction of Ether) to account its operations and permanently register exchanges between miners and contractors. The unit "gas" is electricity, an implicit duty stamp to reroute every technostructural cost back to natural resources management without the need of human intervention (ie: frauds, slavery, ecc). The website is pretty childish but the concept seems valid both for information work accounted in the time domain ( euro = (ether * t) / tau ) and atoms work accounted in product units ( euro = (ecu * shoe) / tau ). It's pretty simple: who chat more, pays more. For fun or for profit doesn't matter: must pay for the electricity spent. The SMSs on mobile phones were similar; but instead of paying 15 cents per sms (160 chars) to buy Telecom Italia's manager's cocaine and ENEL's manager's cocaine, you pay ENEL's manager's (more) cocaine (only). It's a step forward. Maybe, one day, instead of looking at all those european worthless policies to remove operator's fees and Regulate The Market, we'll see an european policy to remove the managers and Regulate The Europeans. Issue solved. But until then, think positive and be happy for having half psycopaths only on command! Rome wasn't built in a day. + +2. By evaluating a tau for each individual (ex: some of the [IQ](https://en.wikipedia.org/wiki/Intelligence_quotient) math can be recycled to do something way better than that), it is possible to adapt production times, production units, retail prices, wages, and everything, to the single individuals using a rational equation that granularly takes into consideration the single individual's capabilities and needs. Example: a person with handicaps could have an artificially (by law) setting for his tau so that predefined products (ex: survival medicines) cost less, zero, or is even reimbursed for buying. + +3. Someone says that the evaluation of tau could lead to the end of privacy in a similar fashion the attitude tests did; indeed it is possible to self-asses tau using the proper Turing-test-like procedure. In the past decades psychos made plenty experiments on other humans; it is pretty easy to find good books about 'double blind' procedures today. And I can personally witness that many human beings are not able to identify a very simple bot from a human: around 1997 I piped an 80s AI called eLiza to an IRC chat, left it chatting, and in one of the logs I've found a guy that apparently got excited and masturbated on his keyboard thanks to the sweet words of my eLiza. For people like him there's no need to disturb NASA to have a supercomputerised reference in order to let individuals self asses their timings: an hamster's wheel from the corner's pet shop is enough. By the way: that's the day I stopped to chat on IRC; and one of the reasons why I've never had a blog, a facebook/twitter account, and whatever crap has been produced since 2001. Other apocaliptic theories may spawn (but we are all used to those): price discrimination, capitalism's destruction, ecc. And those fearmongers may be right: in a few months since the launch of Ethereum someone have already built spiders to use the blockchain as a data source, and it is selling the spider work for profit: younger guys coming out of universities got Big Data jobs and Facebook in their phones; they've never had the chance to develop a privacy discipline. How long it will take before the first blowjob video pops up on the blockchain instead of YouTube and the Moral Practitioners Association of the time will produce their political puppet in order to pass a new law to go searching for blowjobs in the blockchain too? Moral Guys: I'm ONE KIND OF blowjob seeker too, but THAT kind of search you want for politicians to do, must be done by tech instead; not by law! You must pay me to search for blowjobs for you. No... wait... the last sentence doesn't sound good ... actually, I don't want to be paid for that, I've my strong work ethic that forbid for helping the moral guys to search for blowjobs (and saves me ex-ante from ambigous situations) ... but yes, you must make a spider that tags and list all the contents you don't want to be stored in your memories, devices, premises, ecc; for kids, youself, or whatever; then share those lists with the other moralizers; so that all the houses of all the moralizers only, are moralized. Grab a 1000 new parents and in a few months there won't be sex and violence on your screens. YouTube can't do it for you; can do the opposite only (ie: reclassify, to de-censor, wrongly tagged contents; ex: distopyan art, deviant art, ecc). + +4. The UN Declaration of Human Rights (or any other local equivalent) can be used to re-offset economics so that "needs" are always satisfied (ex: 50 liters of water and 2500 kcal per day, per person). That paper was made in a true moment of need; when all the work was manpower and we enslaved animals to get help; and the first machines we figured out have been used for personal and nation supremacy. The entire re-offsetting system can be simulated in public: just think that we are at the end of the third world war and we must keep living somehow, so we need to rebuild with whatever is around, starting from our last mistakes. Some religions are based on this; those religious may help to imagine. + +## Profile. + +> Se invece del vitello, te danno er mulo, tu magna e statte zitto... e vaffanculo. (an old Rome's idiom, en. "If they serve you donkey meat instead of lamb, you'd better eat in silence first... and fuck off then") + +(TODO: move most of this crap in Profile - personal case - and Standing - judicial systems - pages) + +Findings: + +1. [Just Do It](http://mfp19.github.io/2015/12/26/Profile.html#justdoit). Probably a latin quote would be more appropriated; something like "primum vivere dehinde philosophare" (lt. "live first, imagine after"; you choose another verb in place of 'imagine'). I like to translate it with "[survive first, all the rest comes after](http://www.meganetwork.org/video/ESC2009-MachinaryLove.mp4)". But trash philosophy and [dick-pics](https://www.youtube.com/watch?v=XEVlyP4_11M) are more trendy nowadays; so you must place a 'dick-pick' and a 'fuckoff' up and there in your writings; another 'mandatory minimum'. The quote above is a compromise between what I've been dreaming in my childhood - lamb - and what I've got in life - eDonkey. + +2. [Mr. Bin](http://mfp19.github.io/2015/12/26/Profile.html#mrbin). I haven't been able to access the judicial system for 8 years by now; and my eTools are all off-side-track manipulated. I'm currently writing on a laptop that from time to time horns; no kidding. When I started to write this Git I/O thing, I've spent an hour searching my name and digging my G+ profile to figure out how was it: there are messages repeating, messages I didn't write, posts published in reverse order, and so on. So in this chapter I wrote an entire page about myself, timelined, in a tool where the history is tracked (ie: can't change idea off side track). Hopefully my collegues at GitHub have a better security than my laptop, and their company's policies don't allow them to rollback users contents. I've been singing "[The Internet is for Porn](https://www.youtube.com/watch?v=kV7ou6pl5wU)" for so long that... porn makers - ANY et all - truly believe their content is the king. +Nobody explained them the 'message in a bottle' paradigm the Internet is made of; the packet switching miracle: you write and MAYBE, in the next 20 years, if the host kept paying for the electricity all the 20 years long, someone will find your message. Or you can go trashing and be a meteor: the heaviest, the longer lasting, the deepest the bang, the deepest the hole, the longer the sentence. +It happened again after I wrote this chapter (2015/12/26); the very first day of 2016: (a tourist) "ah, you are an IT Guy! My son too - note: more than 25 years old, can't remember the exact adultness - is soooooo good with computers!", (me) "ooooh, I'm happy to hear that! What is he doing with a computer?", (a tourist) "He is a designer and a deejay!", (me) "Ah ok, he is not an IT Guy, he is a designer and a musician!", (a tourist) "Yes... well... I don't know exactly... I've spent a shitload to buy him a full set of gears, and he spends his days playing music and designing!". The "sfera paralela laica" people - "the non-clerical party", literally "the parallel lay sphere", an idiom used by lawyers to point at non-lawyers - have no idea of how many musicians and designers gone (financially) broken because of the cost of their toys. The amount of freelancers - liberal or not - broken to catch up with the showbiz's technological standards. And of course, if they can't grasp the idiocracy inside their premises, they have no idea also of how much money are wasted OUTSIDE their homes! In particular in the marketing, and in the law, departments of whatever administration. Administration that IT Guys didn't: the technostructure did; the IT Guys served. Donkeys paying sex toys to their sons, unable to distinguish eLambs from iDonkeys. + +3. [Mr. Bin's environment](http://mfp19.github.io/2015/12/26/Profile.html#env). My 2003-2009 girlfriend was an iDonkey - same donkey of the tourist above, but i-sed with a macbook - a going-to-be-lawyer iDonkey. She was asking whether or not I'd defend her from bandits in the case she would become a prosecutor; my answer: "no worry Horney, we'll buy kevlars instead of pigiamas, and shotguns instead of bed lights, so we'll die fucking hard in bed togheter! ROMANTIC FINAL!". I hate the idea to have a weapon in my home but ... I could live with it: hopefully I would be able to keep it without shooting myself by mistake. What I couldn't live with, was that she was publishing our pictures on Facebook in some sort of left party program to [re-educate masses to the Italian Constitution](http://www.italymagazine.com/italy/roberto-benigni/over-12-millions-italians-followed-benigni-show-about-italian-constitution) (note: that show was on stage in theatres before the public channel aired it), and after two years of chatting on Facebook with me repeating weekly to please stop that shit (because I was on the other track, other party: let's jail them - politicians - all and pin the innocents out after! It's the only case of prosecutory approach, instead of accusatory one, I admit ... because they self-candidated, have no 'vincolo di mandato', and have parliamentary immunity during their term; moreover they tend to do the opposite with us). The day I was complaining for her to push my data in Facebook, and her replying "I show you how Facebook works: see? My friends only can see my profile!"... pushing buttons in front of my silent nose... I've just gone mad: I've just had spent the past 4 years ridiculising myself in public (check the videos in "Web 2.0 Meetings"), accepting crappy jobs to keep staying where medias were made, just for digital rights sake, and ... a few years before I got engaged with a young beautifull wannabe-prosecutor, ending up in the risk to marriage with an ageing cheerleader in search of popularity. My life was definitively going to shit: Google had already destroyed on-line privacy, Facebook was [a new modern case of environmental corruption](https://en.wikipedia.org/wiki/Mani_pulite) privacy wise, I was engaged with an attention whore and everytime I complained for that the reply was always the same: "[Why so seriiiiious???](https://en.wikipedia.org/wiki/The_Joker_%28The_Dark_Knight%29#Execution)". Pretty interesting - the judicial env, is the formal social engineering of societies - for my on-going research about social deseases at Internet's time. +So I switched my interest from engineers's shit - university public fundings, patents, industrial private fundings, spinoffs, that were destroying my work and my world - to lawyers's shit: the biggest mistake of all my life. The judicial system is ... alive ... it's like [a squid](https://en.wikipedia.org/wiki/La_piovra), [cancer](https://en.wikipedia.org/wiki/Roman_Rota). And the judicial environment was harder for me to understand because I had no judicial experience at all - I'd been so good in not causing damages when playing with explosives and drugs that ... had no perception of the judicial shit at all - I just tought that my gf was a good enough legal consultant. +I couldn't imagine about her making up a judicial case on me: I got sued for stalking in the complicate attempt to anonymize my investigation (in her regards), and she used those gentle attempts to build up the stalking case. Style note: the passion crimes has been abolished in the 20th century, in order to avoid those cases. +Moreover [since Big Brother's 1st edition](https://en.wikipedia.org/wiki/Italian_general_election,_2001) on the italian medias there was an insane push-pull public game using [sad cases](https://en.wikipedia.org/wiki/Cogne_homicide) (note: jump to "Media exposure" section) as polling items and popular TV distraction, [mass distraction](https://en.wikipedia.org/wiki/Viva_Zapatero!). An insane nation-wide game; an insane nation wide-game; an insane-nation-wide-game except for us not watching that psycho-box called TV. But talking about inter-generational corruption, to look at the way the law practitioners ignore the constitution, the law, and the other tools that give them food and glory, was just more interesting than looking at a bunch of nerds (because I used to be one! Don't need to look at them!). +Frankly speaking I can understand a blue collar massacred by rotational shifts not having time for fancy topics and smart conversations; and any poor guy hadn't chances to access higher education; as well as I've learned in time that whoever uses guns, meritorius or not, doesn't give a fuck as well. Grab the dick, click accept, let the porn be. But I cannot understand a lawyer, a prosecutor, whatever is practitioning law. I cannot accept lawyers not reading and understanding the [terms of service](https://en.wikipedia.org/wiki/Terms_and_Conditions_May_Apply), not enforcing the public good by discussing their very own environment: they work in the part of society that rationally send people to the shithole, and to death in some jurisdictions (rationally calling it 'death penalty' instead of 'premeditated and scheduled murder'). They can't take the money and run away. Lawyers must read those terms, understand, publish the warnings, and discuss the judicial authorities, instead of just clicking 'accept' to access their porn as soon as possible; and without the need of a maddog like me to bite their ass. They must autonomously serve the public good constantly sanitizing their own environment, or simply give back their license. In this way, maybe, one day, we might have a public privacy law that avoid one wall-of-text contract per every click/tap/whatever. I tried to say this to my ex-gf and her: "The lawyer is made by the client's word-of-mouth; if the lawyer loose in court, doesn't work anymore; and if you discuss the court, you loose". It's a bit more complicate than that - the italian ground is divided into jurisdictions to allocate 'natural judges' before facts, to avoid off-side-track manipulation of judgements once the fact happened and has been brought to court, but some of those jurisdictions contain so few judges that you simply can't afford to discuss them, and in general because of the otto-benz-engine and the telephone both the jurisdictions and the law market became too small for this compartimentation to resist corruption - but the rationale is that the lawyers don't patrol the judicial system for... marketing reasons. Death Marketing. It's an evidence of an engine - o'monnee - that produces unjustice, disgrace, faminine, to increase lawyers workplaces and lawyer's wealth. Pretty the opposite of what law should be. +Anyway the point is that we - lawyers' "non-clerical party" - can grab our dicks and run to the porn without reading any disclaimer: did you ever red the instructions in front of the piss pot BEFORE pissing? Say the truth to yourself: if you read them, you do it after setting your willy back in the safe. Not before risking to piss in your hands; and reading while jumping is pretty annoying. Well, lawyers simply can't skip the instructions; it's in their ethical code (and the italian one is binding, in theory). Who is supposed to monitor, and patrol, and bomb whenever necessary, the judicial system? Lawyers fundrising's dinners for charity handling money to too-late-activists... for dignity once-your-father-is-in-jail? Me spending two years telling to my gf that all those judicial things are her part of The Job because I already have mine, plenty, in the information technology, and ending up being sued from her? An ex-inmate killing the judge/lawyer/witness as soon as he is released? This is the price of having idiots in courts. And lawyers in 2010 were 44-teeth-smiling: with all the preventive psycho-bullshit invented in the parliament, their market just enlarged like our anuses with a [nuclear bomb](https://en.wikipedia.org/wiki/Little_Boy) sharped enough in order to be used as [suppository](https://en.wikipedia.org/wiki/Fat_Man). Spend a moment to look at the shape of those bombs. Now instead, 2016 - after being found guilty by their people for not doing their job, and being shot down, threatened in their homes, and so on - lawyers strike alleging un-fair trials; or they don't strike, asserting their gmail mailboxes' being safe because they don't know the IT backstage part of the story (or just are wealth enough to not give a shit of anything for the rest of their life). In both cases, bullocks. In any case the judicial system is a kind of drama theatre where people is truly jailed and killed. In 2015 I telephoned to another one - never give up your rights! At least try! - when I asserted doubt about his mailbox to send him my documents ... he said his mailbox is 'special'; so I gave up again. I'd like to see his cards, but I don't have bet money to go seeing. And I don't need to: after Wikileaks, Edward Snowden, Hacking Team and John Oliver's shows ... whoever is not a little bit doubful about the cloud version of the Internet is ... dumb enough to die. If you are using Facebook to call 911 you simply deserve to die; [it's a modern urban version of the sadly wild natural selection](http://www.darwinawards.com/). +Last time I helped a lawyer in Italy in 2010, she was having troubles with the USB smartcard reader: one more point-of-failure added to their machines; usb devices and their drivers have been the most infective shit ever seen on a computer; at the time the US Army already banned USB devices from their premises but our high courts were mandating the lawyers to use USB smartcards readers: scary. The smartcard was requested by the high courts to access their archives: by looking at someone being able to access those sentences (those public records!) I got angry again, because I couldn't access those archives, and I've been searching for some of those sentences since 2007; look at 2013 Aaron Swartz's death movie, then at [Simone Aliprandi](http://www.aliprandi.org/)'s [2014 JurisWiki project](http://juriswiki.it/): he took high court's sentences from private archives (sold as expensive lawyers' services), and published them risking the same unhappy ending of Aaron Swartz (for publishing sentences that in theory should be public; the law mandated the high courts to anonimize the actors, then publish, and they didn't!). The italian judicial system, differently by the common law ones, doesn't rely on previous art to shape current judicials - because in the civil law system there is an ex-ante primary source called constitution, and ex-post coherency procedures (ex: 'cassazione a sezioni unite'), instead; but those sentences allow us to understand if it is worth or not to proceed BEFORE start spending money, how to proceed BEFORE loosing yourself in the details, and without one of those there's no way that a lawyer - [in the case you find one after digging the registries where to find the right registry, where to find one lawyer](http://mfp19.github.io/2016/01/06/Epiphany.html#standing) - let you talk about your case: "you're not a lawyer, shut up ignorant, I know what to do". "Sir, I need to assert IT message integrity at telco level; for her fake allegations instead, I don't need you, I'm innocent, can make it myself!". Those papers - and the $$$ grant from the lawyers guild for public defendant - give you one chance for the lawyer to take your case into consideration. One chance only: I did that in 2006 and the lawyer dropped my papers on a shelf behind him (just to not trash it in front of my eyes; 2 years later I called him to complain and he just 'forgot' my papers). But better one chance than a knee on your bullocks. And those papers were denied to us: we got knees on our balls only, no chances. So I just started to do - for free - what the lawyers were not doing: wild judicial debugging, (unwillingly) butcher style. And my gf was not doing as well, at that point: they would like to sell that part even if they are not in a common law system! In such systems is just normal to make the people pay for consulences, in the civil law system is not! +Every bullshit - ie: "we made the judicial reform!", up to the (in)famous constitutional court sentence 01/2014 - pushed as daily news in order to manipulate me and or whoever was entangled in his own judicial shit, produced an excruciating effort to remember what my gf said before quitting (and suing me) about her findings in the judicial: "they sue you on purpose and you must pay a lawyer: so you don't have enough money to make your way, your politics", "a private issue resolution attempt can be faked on paper as a blackmail attempt", "no notify of investigation closure: a way to fuck you because bla bla bla", "no civil responsibility of the judges: a way to fuck you because bla bla bla", ecc. The guinea-pig... mmm... The Carrot is an hard job but in a iDonkeys-polluted environment, a Rabbit has to do it :) + +4. [Timeline](http://mfp19.github.io/2015/12/26/Profile.html#timeline). I've never had a copy of Alice in Wonderland; the old Disney's cartoon was too psychedelic for my childhood taste, so I've never tried to understand it. And I didn't like Roger Rabbit. It was a too serious cartoon; recent ones (ex: Madagascar, Ice Age) inverted something: instead of using cartoons to make a serious movie, they make serious cartoons that can't be understood by kids so that both (parents and kids) enjoy... good job guys, good job. The only time my father took me at the movie theatre was to see Bertolucci's "[The last emperor](https://en.wikipedia.org/wiki/The_Last_Emperor)": don't get me wrong, it is a great movie about the last chinese emperor - great in the way that is the only serious representation of chinese recent history we could see; it may be considered like ones of Oliver Stone's masterpieces about US, Iraq, Cuba, Snowden - but ... a bit boring for a 10 years old kid; let's say it: fucking damned bloody boring. All those pictures popped out from my memory, scattered, 30 years later, watching a 150 years old oppium pipe in a small antiquities shop close to the Mehkong river, where once used to be oppium flowers. Those new cartoons instead do the [father&son](https://en.wikipedia.org/wiki/Fathers_and_Sons_%28short_story%29) trick waaaaay better. Anyway, in 2010 I was alone, and my picture a cartoon thanks to the cops seizing two of my laptops in 3 years, so my life went from Alice in Wonderland's rabbit, to Roger rabbit; included all those mafia guys melting detectives in the acid barrels, and the cops running after the mafia guys shooting at cartoons with real bullets. Not seriously, just in the cartoon (note: in italian slang 'cartone' are the cartoons, the cardboard, and the LSD trips). Well, not yet. I've no idea who and how someone else used all my life (in the laptops) about - and I honestly don't care: after the first stolen laptop in 2007, I openly said in one of the videos that I don't need my picture, and published everything (I only published) with a CC-BY-SA-NC 3.0 license: whoever did whatever raising money from it, has been a scam - but it has been a hell of life: people searching for me from all around the world, and go figure why! Activitsts? Friends of MPs that signed those laws cutting some throats to not give money back? Bank and insurances detectives? Bounty hunters? My friends reading and talking with me on fake Facebook/WhatsApp accounts; other friends complaining for me not posting G+ posts (thing that I was actually doing daily); others that heard about me farming in Asia (I can't work!); an israeli friend asking me if I finished my job for the government (I don't want to help my gov!); the officer in my embassy asking me if I was a spy for another government (I don't want to help another gov!); arab guys asking me if I was israeli (no-ooooooh, it's not my war/peace!); and so on. Why the hell people is reading my bullshit profile? Why the hell people is reading ANY personal profile? Everybody searching for someone that is not me - assumed that this someone stolen money or killed someone else - and daily news about people beaten up, arrested, tortured, shoot down, disappearing, beacause of a wrong picture or a wrong mobile. I hope I don't have many doubles. Before I was scared because in Italy there were too many shootings around my home; after the 2010 search&seize I've been more worried from the cops than from the robbers: did they really run after Facebook's signals? I mean: why the people don't rely on more reliable side bands for emergencies - ex: mobile phone "Emergency calls only" - instead of using bullshit mainstream channels? In this inverted environment I carry on thinking that I got the best life insurance of the world for free: being dumb like [Stephen Levy](https://en.wikipedia.org/wiki/Steven_Levy); another one of my dumb heroes (no offence, we are many). One day I might even get on [The Guinness Book of Records](https://en.wikipedia.org/wiki/Guinness_World_Records): everything the above story, trying to avoid any advertising, marketing, money, legal or illegal whatsoever, just the minimum movement from my chair I could. I'm probably second to monks and gurus only, because I must practice the patience gift a little bit more (and many other reasons): I tend to explode when someone talk about work; and getting emotional about anything, instead of smiling like them. In any case if I get killed I'd probaly be the second most idiot kill of all the times: not even worth it. The best insurance, as I said. +Almost world wide: in Europe my fingerprints have been taken when I was 'barely 18' (because of the compulsory military medical visit), taken again in 2010 to make my passport, and I still wonder why in NY I was forced out of the international area to get my fingerprints again: I carefully avoided any travel to US for 10 years, just to not let the airline to send my data overseas and then... all this effort vaporised; and my face has been re-recorded about 6 times in Thailand (optic), 2 times Malesia (thermal), once in Singapore (drugs test included, the best search ever... no kidding, they don't touch you, just swipe sensors on your luggage! Pretty nice officers and procedures). And go figure how many other times without telling me! I just left my fingerprint on a glass in a coffee shop. And my anus-print in their toilette (note: it works like the barrel of a gun). +If you like the lawyers-encoded privacy in the digital world you can't live without, stay at home and shot the postman in order to get a first class ticket for solitary confinement. Actually, build a bunker and bury yourself in it: no violence please. Mmm... even better: hook a NASA bio scientist and a vietnamese on Facebook, convince them to move with you underground, move to Kansas (ie: easier to get second hand bunkers) and wait! Bring with you enough of those inverted cartoons: you already watched all the porn! I'd tell you to bring someone from [Coober Pedy](https://en.wikipedia.org/wiki/Coober_Pedy,_South_Australia) instead of a vietnamese: same historical underground life records, but statistically funnier. The problem is that the australian is bigger: eat more and fart more, and in a bunker the things could turn bad too quick. Living in a bunker with someone else must be like getting a prostate cancer: if the other one is small enough, you live all your life long without even knowing that you have one; if it grows too fast instead... +Anyway: once locked my case in a court, set up the lawyer in there, and made my civil service instead of the military one - 'white strike': prostitutes not asking money against new public laws or enforcement activities; japanese blue collars working faster to overflow the chain and creating problems to their management; anti-mafia activists working for free to remove the need for public administration to allocate funds - waiting for the proper environmental inversion, and the Guinness records book officers to call me, I watched those cartoons already and practiced with Guinness, leaving the best books and the best porn for the old age: when you'll wives will be waiving your NSA-preserved dick-pics in front of the judges's noses, to prove their properties, and you'll bunkerize downstairs with the cartoons, someone have to finish the Guinness world reserve without having a dick pick anywhere! I'm trying to be there. The only problem is that my data, today, is scattered anywhere, because of the cops seizure of my ex-gf [SWATTing](https://en.wikipedia.org/wiki/Swatting). + +5. [Behavioural](http://mfp19.github.io/2015/12/26/Profile.html#behavioural). So, as a result of my [Simple Pedoterrosatanism](https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Apocalypse) - that can be distinguished from the Advanced one because I don't make use of any tech skill - the suspension of my life has been prorogated 5 more years, and restricted between those two tracks: + * [2001](http://www.minervamedica.it/it/riviste/minerva-medicolegale/articolo.php?cod=R11Y2002N02A0073&acquista=1), medics talking about legal stuff: "The impulsive crime within emotions, passion and madness. A legal perspective." (it. "Il reato d'impeto tra stati emotivi e passionali, e vizio di mente. La posizione della Giurisprudenza sul tema." - Ritella M., Barbieri C. - ISSN 0026-4849 - Online ISSN 1827-1677) + * [2012](http://tesi.eprints.luiss.it/9462/), lawyers talking about medical stuff: "A definition of aberrant situation. The aberratio delicti. The multi-damaging aberratio delicti." (it. "Definizione della vicenda aberrante. L'aberratio delicti. L'aberratio delicti plurilesiva." - thesis by Alessandro Perfetti, thesis supervisor Angelo Carmona, thesis co-supervisor Cristiano Cupelli) + +They never ask to the IT Guy, unless a computer is involved; we only get the prosecutors coming to us for forensic, or sending us the SWAT to bring us to them (carried by the ears). My case (the Anonymous IT Guy case) should teach them something: by asking me, instead of diagnosing me, they could avoid this multi-damaging aberrant situation where both medics and lawyers fail. By looking at the telephone logs (note: the metadata retention was compulsory by law for 5 years) and questioning me in court about the rest, they would have both discovered a whole bunch of worse crimes - ex: how dare the telcos silently sell our positioning data? How dare they silently disable our mobile's encryption? Why the people pay for corrupted public exams in universities? - and learnt a bit how to manage The Internet without spying us all. Positioning data exist; if they sell it - and I disagree with that - I want my stake. Not a Big Data industry. +And of course: discharged me because of the empirical principle. I was heading straight to the voluntary declaration mandated by law as a right for the accused ones; and they denied it. That is the thing that makes me maniacally emotional like a bull; a mini bull; a bullet; a bulletto (it. Rome area slang for "small bully guy"). +I'm not asking to have the honour guard at the [Altare della Patria in Rome](https://en.wikipedia.org/wiki/Tomb_of_the_Unknown_Soldier#Other_countries); all the way the opposite: I want to be anonymous! Popularity is a condamn; even a supposed one only, the one you get when all your life is seized inside your laptop; and without encryption, to avoid torture (ex: preventive jail) in the case they want to access your memories. I'd like to see a small Ed's picture close to the Anonymous Soldier tomb. They - the ones blowing the whistles on militaries - deserve it. Mine was just a white collar bush walk. Or such I guessed at the beginning. + +I swear, I had no idea Edward Snowden was going to come out. Also because I don't give a fuck about the laws the governments did in the while (and I'm correct, according to the constitutional court sentence 01/2014: 2005-2013 parliaments are scams): in My Constitution - [published on 25.07.2008](https://www.youtube.com/watch?v=3a8bH0ilu5Q), three days before the parliament confirmed the Lisbon Treaty, [using the fastest available media](http://mfp19.github.io/2015/12/26/Profile.html#today) - calling for a switch to a common law system, I set the sentences (to be used as cultural continuity cases in the judicial system) up to [Bettino Craxi](https://en.wikipedia.org/wiki/Bettino_Craxi)'s death; because after the year 2000 a bunch of clinton-ates and eu-notes has been pushed in our legal codes (ex: copyright, trademarks, patents; privacy, and go figure what else came from NATO). I've always been in line with the constitutional court backtracking order. + +The "passion crimes" in Italy were abolished in the 20th century. Those crimes had been abolished - downgraded to investigative tracks - in order to avoid aberrant stories like mine: lawyers attempt to fraud public jobs access tests, psycho-doctors opening the way toward unconstitutional prosecutions, and the resulting "multi-damages". And they have been abolished because those crimes were "aberrant crimes". Read [this other thesis for more info](http://www.tesionline.it/default/tesi.asp?idt=23169) - "Il reato aberrante", Consuelo Occhiuto - or find one in your own language: lawyers, priests, and whoever they are serving, always write the same things since Julius Caesar. In my case then, I had nothing in common with my girlfriend, not enough to go preemptive: no kids, no properties, not living togheter, not in the same party, not the same sex. She choosed first - I'm a gentleman - and choosed her job. I choosed last; and choosed my job. That's all. Instead I've been probed across 3 continents for the next 4 years against stalking; and the shit was coming from my embassy. Plus mobbing; not the crowd one... that is cool... targeted to the single individual. + +And I swear again, I didn't notice before in between the two tracks - psycho and criminal - there is the exact duration of Berlusconi's movie, and I don't give a fuck as well: the wrongdoing was in the hidden part of the telecom systems, and the italian NSA (COPASIR) was not on Berlusconi's side; it was headed by Massimo Rutelli (who have lost in 2001 general elections against Berlusconi), then by Massimo D'Alema, the last "[Radish](https://en.wikipedia.org/wiki/Radish)" Prime Minister ([talk communist, act vatican](https://www.youtube.com/watch?v=-JhAeO0GKlo) since Rutelli&D'Alema founded the Partito Democratico joining their two parties and enforced the majoritarian system). The latter's brother (brother?) gone cunsellor at the Ministry of Health in 2007, after being the main medic at the psychiatric hospital in my area (and I met him once just before his brother became the Prime Minister, a nice guy making family sessions... but I can't recon him in publicly available pictures); here [my home town's website announcing one of his public lectures](http://www.montecompatriproloco.it/castelliromani/Frascati/convegno_frascati_18_settembre.htm); and here some of [his academic papers](http://journals.lww.com/jonmd/pages/author.aspx?firstName=Marco&lastName=D%E2%80%99Alema). More third parties - on top of police officers and lawyers - that step in the middle and interpret empirical evidences + +> "We believe the most comprehensive and dry definition of Mafia is: a ruthless association working for its associates' profit, that forces parassitic intermediation trough violence, in between property and work, production and customers, citizen and state" (attributed to [Leonardo Sciascia](https://en.wikipedia.org/wiki/Leonardo_Sciascia) from [Mafipedia](https://it.wikipedia.org/wiki/Mafia#cite_note-15); it looks like from "[La storia della mafia](https://it.wikipedia.org/wiki/La_storia_della_mafia)", Milano Barion, 2013, ISBN 978-88-6759-001-8; and [Eric Hobsbawm](https://en.wikipedia.org/wiki/Eric_Hobsbawm) might have said something similar before) + +It is pretty astonishing then, looking at the actual criminal code, that the "[associazione per delinquere di stampo mafioso](http://www.camera.it/_bicamerali/leg15/commbicantimafia/files/pdf/Art_416bis.pdf)" is a huge blob built in the extreme attempt to eradicate the word "intermediation" from Sciascia's dry definition. They added details to not include any personal (two-headed) relationship (ie: "an association of three or more people..."), and whatever else to not make any intermediate whole business illegal because of a single murder (or any other crime) in the same association (for profit, not for profit, registered or de facto), basically denying the savings that might be originating from the chance to directly communicate from one point of the world, to any other point, without the need of a mafia guy in the middle. Savings that had been considered a new market instead; a whole new market that needed a whole new stack of money to be. The Internet was nicknamed '[New Economy](https://en.wikipedia.org/wiki/NASDAQ)' instead of 'New Democracy'. + +Add this on top of the [built-to-order systems](https://en.wikipedia.org/wiki/Build_to_order) (ex: Toyota, Dell, Kickstarter.com ... ) and the "message integrity" computer security issue where [this perverse gitlog started](http://mfp19.github.io/2016/01/06/Epiphany.html#integrity), to get the proportions of the generational [failure of the italian labour parties](https://en.wikipedia.org/wiki/Marco_Biagi_%28jurist%29). + +Mad houses have been abolished in the 20th century too ([Legge Basaglia](https://en.wikipedia.org/wiki/Basaglia_Law)): the current italian politicians might have been some of the left overs when the psychiatric hospitals closed. After the early 90s "Mani Pulite" scandal [linked above](http://mfp19.github.io/2016/01/06/Epiphany.html#facebook) washing away an entire generation of politicians, business man, bank managers, they've been able to sneak out and take advantage of the suicides, murders, and judges bombings of that bloody years. I'm serious about that; I truly think they are some psychos escaped from rehab. + +Even today - [Gratteri a part](http://mfp19.github.io/2015/12/26/Profile.html#behavioural), openly giving for granted that Internet is the meeting point of pedos - there are plenty prosecutors that back up those psychos, and psychos backing up the prosecutors: [Raffaele Cantone](https://en.wikipedia.org/wiki/Raffaele_Cantone), magistrate, President of the Anti-corruption National Authority, just declared "I'm a prosecutor, when I see anonymous I spot a crime". +This 2 years after we've been yelling against the ridicolous whistleblowing facility they produced: you must register in order to anonymously blow the whistle, and about commercial frauds only. The day the registry leaks, the whistleblowers are dead, all at once. Everytime the device of the whistleblower is corrupted, the whistleblower is dead even before succeeding (ie: witness in court). +In my case after 5 years since I was yelling at the italian chapter of Partito Pirata to not follow the german chapter example (ie: open vote) and use a secret vote instead because of the italian [long lasting tradition of not let the stakeholders to vote](https://en.wikipedia.org/wiki/Expedition_of_the_Thousand#The_end). The plebiscites held in Sicilly were made with separate voting boxes, one to say "Yes, I want to be part of the unified kingdom of Italy" and one to say no; and a gunmen close to every box. There was no way to drop your vote in the "No" box without being shot right after going out from the voting building. +The same has been happening all the way trough the italian history after the second world war: thanks to the two-layered over-compartimentation (the set of candidates to be elected, the fixed cabins to go electing) of the administrative units (for voting purposes), it was possible to account ex-post, the votes granted before by word-of-mouth. Then pinning out with a second round of word-of-mouth, the ones that before the election day granted their vote by talking, but voted the opposite in the cabin. To have the math of the whole corruption schema look at the [Birthday's Paradox](https://en.wikipedia.org/wiki/Birthday_problem). The 2005 voting law, abolished by the Constitutional sentence 01/2014, was addressing this issue by removing the set of candidates to be elected. +The Partito Pirata activists were giving for granted the "message integrity" of the electronic network in use - that was not integer, because of the Spaghetti NSA described above - in order to reach the LiquidFeedback electronic voting system (and its integrity). Voting machine not "integer" as well: its integrity was based on decoupling the voting software from the operating system, so that the ones acting inside the voting machine (ie: voters, tier-2) are protected from the voting machine's system administrators (tier-1), and the system administrators were protected by the ones that run the bare metal (tier-0, military grade). Protected or manipulated. Or both. Cloud Voting: the same security schema of Microsoft Live, Google Whatever, and Facebook. + +Today we have [left wing politicians](https://en.wikipedia.org/wiki/Democratic_Party_%28Italy%29), nominated (ie: elected with unconstitutional method for faking the elections) with that security schema in place, from mayors (ex: [mayor of Rome](https://en.wikipedia.org/wiki/Ignazio_Marino)), all the way up to the [Prime Minister](https://en.wikipedia.org/wiki/Matteo_Renzi), [playing shit storm](http://mfp19.github.io/2016/01/06/Epiphany.html#notactivist). [Here Ignazio Marino sued for defining Mafia the M5S party](http://roma.corriere.it/notizie/politica/16_febbraio_09/ignazio-marino-accosto-m5s-mafia-gup-imputazione-coatta-51de4c72-cf50-11e5-a78b-52d074ea1480.shtml). The "Imputazione Coatta" is when the prosecutor in charge of the investigation say "there's no suspect of crime", and his function is overridden by someone else: "we go on trial anyway". Who is 'someone else'? Someone else inside the court. Indipendently from the distinction between GIP, GUP, ecc - all law practitioners, members of the courts, appointed for the different steps in a trial - it is when the accusatory system become an inquisitory system, for that person only, in that case only. Harder to understand from the daily news on TV; people understand "another assholician stolen our money"; instead they might just be lynching him. That is what Ignazio Marino pointed out by saying 'M5S have mafia-alike requests'. This PD-M5S 'faida' (italian for 'fatwha') started when a [M5S young deputy](https://it.wikipedia.org/wiki/Giulia_Sarti), previously known for showing off on video in the [Agende Rosse anti-mafia movement](https://it.wikipedia.org/wiki/Gioacchino_Genchi), had her personal hard disk stolen in her personal office inside the italian parliament building (tip: police/military contracts are considered life long, and they are in charge of the security of the parliament building; the same apply to most of the civil personnel working in there, and the access to those jobs is highly familistic, despite the existence of public calls for tests, exams, and so on, on the 'Gazzetta Ufficiale' mandated by the Constitution). It is when the entire M5S party realised the existence of the 'message integrity' issue (that starts from the integrity of the building where the data is) and headed (again) into asking for ... the same policies in place; basically requesting a new Google-Facebook round (ie: off-side-track security, bypassing AGAIN the IT Guys involved in a distributed model). +The whole trial to Ignazio Marino is just bullshit: it's a trademark issue camouflaged into something else. That guy (person, flesh&bones) against a party (a picture, a symbol), about the words of a politicians, about an oppositing party: would you expect for him to say anything good about one of the oppositors? It's just idiot - and too expensive for us, for the public good paying the courts's costs - even to file the case in a court. Any defamation case, any trademark case. The M5S movement is doing it to defend the void they have been artificially created with; a pack defending their symbol. Hard to believe in those news. + +Ignazio Marino is a medic - like my father and my brother - the ones that tend to believe to psycho-syndroms and the rest of the psychoshit I've been tortured with, in the past 5 years. And the 4 years before. My mother included: same party because of different reasons (a psycologist she ended up when my father left, was having politics funding dinners). It's a bit more than "environmental corruption". It is an addictive desease gone at large trough medias since we figured out that oil was a bit more useful than turning on public lamps in the streets. I've been struggling to keep it in the TV only; but Google&Facebook did the trick to complete the migration. + +The corruption is not there, in the economy targeted by the Cantone's Anti-Corruption Authority's (not) anonymous whistleblowing facility; it's in the heads of those puppet institutions; politicians ARE the corruption by definition. Corruption is against something; corruption of something. Every time the parliament pass a law, an act, whatever, it is corrupting the previous framework, the previous status quo, the previous system surrounding us. The one that people, their blockchain, know; or believe to know. Calling it "culture". But most of the people simply CAN'T follow this granular constant evolution; the fastest it is, the more people feel like being a stranger in their city. Blaming immigrants, the other party, someone else. + +I wonder then, how do the Anti-corruption National Authority (persecuting undifferentiated Anonymous-es) defines 'corruption': blind faith in the papers composing a book maybe? [Pretty old idea](https://en.wikipedia.org/wiki/Religion). Already patented (and the patent expired!). + +Even more considering the overall [message integrity corruption](http://mfp19.github.io/2016/01/06/Epiphany.html#integrity) of their working tools; and not the digital ones only: my girlfriend's associates were defending a lawyer that faked an high court paper - paper, not computer: whitener, pen, photocopy, deliver the photocopy - because this lawyer couldn't meet a schedule, faked the dates to stay in the run, and that fake public document was the only way to keep defending her client. Inside courthouses using procedures impossible to cope with. Would you jail this lawyer? The same story is Ignation Marino's trial. And mine. Aberrant stories. Theoretically any, until we don't get (back?) 'message integrity' at least in the voting machine and in courts. + +As well as I don't understand how the so called "indipendent administrative units" (https://it.wikipedia.org/wiki/Autorit%C3%A0_amministrativa_indipendente_%28ordinamento_italiano%29) (nicknamed "authorities") are indipendent: indipendent from what? From the parliament? Can't, all and only the administrative units defined in the constitution can be authorities, expecially the ones with law making and judicial powers. The only well defined exception is the executive (the gov), and in any case, in the backrows of the constitution there's the art. 1, comma 2: if you want authority, you must pass trough the popular suveregnity. American prosecutors alike: elections. Not appointed by the prime minister (ex: Anti-corruption authority Cantone appointed by PM Renzi). Nor by the parliament (ex: antitrust, privacy, comms, authorities; spawned in early 90s). + +I could keep going for the next 3 terabytes of plain text; and it's not worth it. For me to write, and for you to read. Wikipedia exists already; just download it; and print it from time to time, to avoid the UIkipedia and the Mafipedia abuses described above. I already suggested 9 years ago to Wikimedia Italia Fundation, to keep all the biographies separated from the scientific part, in order to not be sued (again) by face-working asses (reputation-based jobs: politicians, showbiz, and alike). +It is not worth it because the EU integration process, law wise (ie: on top of integrated economy and finance) has fallen like a meteor over our heads. Basically I have no idea what the hell the italian judicial system is today. I'm not even sure that it exist; civil trials were already fake in 2007; criminal ones in 2010; by now the courthouses could have blown. +On the news VIPs trials hit the headlines daily; about any small insignificant detail (ex: "Tizio said that Caio said that Mevio said that Sempronio defaced Tizio using the word Barbagianni, and that's obviously derogative, Mafia alike"); but in 10 years, it has never been my turn and the only chances I had was just to give a passive appearance of the legal procedures in place. In the first 5 I was waiting for it; in the second half I've been doing the lawyers job, appearing like a fuggitive. I feel pity (even) for lawyers and prosecutors; they see this every day. But they don't hack their part of the civil society. They don't deserve my pity. +I know only that every time I tried to access the judicial system, both new videos of bloated courthouses popped up on my screen, and new idiots in front of my face snarling about pensions, kids, drugs, corruption, ecc. I'm a minority, but I know it. I don't need one of those 51% of 'I'm happy with that' party to snarl in my face; the idea is to increase that 51% so that there aren't 49% of 'I'm not happy with that'. Don't focus too much on the number 51-49; that's ok in bipolar systems (ex: UK, tories and whigs). Italy at the moment is a tripolar system (25-25-25) instead, [all the rest is treated](https://en.wikipedia.org/wiki/Involuntary_treatment), [me included](https://en.wikipedia.org/wiki/K-PAX_%28film%29). +Hopefully italians will be able to go back to the 1948 fully proportional voting system as soon as the actual president of the republic (author of the 1993 'Mattarellum' voting law: 75% bipolar, 25% treated/jailed/dead) will be dead. I hope before his 7 years term. And after that italians could even reach the democracy again: 1-1-1-1-...-60Mth. The whole drama here is that ... if they don't allow the IT Guys to touch the very heart of our democracies, we can't help (ourselves either). + +Plenty, of the points of failure described above, could have been already fixed applying any kind of orthogonal policy (ex: from EU), then discarding the previous ones. I don't belive they are doing it: since 2001 there have been a few amnesties (often camouflaged to not scare us) but no permanent, recurrent, case review process UK-style. Italians tend to forget the honour duties; both the MPs and the mafia leaders are called 'onorevoli', but the latter are more serious. +When the inmates (and the guards) were living in unspeakable conditions, there was an amnesty; it was an humanitarian emergency, to not build more jails (ie: reduce politicians's personal incomes, budgets on 'circensis', and whatever was more enjoyable to do); to not change laws. Examples: keep the copyright infringments in the criminal code instead of the civil code, in order to access deeper investigation tools like searches and seizes (available in the criminal code only); legalize drugs; not jail immigrants (ie: remove the criminal act to consider it something else); and whatever would cost more than 40 euros... the daily public cost for an inmate, and an immigrant. That's how the jail system became a permanent lucrative activity INSTEAD OF 'just a job to do', Mafia Capitale scandal, from wiretapping of two bosses: "I make more money with immigrants than with drugs". That's why I keep talking about horizontal [asymptotes](https://en.wikipedia.org/wiki/Asymptote) (X=time) whenever someone try to push apocaliptic theories baked by economic curves going to infinite. Those asymptotes exist because the Earth is limited; we can let the asymptotes be blood, war; or we can produce them. Up to you. + +I am a 'legally hammered one' - [Winston](https://en.wikipedia.org/wiki/Winston_Smith), [Cassandra](https://en.wikipedia.org/wiki/Cassandra) - before walking into my embassy my legs failed, my girlfriend held me. My opinion is biased. I don't believe they did [it](http://mfp19.github.io/2015/12/28/Checklist.html). But they might have changed something for the good too; Italian Jobs are famous world wide. I just cross my fingers that the things are exactly the opposite I see on the news. + +## Pasta&Ciccia. + +> Literally translated, Spätzle means "little sparrows". (Wikipedia) + +Findings: + +1. Until 2005 I've been able to spot great consumer associations' products anaylisis from northern european countries; then no more. And in Italy those disappeared in the mid 90s. By 2010 all our devices were off side track bugged for surveillance purposes, or simply impossible to protect because of the spying tools installed in the data hubs (ie: outside our premises). The cheapest Software Defined Radio able to speed up to modern radio signals (WiFi/HSPA-LTE) and tell whether our calls are encrypted or not, was in the 3000 USD range. In the 2013-2014 period I made a quick estimate: to make a grassroot, high speed, mid size, custom general purpose computer board, using commercial silicon at consumer prices, takes around 100k (of a western currency unit); to make the same stuff in silicon takes about 500k. I had about 25$ in my pockets; summing up all my bank accounts. If I'd stolen property to the friendly people around me I'd probably reach 100$ (and a few tens of grand, of debts, with banks and public institutions, cops&robbers running after me, and being banished from my monkeysphere... exiled). A hypotetic computer association made of 1000 people - given that our decision assisted tools worked properly and we all agreed to steal money from our families, friends, ecc, to bet everything on that single project - could spawn a board; it is unlikely to be able to spawn a silicon chip. We can workaround the issue of the silicon chip by increasing the size of the resulting board; but this increases the cost of the board itself. And we can even avoid any electronics going back to pure mechanical tool; but this would increase the size of the resulting machine and the amount of energy needed to operate it. And when I say 'increase the size' and 'increase the energy' I mean that that association would need a small-coutry-sized piece of land, and a few nuclear power plants to operate that machine. Have a look at the Large Hadron Collider project, to have an example of 'size'. Unacceptable. And considering the amount of steamware to dig out from museums in order to have an equivalent mechanical tool (ex: ferro-magnetic coils to be used as memories), it looks like an horror movie: I've seen the pictures of Stallman singing latinos songs from his One Laptop Per Child around 2011, before the new southern-northern american street clashes that John Oliver (HBO) published on YouTube around 2014. That - see [MadMax movies](https://en.wikipedia.org/wiki/Mad_Max) - is the other kind of hell that raise up when someone invokes the masses against the institutions, and we don't really want to live in ... ask to whoever has been there ... we call them 'refugees' for a reason. + +2. There's a recurring question in my mind that makes me dumb all the times my toughts stomp into it: "can I speak?". I like the english version of the entity 'pensieri': 'toughts'. It is very real: "something imaginary that just happened in the past, gone". When nerves stand the slings and arrows of this outrageous life, and my Invisible Friend Willy agrees, hate speech is the same. It helps to reduce pressure. That's why I love it. The old grandma's recepe to survive honest is "[Be conservative in what you send and liberal in what you receive](https://tools.ietf.org/html/rfc1855)... and find your very own black hole where to throw all the rest". Note: if you follow the link notice the imperative and conditional verbs. The problem is that someone, by reading my [black hole](http://plus.google.com/) might have triggered unpleasant procedures: before 2010 I was happily crunching white collars in order to reform the italian Constitution without the word 'party' in it... then... + +3. There are very good answers on earth, both at the top of the ladder (Royal level) and at the bottom of it (liberal arts: jesters, satyrs, comedians). Again: my personal references are the english crown at the top, the ancient greek comedians at the bottom, because of my very own background (2nd generation republic born after the last italian king); but what I can tell is: it is pretty similar everywhere in the world. Thai people (the people of the Thai Kingdom), thanks to english people and the other world wide expats living in Thailand, made me understand a bit better the meaning of the crowns, in my middle years; in Italy the only similar tradition is the Catholic Pope one (that I don't honour and refuse to honour because they keep taxing all the italians with the 8per1000 rule); the President of the Republic can be considered similar too because of his roles (head of the judges, head of the militaries, etc), and in both cases there's no blood rule: no crown, no feeling about it. We had a pre-WWII law that mandated to keep a picture of the king (the flag, and the chatolic cross) in all the public offices; but when I was at high school (1983-1996) all those symbols were already gone; the only somewhat real feeling I could get in my own world are my memories of my talks with my grandma. Very little of useful reasoning in a huge amount of emotions; not really useful to understand differences between kingdoms and republics. Despite the late 19th century general idea to keep the church separated from public institutions, the Vatican State kept playing a major role all the way the past century thanks to their confessionals and some untold (and unauthorized) agreements; in UK, for comparison, even today the House of The Lords have a life long serving majority (700 out of 800) and a religious minority (25 out of 800) embedded in their parliament instead; that is somewhat more honest: the religious minority is openly represented instead of stealing money and manage them at will under the hood. +About liberal arts instead; I had plenty all my life long (Dario Fo, literature Nobel Prize, is an all around Satyr); you can spot both very high and very low ancient forms of comedy all around the world as well: english have those, chinese have those, thai have those ... and so on. They all have different names, colors, timings; but everywhere there is (or used to be at least) one of those forms of art that can be staged in front of kings and queens. We still have the best examples - even of discussing the power, the blood rule, royals - under our eyes, we can see the best practices to survive in any formal environment without offending and according to the formal rules. It takes years to learn, but can be done. + +4. As far as kings, queens, presidents, popes, parliaments, allow at least one form of art to go on stage, and some speakers corners in public streets and parks, censorship by itself doesn't exist. In that chapter there's a list of reasons and feelings why it doesn't, and if it does it is criminal. I personally think that active protection of public speakers is compulsory too, no matter what; but in practice it is pretty hard to achieve: kids keep crying when we take them out of their comfortably belly water, Julian Assange is still bunkered in the Ecuador's embassy. Why so long? Who pays for the english law enforcement to keep the belt around the ecuador's embassy? + +5. As far as kings, queens, presidents, popes, parliaments, allow some kind of public scrutiny with acceptable&certified timings, some level of surveillance is widely acceptable. Plus there is a very basic truth: we bring and spread our face/fingerprints/DNA around everyday, and our automated tools need a certain amount of logs in order to work properly and being debugged in the case of fault. Then we can point the fingers to any story - in that chapter I use some italian mafia and secret agencies ones - in order to achieve better procedures. Real time. Epsilon cost. + +6. The blockchain system can solve any kind of public information issue up to the most difficult ones: think about the top most secret public documents distributed encrypted in a way that they are automatically disclosed within 75 years from facts (US public law, AFAIK; but it can be 25 years; or whatever law mandates). The UK's IPT-managed system could be evolved into an office that decide the amount of years at the moment of deploying a black operation, instead of deciding at judicial time whether or not is the time to release some docs or reimburse some victims. Alan Turing might have been pardoned before death, instead of 75 years later. And [Roberto Calvi](https://en.wikipedia.org/wiki/Roberto_Calvi) would not be found on a gallow under London's Blackfriars's bridge. I'm not talking about the italian one because we simply don't have an italian Alan Turing (Adriano Olivetti died before finding one, the others went to US), nor a reliable IPT-alike office: anyone can say all the bullshit anytime, and after a long and painful research ends up that the most important details are always locked inside the unaccessible Vatican Library. +Bitcoin - and all the profeetering gluttons it attracted, both for using it or singing its obituaries - has been the proof of this chance: despite all the accidents (from a girl found dead in Singapore to plenty wallets stolen world wide; and in one case even by american federal cops!) the security agencies are certifying its integrity, some banks adopting those methods, some governments endorsing and embracing those tools to renovate their internals. It takes time to get to mass distributed results; the amount of time is a pretty complex function of demographics, economics, ecc, that varies from place to place. There are dangers, it can be used to harm people instead of make a better world, and there could be things that delay (more) the adoption of it but ... it's a good tool in our toolbox. Even if you are a criminal: do you really want to go around without a blockchain under your seat? What the hell of criminal are you without a blockchain, uh? Have you ever seen a punk without a chain coming out from his pockets, uh? Go asking for blockchains to your gov! :) + +7. In order to achieve this, there's the need to restore the chance for hacktivists to make their own tools. Not by charity, and not by crowd-sourcing: it has to be public founded in a similar way the militaries are; with some clear public agreement and distinction at large, between the two, and a comparable amount of money. Hacktivists must be embedded in the formal systems as well as the protection of war veterans, war victims, families, elders, kids, has been in the past. Maybe it was not perfect, and money have never been enough. But it has the same permanent level of priority in any public agenda. It is more important then propaganda, marketing, psycho-stories, psycho-procedures, and whatever can be enclosed in a cloud service like Facebook or Google-whatever: refuse any backoffice guaranteed procedure ('the cloud') and ask for the money back in order to buy yourself your own piece of hardware to build up the mass distributed equivalent of those! It's a matter of distributed public capabilities to enforce the public trust: there must be people like me - psycho-identified since I was 11 years old - able to go from 25 dollars in their own bank account, to a self-secured electronic device without paying more than 25 dollars, and many people with all the other skillsets able to ask me wheter their current mobile calls are encrypted or not. Mandating universities to open the access to their labs could be a practical way to proceed: Aaron Swartz has been hammered on the basis of trademarks/copyright/patents laws, for distributing knowledge only, in a country where university documents are strictly private, the university computer labs are closed, but guns are sold at the hairdresser. I've been hammered by law in a country where universities are public founded and their presidents ('Rettore') sign NDA agreements with the industry only (ie: not giving value back to the public). In both countries the public opinion mainstream media is (has been?) ... Facebook! And those enterprises (Facebook, Google, etc) have been cherry-picking the Free beers instead of being liable by law for whatever happened to whoever have been using their services and devices, then providing fake solutions (ex: Facebook announce to not force people into using their real names, Google declaring availability to de-index personal data, modern web puppies burning public money for privacy class actions against Facebook) instead of being liable for whatever happened using their tools. De-list Facebook/Google and whatever marketing firm from the stock markets: they are a cost, not a stock. And the good-companies have been already rebranded; you betting your money on trash. BTW, thank you to have accounted the robbery in a company register: we know exactly how much money must come back. + +## Checklist. + +> (WARNING: grandpa's paradox alert, time screw ahead) During the last Republican presidential debate in which he participated, Rand Paul condemned the National Security Agency’s mass collection of Americans’ telephone records, cautioned against reckless intervention in Syria’s civil war, and declared that a "true fiscal conservative" must "look at all spending" for savings, meaning the military budget is not sacrosanct. The Kentucky senator also called for criminal justice reform, touted body cameras as a way "to protect both officers and citizens," and bemoaned the racially disproportionate impact of the war on drugs. ( [Jacob Sullum](http://nypost.com/2016/02/09/why-republicans-will-miss-rand-paul/) ) + +Findings: + +1. From a second generation republic citizen's point of view it's just weird for someone to be willing a republic. I've been looking at federations - US included - as an example to follow! Neighbor's grass is always greener. So I can't understand why they called themselves Republicans; it's something too deep in the american culture and history. The italian republic too was born after a kingdom; before the transistor was invented. But I might have written Rand Paul's speech: we are both pretty unpopular, but he looks wealthier. What I have more than Rand Paul is ... that I'm not a physician: he probably got interest in those subjects when he spotted the results on the bodies and the minds of his people; I've got suffering all trough instead like a guinea-pig, and repeating at every electoral term, up to the need of a bunker, a full auto rifle, 2 smoke grenades, 2 flashbangs, a shoe stinger, and a fully armed [A129](https://en.wikipedia.org/wiki/Agusta_A129_Mangusta) on the roof. And the time to learn how to use all that scary stuff. +My favourite italian party in Italy up 2000 had been the Partito Radicale; then [they spammed my mailbox using Buongiorno.it mailing-lists](https://it.wikipedia.org/wiki/Buongiorno_%28azienda%29#Controversie) - that I subscribed to get a daily morning fortune cookie, and I've found myself into the [Spam S.p.a.](https://en.wikipedia.org/wiki/S.A._%28corporation%29) - I dropped that party too, and started to write (for free) for the small IT-tech newspaper that have been sued by Buongiorno.it, and had to reimburse 51k to a company that openly violated the privacy law (but the judges didn't know what they were doing; they probably considered the fact that all the subscribers did it on voluntary basis without considering that we subscribed to get a cute daily fortune cookie, not their whatever propaganda). +I started to file copliants to the Italian Data Protection Authority - ask [Giovanni Buttarelli](https://en.wikipedia.org/wiki/Giovanni_Buttarelli) to dig into the [authority](http://www.garanteprivacy.it/)'s archive, he was the cancellor signing the docs I received; and no, you can't do it yourself because [they](https://en.wikipedia.org/wiki/Giovanni_Buttarelli#Italian_Data_Protection_Authority_and_the_European_Data_Protection_Supervisor_.281997_-_present.29) probably removed the archive by now - up to the 2003 mod to the privacy law that made us impossible to continue (to allow marketing, profiling and then anti-terrorism, instead of our rights); and when I figured out that the law was not just the 'compacted version' (a 'TU', 'testo unico') to group and harmonize the first 2 years of Berlusconi's gov, but they abused of the public trust to push their shit deeper in my throat (adding un-advertised details to the TU), I went down one layer and started to build a wireless network to bypass both the public laws as a whole, and the wired shit (black boxes in the national internet's peering points). Did I ever tell you that I don't like the marketing departments? + +Ok, I tell you: I have an audio recording of the mayor (a lawyer) in my hometown, ten years later (2010), saying: "I want to do your network, but it must be self-sustainable: can you push ads on the webpages?". I know my chickens; so I went there already recording. Two weeks later: "I aaaaaam so sorryyyyy... we already signed a protocol with the provincial authority" (call the town council secretary asking for the docs) "look, see? This document is the one we signed 2 weeks BEFORE you came here". When I arrived there he didn't know anything about; two weeks later he signed a doc three weeks before. I know, it looks like I messed up the verbs according to the english grammar; no, I didn't: this is the almighty provincial administration's "[Progect Innovascion for All](https://newmediologo.wordpress.com/2008/07/31/provincia-di-roma-pianoinnovazione-internet-per-tutti-2/)", an excerpt: "Given the fail of previous experiences like RomeWireless we would like for this New [Dismaland Progect](https://en.wikipedia.org/wiki/Dismaland) to be made by someone coming out from the internet society and being advertised on Facebook and other internet's marketing tools". +The page I linked is a fake; today it shows a 31 July 2008 date; it is pre-dated; they can't remove items like "RomaWireless" and "Provincia Wireless Spa" from public registries (because money have been allocated, assigned, and spent), and they can't deny their past existence on the internet only, because it would reveal an off-side-track manipulation of facts, so they fake the page contents on every ex-post modifiable media, using external references (ex: cascading style sheets) to avoid for a single [Blade Runner](https://en.wikipedia.org/wiki/Blade_Runner) to rebuild the entire story. I can write a spider that does it for me; but there's no need of. The internet, fully enclosed in bunkered datacenters ("the cloud"), without a blockchain-alike public system, is just perfect for that kind of off-side-track activity. +The IT guy is not a lawyer. I noticed that the article look like a fake because I knew the real story. It's a long story, and hard to drink daily. So I went to look at the date and I noticed the time screw; I tried to highlight the date and it was not possible; so I went to the code and I've seen a plain H1 tag; so I went to check the CSS; and so on. A lawyer instead would stay at the fake date, triggering a worthless court case (ex: defamation of his own religious, political, whatever party), that would be off-side-track adjusted on the run as soon as an higher authority (ie: the one that manages the external resources like the CSS that added the fake date; the United Nations's spokeperson Laura Boldrini as Head of the Chamber of the Deputies?). [Shitstorm](http://mfp19.github.io/2016/01/06/Epiphany.html#notactivist). Shitstorm [up to the blondies](http://roma.corriere.it/notizie/cronaca/16_febbraio_08/finisce-procura-guerra-colpi-tweet-maria-de-filippi-milly-carlucci-7c7a3446-ce92-11e5-8ee6-9deb6cd21d82.shtml): [the actress](https://en.wikipedia.org/wiki/Milly_Carlucci) (note her "Order of Merit of the Italian Republic") sister of the MP trying to ban the anonymising practices (note: Gabriella Carlucci, that probably doesn't exist; my memory my be failing but the Carlucci's sisters were 2, not 3; this would explain the medal of honour better than the UNICEF stuff), accusing [Maurizio Costanzo](https://en.wikipedia.org/wiki/Maurizio_Costanzo#Personal_life)'s wife of triggering internet's mass mobbing, in order to win the 'The most social TV show' Prize. Noblesse Italien. I don't know if it is a real article, a gossip journalism invention, or they are seriously bothering a court (and make us pay) for that ... but I'm rolling on the floor laughing. + +Note: the bombing of Costanzo's car (or alike) in the early 90s is not reported on his en.wikipedia bio; it could have been fake, or it could be the [sicillian-medic-then-politician](https://en.wikipedia.org/wiki/Salvatore_Cuffaro) that made a drama in one of Costanzo's shows a few days before Costanzo's murder attempt, and at the time of two judges where bombed in sicilly, has been released from prison a few weeks ago after a 7 years partly-suspended sentence for 'externally facilitating the mafia association'. At the time of the Costanzo's bombing someone said that [CIA](https://en.wikipedia.org/wiki/Frank_Carlucci) was involved too (in Berlusconi's 1994 victory); today looks like Carlucci sisters had an ancestor (Frank Carlucci linked above) serving as an ancestor of Dick Cheney, wikipedia say "16th United States Secretary of Defense". The more I dig the more the US Department of Defence look like the Vatican Library. I can notice only that the italian wikipedia reports correctly the facts, instead. + +Anyway, back to my story: I took the chance of my personal shit, to send also the mayor's recording about using ads to economically support the build-up of a wireless network, to the professional lawyers association asking for the pre-auth of a public defendant (for my shit). Because their ethical code prohibits the abuse of their profession, inside and outside of the courts: if you manipulate the dates of a public document, you are not only abusing of the law practitioning as a whole, but there's the chance that you infringed also some public law in order to get the public money; even worse if it happens for you to be the mayor (ie: citizen, lawyer and public officer); it's the same thing my GF and/or her professor did, and it is a crime defined in the criminal code as "fake public act". +Because the lawyer association must archive the data they received in order to grant the auth to hire a public defendant; and having that recording on a DVD (write-once) off side track (a different office, for a different process) ... it would have been the only way for me (recap: no money, no car, living with psychos, nailed by another two fraud lawyers, and having the cops seizing by design IT stuff for whatever reason and destroying data at the end of the (fake) trial; in my case the excuse for the seize was "he could have revenge porn") to keep those memories safe, far from me, and under institutional eyes. Indexed and Certified (as something else, but the public stamp has a date; it's an old white collar's trick to get a certified date on a piece of paper). But nobody knows they existed and where to find them; except me. Smile please; it's cool. And call me Bond, Michele Bond: fried white collars are crunchy. +Now note the sentence translated above, I simplify it: "because we failed, we want for some fresh cheeky puppy, one of our kid only - o'monne have to stay in the fammele! - to clean up our shit using Facebook"; and the online doc is predated. Today, 3 years after I openly talked about the predating of the mayor's public document, it is predated. You got it? Perfect: [three nested layers of time screwing](https://en.wikipedia.org/wiki/Inception). The third created after BitCoin showed incredible resistance to cracking attempts. +Accept my advice to watch the movie; it's a good sci-fi action movie. But PLEASE, keep your feet on the ground, because this is not a movie; it's my life, and I'm not Alan Turing: not a gene, I don't work for the militaries, not dead (yet), nor willing to have post-mortem royal pardons for something I didn't and I'm not. + +2. As you might have noticed reading above, on the information side of the story instead, things are shit; from liberal arts to formal systems (ex: judicial). +> Those aboard Titanic were ill-prepared for such an emergency. ([Titanic](https://en.wikipedia.org/wiki/RMS_Titanic#Sinking)) +I didn't understand what happened at Charlie Hebdo and I didn't comment it. If artists have fear to express themselves, their anonymity can be enforced and their offices dematerialised; it's never been a capability problem; political only. [Banksy](https://en.wikipedia.org/wiki/The_Son_of_a_Migrant_from_Syria) have no name at the public registry. And they are mostly unknown already: I've never spent a minute reading the names at the end of a movie, or on a CD cover. The best artists are unknown outside of the showbiz ([jetset](https://en.wikipedia.org/wiki/Jet_set)). Slang changes, its words look better for a while, but our brain didn't evolve in the past 5000 years: we are monkeys. +> In accordance with accepted practices of the time, where ships were seen as largely unsinkable and lifeboats were intended to transfer passengers to nearby rescue vessels, ([Titanic](https://en.wikipedia.org/wiki/RMS_Titanic#Sinking)) +Things turn difficult because of the institutions: a lot of the security framework is built on the denial of anonymity. +> Titanic only had enough lifeboats to carry about half of those on board; if the ship had carried her full complement of about 3,339 passengers and crew, only about a third could have been accommodated in the lifeboats ([Titanic](https://en.wikipedia.org/wiki/RMS_Titanic#Sinking)) +And it become impossible at Assange/Snowden/ecc level. From my perspective instead of extradition treaties there's the need to build a sort of "voluntary detention facilities" to keep safe people awaiting for their fair trial on-going in another country; a neutral protocol that protects from the beginning to the end of the trial, set timings, and pays the expenses. Assange (ecuador, english and donors, paying for his captivity) and Snowden (russian and donors, paying for his captivity) stories led the modern way but there are older protocols that may work as drafts. +> The crew had not been trained adequately in carrying out an evacuation. The officers did not know how many they could safely put aboard the lifeboats and launched many of them barely half-full. +By enforcing the mass destruction of our constitutional rights backed by the natural arrogance of policing everything typical of the beefs in uniform on the paybook of the proofitering gluttons, they increased the decadence's speed by a few orders of magnitude - and I'm sure the Japanese were laughing at europeans - making insufficient the amount of money pumped in from the central banks. When they figured out that it was not possible to grant relocation money to every teenager making a blowjob on cam - because kids could make it on purpose to escape from their very own shithole - to transport her/him in some religious remote monastery on Mars (because closer ones are filled up to the roofs); they turned the public policies upside down: [Facebook allows for fake names](https://en.wikipedia.org/wiki/Facebook_real-name_policy_controversy#Compromise_to_protect_those_with_special_circumstances), [Google's de-indexed on request](https://en.wikipedia.org/wiki/Google_Spain_v_AEPD_and_Mario_Costeja_Gonz%C3%A1lez), [Italian Police advice parents to instruct the kids for being Anonymous](http://www.commissariatodips.it/da-sapere/per-i-genitori/navigazione-sicura-e-consapevole-dei-minori-su-internet.html). + +My father (a psycho and a medic, a psycho medic) call this arrogance "[Mr. Clean's Syndrome](https://en.wikipedia.org/wiki/Mr._Clean)". And I agree. Those policies can fix cases where a teenager's phone number has been written in a highway's toilette, because the toilette doesn't move and have a limited amount of local clients. Today is a bit more complicate. You need to be anonymous in order to stay safe. + +Finally, no, I'm not curious about [the moscow mechanism](https://en.wikipedia.org/wiki/Giovanni_Buttarelli#Moscow_Mechanism_.282010_-_2017.29). AT ALL. I've been asking for more Edwards (Snowden) to be protecting us a few years before this wiki page had been written on UIkipedia. [cherry-picking our butts](https://en.wikipedia.org/wiki/Sal%C3%B2,_or_the_120_Days_of_Sodom) + +> The film focuses on four wealthy, corrupt fascist libertines after the fall of Benito Mussolini's Italy in July 1943. The libertines kidnap eighteen teenagers and subject them to four months of extreme violence, sadism, and sexual and mental torture. The film is noted for exploring the themes of political corruption, abuse of power, sadism, perversion, sexuality and fascism. It has been praised by various film historians and critics and Salò was named the 65th scariest film ever made by the Chicago Film Critics Association in 2006 and is the subject of an article in The Penguin Encyclopedia of Horror and the Supernatural (1986). + +If you are sensitive to sex, ultraviolence, pedos, or whatever ... don't search for that movie. Some psycho might be patrolling your device, your side network, the search engine, any of the network devices in the middle, or the server; and it can be even worse: there could be 1 psyco per each of those Points of Failure. You could end up being an inmate's piss pot in a prison and never realise why. Or worse. You click - "he likes ultraviolence!" - and you're fucked. +Buy this advice from a friend that knows a bit about [Information Overload](https://en.wikipedia.org/wiki/Information_overload): it took me 10 years to watch half of that movie, 10 minutes at a time, 2 years pauses in the middle, and each time new psycho hookers all around (computer-driven, and in person). That movie is even hard to find; when you get it you'd better (try to) watch it before it disappears again: it would trigger any censorship in place anywhere in the world. +In an IPFS raw system 33% of population would not cache it because of the violence, another 33% because of sex, 33% for misc political reasons, and the 1% caching that movie would be risking death without knowing it. +Notice that its director has been assassinated and nobody knows if it was because of being gay, because making those kind of hard core movies, seen in a restaurant hooking a young boy, or his on-going investigations about some oil smuggling case of the time. + +I prefer [the Scary Movie legacy](https://en.wikipedia.org/wiki/Scary_Movie_%28film_series%29). But if you feel like 'I want an horror movie tonight' and you've been reading all this stuff, watch this one instead, it's about recurrent and recursive budget cuts: [Edward, The Lawnmower Man](https://en.wikipedia.org/wiki/The_Lawnmower_Man). Then try to figure out why I said that is about 'recurrent AND recursive budget cuts'. + +## Antelitteram. + +> "I don't want to live in a world where everything I say, everything I do, everyone I talk to, every expression of creativity and love or friendship is recorded." ([Ed](https://edwardsnowden.com/)) + +Findings: + +1. I don't want to live in that world too. [Some](http://netsukuku.freaknet.org/) [projects](http://www.olsr.org/) have been addressing this issues for many years. At [any](https://en.wikipedia.org/wiki/I2P) [layer](https://en.wikipedia.org/wiki/OSI_model). In [all the layers at once](https://en.wikipedia.org/wiki/Freenet) [when devices were considered safe](https://en.wikipedia.org/wiki/Abstraction_layer); [more than once](https://en.wikipedia.org/wiki/Tor_%28anonymity_network%29), every time new PhDs forgot a detail somewhere. When [all the commercial devices](https://en.wikipedia.org/wiki/Tails_%28operating_system%29) and [operating systems](https://en.wikipedia.org/wiki/Qubes_OS) were not considered safe any more. I tried them all; pretty interesting stuff. But too big to check it before use. + +2. I know that hearsay constitutes a contract as well; and we tend to ignore and forget it because it is impossible to prove it in front of others at later time (ex: in court). Mafia ignore, PhDs forget. + +3. TODO. + +## NotActivist. + +> Tiocfaidh ár lá (ga. "our day will come", [Bobby Sands](https://en.wikipedia.org/wiki/Bobby_Sands)) + +Findings: + +1. There's an overall 15 years delay between facts and current spy stories, mass-surveillance chronicles and [apparent institutional motion](https://cdt.org/blog/did-the-european-court-of-human-rights-just-outlaw-massive-monitoring-of-communications-in-europe/). Jon Postel died in 1998. Edward Snowden popped out in 2013. The same pattern from any other country perspective, ex. Italy: gov wiretapping black boxes appeared in the italian peering points (Internet hubs) in 1999, hacktivists reported ROS (italian military special forces) poisoning the BGP routes in 2014. In the middle 15 years of data retention and e-commerce boosting policies. Fare-Well Europe. + +2. Activists and Hacktivists are different animals. The italian [Hacking Team scandal](http://www.technologyreview.com/featuredstory/543991/the-growth-industry-helping-governments-hack-terrorists-criminals-and-political/) clearly highlights the difference: activists are worried about consolidated, mature, civil principles (ex: freedom of the press); hacktivists care about the tools to make (also) those principles real (ex: freedom of being anonymous on automated graph-walking networks). It ends up that a factory/gov baked [reduction of device's attack surfaces](#resources), that would benefit both et all, is not even on the horizon of all those activists complaining for journalists spied. The little snitchers, whistleblowers, journalists, issue ... is a second tier issue. And, sadly, far from the masses as well: today even rocks and plants know to be monitored, but they are the only ones to not have anything to hide. And criminals do not rely on those information tools; they have guns, don't need a smartphone for their business! Activists cannibalize hacktivists and fuck both. + +3. The end result is a completely unreliable view of facts built on word of mouth, tagged by hearsay, and managed off side track even easier than before: [extraordinary renditions](https://en.wikipedia.org/wiki/Extraordinary_rendition) are easier today than before. Some evolutions (ex: the next stages of Shenghen Treaty) deleted without replacement foundamental details (ex: 26 indipendent giurisdictions able to grant asylum to people like [Bobby Fisher](https://en.wikipedia.org/wiki/Bobby_Fischer#Asylum_in_Iceland), Julian Assange, Edward Snowden; 26 indipendent land executives working in parallel on exceptions management). Despite the wide experience matured in the human history - ex: the huge amount of existing voting systems - today's Entscheidungsproblem (decision problem) is solved by simply sticking on one side and shitting on the other one to keep ruling the game: "for not being part of the blood-sucking mosquitos, we are part of the shit-eating flies" (Natalino Balasso, comedian; see below). Medias are enough to play this game; there's no actually need to work the problems out; once the storytelling is pumped in. A so thick amount of shit on this wall, that [Peppino Impastato](https://en.wikipedia.org/wiki/Giuseppe_Impastato), and Bobby Sands, died again. And we, today, are diying too. +The italian case reported in this chapter - seizures of hacktivists resources and their claims of connections between right wing activists and police - shows the last results of the shitstorm gone institutional when the current President of the Italian Republic - Sergio Mattarella - and the parliament of the time, in 1993, changed the 1946 voting law into a majority-based one; leaving in the proportional system the 25% of seats only. And barring minorities from having a representative: the Casa Pound far right extraparliamentary movement is one of those minorities (0.5% at 2013 general election) today. Who ever have been supporting the "digital rights" is one of those minorities as well; and it is orthogonal to both [the political and economical spectrums](http://www.politicalcompass.org/euchart) (ie: left/right wings division doesn't make sense at all because all of those need message integrity). In 2005, the second step toward the majority rule, excluded direct choice of representatives. To recap: no minority can be represented, the majority rule forced people to take one of two only sides in order to be represented, representatives are predetermined; without the checks&balances typical of the majority-based systems (ex: UK). Turning the whole voting machine into a mere confirmation ceremony without any chance of choice. In 2014 the constitutional court voided the 2005 voting law mandating the current parliament to restore the connection between the people and representatives (art. 1 Constitution: "The soveregnity belong to the people"). The 2005 voting system produced a fully symmetric war. As a result of the long lasting repeated retaliation both sides have been active in accessing public funds, protecting their own self-recognised values and individuals accused/victims of judicially relevant cases (up to rapes and murders), stepping on each other's toes, [SWATting](https://en.wikipedia.org/wiki/Swatting), and accusing each other of all and any woe. Shitstorm. +Since the 1994's police operation Italian Crackdown the digital rights have been dragged into this political war thanks to the (damned) political activists that have embraced and endorsed different aspects of those rights ONLY. The Autistici/Inventati digital rights association raided in 2005, has been raided again in 2010 on call of Casa Pound's founder Gianluca Jannone because the Avezzano's local branch president has been threatened with messages painted on his home. Shitstorm between (forced) minorities. +Both of them paid something, bothered the norwegian authorities, without results (no identities found), because of the prosecutor office not taking into account the damages of its investigative action; creating debris (A/I activities disruption) on top of damages (Casa Pound's representative threatened in his home). +The only relevant fact is the constant, historical, over-reaction of the authorities every time a computer is involved (ex: "public prosecutor in Avezzano sent international rogatory letters to the Netherlands, Norway and Switzerland, where it has servers"); the constant, historical, public expenditure for this over-reaction; the constant, historical, lack of accessible public logs about this operations (ex: what is the connection between the threats received by Casa Pound in Avezzano, and the seizure of A/I servers in Norway?); the constant, historical, lack of reimbursements for the people whose rights have been judicially violated because of those operations; the constant, historical, cover-up of those not-reimbursements to preserve the idea of justice. That in turn spread the fear of state mandated death orders (off side track, hidden to us): we, the people, have no access to empirical evidences before the trial (ie: preliminary investigations), during the trial (ie: the law banned the journalists from the trials), and after the trial we receive those reports on the web by unknown and unverifiable sources (!). + +4. Once again today, the once called "digital rights", and the hacktivists, are the major victims of this ongoing war: "to obtain data that they had not been provided by A/I's legal representatives. A/I stresses that it did not possess the information that the Italian police sought. The Norwegian postal police visited its ISP's webfarm and copied the disks, whose contents are mostly encrypted". And our resources exhausted. + +## NotPublish. + +> (TODO, find the german version) "Se uno Stato mondiale abbracciasse tutto l'orbe terracqueo e tutta l'umanita', per cio' stesso questo Stato non costituirebbe piu' una unita' politica, e si potrebbe chiamare Stato ormai solo per modo di dire." ( [Carl Schmitt](https://en.wikipedia.org/wiki/Carl_Schmitt), Der Begriff des Politischen, 1932) + +Findings: + +1. "If a Nation would embrace the whole Earth and all humanity, because of being one only it would not be a political unity any more, and could not be named 'nation' any more." + +2. "If a Local Village would embrace the whole Earth and all humanity, because of being one only it would not be a Village any more, and could not be named '[global village](https://en.wikipedia.org/wiki/World_Social_Forum)'." + +3. I can't translate it. I tried also with 'dollar' and 'AS Roma' instead of 'nation' and 'village'; but it doesn't work. And Google Translate is even worse: I can't read german but the results didn't look good to me. Do you know [Altiero Spinelli](https://en.wikipedia.org/wiki/Altiero_Spinelli)? The word 'spinelli' in italian today means 'spliffs' ("more than one little cute marjuana joint"). And it looks like in EU there's not enough Spinelli today: no federation, no spliffs. Supernation and cocaine instead, plenty. And in US looks pretty similar: watch [John Oliver's Last Week Tonight about State Legislatures and ALEC (HBO)](https://www.youtube.com/watch?v=aIMgfBZrrZ8). What I'm saying is that you can classify using weed and cocaine users and you get the same results of using any other bipolarism (examples: libertarian-authoritarian, liberal-communist, guards-robbers, ecc): "Penetrate The Internet (and own it)" and "Save The Internet (in our NSA storage facility)" togheter will just make Ya[FuFme.com website](http://www.criten.org/mirrors/fufme.com/faq-use.html). + +4. And no, by making it more complex (ex: using [12](https://en.wikipedia.org/wiki/Personality_type#Carl_Jung), or [16](https://en.wikipedia.org/wiki/16PF_Questionnaire), instead of 2 only personality types) doesn't work either. It just makes the things more expensive, unless you spy us all, from public habits to the way we use a finger to clean up our ass in those intimate moments. And I suppose that installing a camera inside someone's private toilette can easily be considered a privacy violation about everywhere since [Lucy](https://en.wikipedia.org/wiki/Lucy_%28Australopithecus%29). Can't even calculate instead how much it cost to place a camera close to every tree in every public park, private bush, or wild jungle; I made similar math before, but it was for faster changing envs and objects (radios on highways and radios in densely populated cities); can't transpose the same results to this case study. There are [pretty impressive CVs around the world about this stuff](https://en.wikipedia.org/wiki/Sean_Young_%28psychologist%29). But no, it doesn't work for everybody. [Both psychologists and psychiatrysts tried with me too](http://mfp19.github.io/2015/08/24/Integrity.html) (look at the lombrosity.com part), and [it didn't work](http://mfp19.github.io/2015/08/19/HelloWorld.html). + +5. That's why I think that some countries - ex: India, China, US, South Africa, UK ... whoever tried to protect minorities - might have developed better policies, at least some policies are world best practices and fairly exportable: italians are 6 recognised ethnic groups only, plus nomads (ie: minorities that would not be able to reach public formal recognition; gypsies, immigrants, people previously hospitalized, arrested, and carcerated), and we are [analitically profiling each other](http://mfp19.github.io/2015/12/26/Profile.html#behavioural) and [killing each other like animals](https://en.wikipedia.org/wiki/27th_G8_summit#Charges) since [the last openly recognised ethnic purge](https://en.wikipedia.org/wiki/The_Holocaust)! In EU it's about the same (26 recognized ethnic groups). Instead places like China have 56 publicly recognised, over about the same land, since... ever? I'm sure they have their own problems as well but it would be nice to not always have poorly translated texts from intermediaries only. Given that Forrest Gump made peace with China in the 60s, we should have had their news on european TVs since the 80s, and some of them happily married with us already! Not just [Bertolucci's movie](https://en.wikipedia.org/wiki/The_Last_Emperor) about the previous chapter of their history, and chinese restaurants! It looks like a few weeks ago the chinese community in Milan went for the very first time to vote; in 2015; it's a first, shy, step. Hopefully, by enforcing the [Internet Sans Frontieres](http://www.ietf.org/rfc/rfc3271.txt) and adding [sans psychos](https://en.wikipedia.org/wiki/Psychologist's_fallacy) at this turn, [our retirement will be better than the previous ones](http://rfc3271.org/vinton.html): they look good in those pictures, but there are no girls! It is some sort of sausage party! The good news are that girls have been appreciating math and sciences more in the last decades; we could have more than the previous generation in our parties after retirement. + +6. Anyway, some things are pretty scary and the resulting couriosities will never be resolved. Hopefully. I haven't found a way to survive yet; and moreover I am a minority; can't have more curiosities. A lot of people tried to define a sort of "internet generation", and politically abused of us: serve to their partisan purpose or be classified as monsters, pedos, spies, vampires, snitchers, killers, rapers, dumb, pervs having Umbrella Corps to live in rich DarkNets. Except for pedos, that is a bit infamous, I wish it would be true; unfortunately it is true only for IT Guys that worked for companies serving the technostructure (and all its abuses) and the wages of the technostructure (managers, lawyers, creatives) are higher than the IT Guys ones. The ones that stalked us in order to have our detailed profiles, and stolen what we had to share calling it crowd-sourcing, kept going. And this is not acceptable. + +7. The big question mark about those articles reporting politicians speeches is about the meaning of their talks; the implicit limits of the media, limit the chance to entirely report the meeting described in the articles; and in turn, the implicit limits of existence, limit the chance to entirely understand another behing. Both Donald Trump and Xi are, at least, partly correct. In both the examples I picked in this chapter. Some picks are ilarious ("We must penetrate the internet": man, your phone is part of the internet and ... your good guys at uni don't want to penetrate themselves, they won't help you unless you raise McNamara from his grave, dress him in high military uniform and send him to lie in the universities), some others are scary ("Computer security: no double standard", which one? I mean, which standard? Layer1-7 or Layer0&8?); they both sound like ultimatums. Ultimatum to what? It's just normal that human rights association have fear about the ultimatum is against the human values; but if you add "computer security" in the sentence, you understand that have not much to do with legacy human rights. It have to do ALSO with human rights; among those, the privacy one can sum them up all. But there are also money in/on it. And I'm not talking about digital currency (ie: credit cards) or digital cash (ie: bitcoin); the first one is strongly enforced by gunmen; the second one is strongly tracked. About money I'm talking about the illusion of sales; the illusion of popularity; ecc. + +## Standing. + +> During a symposium held for centenarian [Albert Hofmann](https://en.wikipedia.org/wiki/Albert_Hofmann), "Hofmann revealed that he was told by Nobel-prize-winning chemist Kary Mullis that LSD had helped him develop the polymerase chain reaction that helps amplify specific DNA sequences." Replying to his own postulate during an interview for BBC's Psychedelic Science documentary, "What if I had not taken LSD ever; would I have still invented PCR?" He replied, "I don't know. I doubt it. I seriously doubt it." ( [Kary Banks Mullis](https://en.wikipedia.org/wiki/Kary_Mullis), Nobel Prize-winning American surfer ... and biochemist) + +Some things - ex: human brain and computers - are exactly the same world wide. + +* [Intel x86 considered harmful - Joanna Rutkowska - 1.0 - October 2015](http://mfp19.github.io/resources/x86_harmful.pdf) + +> Sadly, and most depressing, there is no option for us users to opt-out from having this on our computing devices, whether we want it or not. The author considers this as probably the biggest mistake the PC industry has got itself into she has every witnessed. + +* [State considered harmful: A proposal for a stateless laptop - Joanna Rutkowska - 1.0 - December 2015](http://mfp19.github.io/resources/state_harmful.pdf) + +> Personal computers have become extensions of our brains. This symbiosis is only going to strengthen in the years to come, and not just metaphorically! The +author believes it should be paramount for humankind to ensure we can trust our personal computers. Unfortunately the industry does not seem to share this opinion. + +Those Rooty's documents, grouped with the modern arts masterpieces (Kim.Com, Assange, Manning, Snowden), the Anonymous bitcoin developers, and the well known Ethereum developers complete the millennium job. Theoretically, at least. Most of the findings Joanna Rutkowska had about the Intel silicons are exactly the same for all the other families of consumer silicons (AMD, ARM-based, etc) as a result of the current commercial and military policies. Most of the findings Joanna Rutkowska had about laptops are easily applicable to the smartphones and any other mobile device. And currently we are using those tools. + +Some other things instead are different and their mashups pretty psychedelic + +* [2015 Ambulance Chasers's Call to Arms](http://mfp19.github.io/resources/Delibera_19_2015_Astensione_30.11-4.12_def.pdf) (Italian lawyers reporting fundamental abuses in the judicial system), and the [sanitized version](http://mfp19.github.io/resources/lawyers_absents.txt) of it (mentally sanitized: bare text file, git hashes it). + +> once the modern age push has ended even in the criminal judicial context, the on-going new political patterns and the new kind of judges that interpret not only the law, but also the scope and the values of the law, produces an incremental destructive crisis for the rule of law (it. "legalita'") and limitation of law (it. "riserva di legge") principles. It is impossible to accept these huge challenges using the existing tools. + +Try youself to use "existing tools", it's better than LSD. If you're not an italian citizen and you want to have a go I allow you to use my face-ass... mmm... slapfac... my ID. Here the starting kit + +* [2016 Ambulance Chasers's public funded legal aid HOWTO](http://mfp19.github.io/resources/Manuale_Gratuito_Patrocinio_1.3.pdf). Follow the steps in this guide to get to the constitutional supposed-to-be right to defence for me. Note that the guide was written by a lawyer in Milan but ... nobody knows if it works somewhere else too. My 'natural giurisdiction' in theory is [Velletri's courthouse](http://www.tribunaledivelletri.it/); but the correct 'natural giurisdiction' changes depending on ... many factors; and because the individuals to bring to court are many and scattered anywhere... it's pretty tricky to figure out what 'natural giurisdiction' you can apply to. If you feel more comfortable with the courthouse howto instead of the lawyers howto, [here](http://www.tribunalevelletri.it/comefare.aspx?id_ufficio_giudiziario=1600&cfp_id_scheda=796) the Velletri's courthouse howto. I did this part twice and is not that much fun; it's more [LSA](https://en.wikipedia.org/wiki/Ergine) (a light depressant) than LSD (a powerfull psychedelic). In any case don't cheat: you must get legal aid without paying a lawyer to do it for you, because as it is stated on the howto, all the preliminary costs are not covered by the public funded legal aid. Good luck. +* [2016 Ambulance Chaser's contingency fee agreement](http://www.pattoquotalite.it/). As an alternative to the public funded legal aid you can try the contingency fee agreement. Consider that such agreement has been strictly forbidden for a few decades; then enabled in 2007; then forbidden again around the year 2012; then enabled again. I've no idea if someone ever did it but if you feel brave, fuck yeah, go for it! Lawyers tend to avoid that agreement because they know the current state of the judicial system and they don't want to take any responsibility of it; but they won't tell you as far as they can find fresh meat using the state mandatory lawyers price list. Good Luck. +* [2016 Ambulance Chasers's registry of free public defenders](http://mfp19.github.io/resources/lista_grat_patrocinio2.pdf). Once you got the money to pay a lawyer - and usurers are not an option - the second step is to choose a lawyer in this list. It is the registry of lawyers - the only lawyers - enabled for public legal aid in my 'natural giurisdiction'. If, for some reason (ex: the counterparty is poorer than me, it is a family member in another place, or a judge, or whatever that changes the 'natural giurisdiction'), you figured out a different courthouse, well, don't worry anyway: there will be another lawyer's registry to dig in! Just remember: if you hire more than one lawyer the public legal aid is revoked and you must pay everything (backward too!); you must repeat the full procedure instead, one per every lawyer you hire. After have called them, took appointment, brought the papers to them, and repeated quanto basta... If you have found a lawyer, and you have managed to make him/her prepare all the papers, you made me curious: it never happened before! Please call me and I'll probably sign the power of attorney. You deserve it: the amount of time and money you've already spent is ... I admire you. I could not make it. Good luck. +* [2016 Ambulance Chasers's list of 'technical consultants'](http://mfp19.github.io/resources/consulenti.pdf). Once you got both the public funded legal aid and a lawyer willing to work, you must find all the court authorised consultants: accountants, medics, IT guys, ecc. This is the registry of authorised consultants published [on the same website](http://ordineavvocativelletri.it/it/index.php?page=patrocinio) I took the list of lawyers above: they are all psychologists. Psychologists only. Any reasoning is excluded from the trial: drama only. Evidences are banned. They simply don't exist in Italy. Nobody have seen anything. Everybody feel anything. A country of law lovers. With a constitution mandating empirism. Basically you must find a good certified storyteller that interpret in your (my) favor instead of hearing me (and whoever else). + +Please note: [the courthouse states that the website is 'handicapped friendly'](http://www.tribunalevelletri.it/accessibile.aspx). You, without handicaps, can't fail. Court self certified. + +Do you remember that movie, [Fight Club](http://www.imdb.com/title/tt0137523/): a guy with a psychiatric relevant medical condition - I don't like the word "schizofrenia" - one day enters his boss's office, tries to extorce a better wage and his boss call the building security to kick him out, so he starts to boxe himself in his face and fall on purpose over a crystal shelf breaking it, as well as breaking his back. When the building security officers arrive, they find the employee on the floor bleeding over thousands of glass pieces. As a result his boss is jailed for assaulting one of his employee and he gets a good stack of money from insurances and alike. +There's also the other movie with Sharon Stone... and the other one with Madonna... the one she goes doggy on the desk after have cooked him for a while, to make the cop fuck her brutally, then she run to the cop station saying he raped her... + +We are all doing something similar every time we use a telephone: fixed, mobile, dumb, smart ... producing mass-schizofrenia (or the more popular 'paranoia'). I wonder how many people killed each other for that (ex: "he busted me!", and he hadn't). The sad part is that law is unable to fix it; the cost of law, become business, driving justice into an obnoxious mix of deep disproportionate prevention and unfair punishment. Forcing us to avoid any reasoning about that; rely on our senses only, day by day. Psychedelic. + + + +I've been on LSD once only - pitiful me - I took a third of a dose and ... I've been going around the same building of Amsterdam all the night long. Hand in hand with my two buddies (and I hate that! It remembers me the priest at school mandating us to go around hand-in-hand!). Buying an hot-dog at the corner of the building on every lap. Before yelling at the building because was not moving so I couldn't find my home. Then having any kind of fobia for not finding my home. Until, once back in the room, every time I closed my eyes the picture in my brain was a screen split in 4 sub-screens, with a caleidoscope in each, then washing the face, drinking some orange juice, and back to bed again; repeating the caleidoscope-washing-juice until I finally falled asleep. And advicing to use magic mushrooms (ie: a light psichedelic that can be stopped eating fruit sugars) instead of LSD, to all the other youngsters, in the years up to now. I didn't invent the PCR like Kary Mullis, or any other scientific miracle, but I hope you're laughing: that's the good part of sharing integral memories. Free Message Passing. And I love this memory - thanks Mr. Hofmann - but I still don't understand why people like psychedelics. Weed is so comfortable, cheap, unharmful... sweet, and makes you sleep before you get to the idea to drive the car. Moreover I've found a much better psychedelic than LSD: the judicial systems! Once your destiny is locked in court, you start to act like a rat in some kind of experiment run by other humans. Everything in your life changes. That's why I can understand parenthood: parents buy a gun to protect their family, after I got the cops at home I've slept with a knife under my mattrass (ie: searching for weapons for the very first time of my life); parents can't sleep because the kids are crying, I couldn't sleep because my parents were crying; parents bother the governments to censor the Internet, I've bothered the government to censor the parents. And so on. Without the need of any drug. And after have provided full stack solutions: from radio signals to constitutions running on top of those signals. + +I can't yet really state whether is better the 'preventive jail' the germans did, or the 'preventive psychoshit' the italians did; I tried the italian part only and no thank you, don't want to try the other one too. I feel sick enough already. The only thing I'm sure of, is that they are both abuses, both for the Italian Constitution and My Constitution. And if you call the european telephone number they will check the word "ombudsman" in your language and give you the telephone number of the one in your own country: I did that too. +Prevention is a concept that I hate in deep: I consider the [6-Day War](https://en.wikipedia.org/wiki/Six-Day_War) an assault from Israel to Egypt, I hated [Collin powell vial of anthrax](https://www.youtube.com/watch?v=jV5Ggfn9PYM), I hated [the programmers that administratively discarded Agatha's reports](https://en.wikipedia.org/wiki/Minority_Report_%28film%29). Prevention simply smells bad. +There will always be a frame, some void, between legit (ie: real/royal, it. "reale" for both words) and legal (ie: artificial); there will always be an [high rope](https://en.wikipedia.org/wiki/Tightrope_walking) to walk. Find your high rope, and walk it; it's a good breeze... better than Bacardi. I've been using the whole computer system as a reference - a balancing pole - to debug the judicial system - the wind - because science is more reliable than those fancy systems. And people, anybody et all, held it; held the rope. It simply can't be the opposite. Whenever it looks like the opposite, there's a human mistake or a BOFH (like the one that keeps playing the sound card test in my laptop now). + +Last but not the least, a few words to apologise for all the mistakes I might have done talking about things that I don't know enough, like the US and UK judicial systems and the people produced by those systems. + +By searching for the proper translation of the italian constitutional limit to the "common law", called "riserva di legge" - ie: given the constitution is the 'ordinem', the extra ordinem sources are sources outside the constitution; so the 'riserve di legge' is what limit the chance for the people to see habits and common opinion to be law - Yahoo found the book "[On the Limits of the Law: The Ironic Legacy of Title VI of the 1964 Civil Rights Act](http://www.amazon.com/On-Limits-Law-Ironic-Legacy/dp/0801848970)" + +> On the Limits of the Law is Stephen Halpern's compelling examination of the legal struggle to control the enforcement of Title VI of the 1964 Civil Rights Act -- the historic provision prohibiting racial discrimination in programs receiving federal financial assistance. Although the provision appeared to have immense power to fight racial inequality in education, Halpern argues, attacking the problem through legal rights and litigation distorted our understanding of educational inequality based on race and limited the remedies used to address it. + +And I tought that he addressed the same issue I played around in [Antelitteram](http://mfp19.github.io/2015/12/29/Antelitteram.html), [NotActivist](http://mfp19.github.io/2015/12/30/NotActivist.html), [NotPublish](http://mfp19.github.io/2015/12/31/NotPublish.html): "attacking the problem through legal rights and litigation distorted our understanding" of the current times. Giving ([AGAIN!](http://mfp19.github.io/2015/12/26/Profile.html#behavioural)) the fake idea that any behaevioural test - ex: "let's see if he can fix my TV's antenna before giving him a TV job", or "let's make my exam before giving him a PhD" - can give some kind of reliable result. Rats tested inside rat's traps. The same bullshit happens when you see a white/black guy and think he is a poor guy: why the hell you think that crap? We even invented a word for that phenomenon too: "positive racism". And there's people producing videos on the racial spectrum or whatever else: you write 'faggot' and you get the video to test you against gender discriminants. And then pushing those videos in your G+/Facebook/Whatever accounts to monitor your reaction, counting your clicks, etc. More rats testing other rats. We are far beyond that book nowadays. Far beyond the american and italian constitutions nowadays. Far beyond the "three-piece psychology and 1950’s technobrain". Where exactly I've no idea, but the same shit keep popping up from time to time: racial/gender/whatever hate, bullocks relying on psycho theories to diagnose, gov intelligencies believing in those diagnosis, miltiaries crunching&mincing whatever the intelligence said. [So we keep having and killing Jesse James](https://en.wikipedia.org/wiki/Occupation_of_the_Malheur_National_Wildlife_Refuge)! + +In any case that book, probably, can talk about the american common law system; better than [what I did](http://mfp19.github.io/2016/01/01/Standing.html), that's for sure. And because the racial issue is one of the most ... [bloody hell](https://en.wikipedia.org/wiki/American_History_X) ... ones, it could be a better lecture for any willing pupil on that part of the world. Because to fix the privacy issue there's the need of a provision that "have immense power" as well, and I have no idea what the american culture can produce for that purpose; the ital-european framework I grew in evolved, privacy wise as all the rest of it, in a somewhat different way. The only thing I could do was to find a previous real case, and point you americans to that american book. + +In any case my writing is open to contributions: please correct my mistakes using git instead of talking to me by other means, and complaining that the law is smarter than that... it's a torture for me: no, it's not smarter than that, it is more expensive only. And that public expenditure - the judicial overhead over the real damage's cost - is tollerable against blood facts only; not to protect copyright, patents, and other imaginary things. Even protecting the atom-property rights (ex: the Malheur National Wildlife Refuge) where one of those modern Jessies have been killed, cost public resources and lives. The bit-properties rights cost too much. The more complex the rule is, the more expensive the law is: smarter, more expensive as a result. + +Shall our ancestors be proud and the future smile to you all. Thank you all, for all those emotions. + +# Epiphany + +[The experiment side of the story](http://mfp19.github.io/about/) is ok, there are enough self-contained references to space, time, people, and their acts, scattered all around the git repository ready to be ported into a distributed blockchained version of it; I must remove the external references (ex: YouTube videos, external Websites, etc) and embed them into the repository itself, because there's no [resilient, high available, freely accessible, universal library in place, yet](http://mfp19.github.io/2015/12/15/Solution.html). Technologically wise is easy (IPFS is one of the many examples), but I can't figure out how to do it (again) without stepping (again) on some of that shit typically found in the [legal labyrinth](http://mfp19.github.io/2015/12/31/NotPublish.html#publish) that makes our lives impossible and harder than what should be: "my internet!" (Microsoft), "no, my internet!" (Google), "ok, our internet!" (Facebook), "sorry, I don't want to be your!" (Diaspora), "ok, your internet too, but money are mine only!" (Apple), "why money are yours only?" (Samsung), "because I came first!" (Apple-Samsung patents war), "and what about who comes after?", "After? What about who came before! They didn't make us trademark the word Windows and now Apple wants the words App Store?" (Microsoft) ... and so on ... and on, and on ... year after year ... + +> profiteering glutton + +after + +> profiteering glutton + +we (the people) invented the reptilians. And made fun of the people that invented reptilians: "paranoid!". And there was no need of inventing reptilians: we're not at radio age any more, + + + +If the radio had two knobs - George Carlin's advice to the reverend - [the internet have about 2 billion channels instead](http://mfp19.github.io/2015/12/31/NotPublish.html), and if that's not enough, there's also a way more effective capability to proactively filter out your customized idea of "shit" from your premises (only) to safeguard (more) the kids. The only thing that changed are the words to describe the + +> profiteering gluttons + +We could have invented something better than the reptilians, the phreakers, and the computer hackers nowadays! With the The Four Horsemen of the Infocalypse things got better (then the UIkipedians alone!) but ... again ... do we really need to re-write everytime aaaaaaaaaall the bible-like books again before getting to the point? + +Anyway: I have no idea of the final result, shape, content, of this writing, yet. I don't know how to make it comprehensible. + +> Joyce himself never defined exactly what he meant by epiphany ([The James Joyce Centre](http://jamesjoyce.ie/epiphanies/)) + +Probably some tools to linearize the hypertext - an index and a chapter summary - for printing purposes are enough. I'm used to jump from one point to another one, thanks to some pre-hypertext books I was hungry for, when I was young: fantasy "game-books" where you could drive your story by jumping from one numbered chapter to another one changing your own timeline, storytelling, wave of emotions. But humans tend to loose their patience when they can't grasp a clue; for me is true in front of some mind games, for others with "harmonic texts". + +> (3) Used to describe material which is deserving of (or will be subjected to) the degree of intense speculation and overeager viewing normally reserved for high quality pornography. + +We even invented the [Fourier transform](https://en.wikipedia.org/wiki/Fourier_transform) to grasp armonic clues, and then the discrete-time Fourier transform to account our reality by numbering the armonic clues, and then the fast Fourier transform to do it billions of times per second: nowadays it turbo-boosts the [Porn](http://www.urbandictionary.com/define.php?term=pr0n) delivery speed on our displays; chats and financial graphs included. It drives our planes, cars, motorbikes and go figure what else: more than the average understanding of the whole thing. + +> "What is so staggering about Ulysses is the fact that behind a thousand veils nothing lies hidden; that it turns neither toward the mind nor toward the world, but, as cold as the moon looking on from cosmic space, allows the drama of growth, being, and decay to pursue its course." ( [Carl Gustav Jung](https://en.wikipedia.org/wiki/Carl_Jung) cited on Wikipedia about [Ulysses](https://en.wikipedia.org/wiki/Ulysses_%28novel%29)) + +Did you get it? This page is a second iteration over all the previous ones. It's just a digest to help digestion. A re-hashing: you take the first letter, sum up with the second letter, and so on, producing 1 letter each 2 letters, from "Sah sah sah ... Test" to "Standing", to get "Epiphany". In the same way the MD5/SHA1-2-3/etc produces a fixed lenght hash to identify a bigger resource. And the whole thing presented as a collection of different data structures (index and structure) to humanly access the information repository. Repository that in turn does it at bit level instead of single letter level. It's trivial. + +# By the way. + +There's a funky italian song too! + + + +> Members are rapper J-Ax (real name Alessandro Aleotti) and DJ Jad (Vito Luca Perrini). In the spoken intro of Strade di Città, it is stated that the band is named after the article of the Irish constitution guaranteeing freedom of the press, although it must be noted that article 31 of the Irish constitution is not about the freedom of the press. They probably meant the Section 31 of the Broadcasting Authority Act. ( https://en.wikipedia.org/wiki/Articolo_31 ) + +Here it is + +> During the Troubles in Northern Ireland, 1968-1994, censorship was used principally to prevent Raidió Teilifís Éireann (RTÉ) interviews with spokespersons for Sinn Féin and for the IRA. +> ... +> In 1991, European Commission of Human Rights upheld the ban in case Purcell v. Ireland, though not unanimously. The Section 31 broadcasting ban lapsed on 19 January 1994 because it was not renewed by Minister for Arts, Culture & the Gaeltacht Michael D. Higgins, eight months prior to the August 1994 IRA ceasefire. ( [Wikipedia](https://en.wikipedia.org/wiki/Censorship_in_the_Republic_of_Ireland#The_Troubles) ) + +And we have also our George Carlin too! Ladies and gentlemen, Natalino Balasso, "[a Light That Burns Twice As Bright](http://www.imdb.com/title/tt0083658/)" + + + +Note: a quick (incomplete) translation. + +> Natalino Balasso - New Year's speech 2016 +> +> Hi all, we have left the 2015 behind our shoulders and we challenge the 2016: what are we talking about? Numbers. Some people think - wrong - that the comedians can bring people to new levels of consciusness but looking at actual results it is possible to say that consciusness is overrated: humans make love, dogs have sex. Consciusness is just a matter of lexicon. In the while time, despite our 86 billions of neurons, the dogs have sex way more than what the humans do; and Bonobos are doing way better than the dogs: the smartest race on the planet. People that fuck 12 times a day to keep society quiet and calm the nerves. We self-castrates and blame Freud for it: people don't need artists, need jesters[1] because people is not able to have fun without. The jester is nearby the power, because the jester keeps the people, like drugs keep people unconscius, and after the unconsciusness treatment the people cross the road, someone turn on the headlights on full beam and speed up. +> +> I know that you would like something consolatory, something like me saying that bank frauds against little savers are a shame: banks do it, we already know it, but... to give 200 grands to a bank is like play the nudist in jail! The bank frontdesk is not dangerous by itself, but if you introduce yourself to that desk using your ass ... who you want to blame then? I've never had 200 grands to invest: if I die tomorrow, my bank loose money. But having those money, I would differentiate my investments: some money on the drugs market, some on the spirits market, some on the pay-tv market, and so on. +> +> What I ask to you instead is: why do you want for me to talk BAD about the politicians that YOU voted for. I already have plenty problems by myself: public television don't air my comedy because there are references to sex and religion, swearings, and we are not in a spacetime worm-hole, we are not in 1964: you think I'm going to lick the balls to public television's managers? They told me to change the words of my comedy and this is the art's death. It means that what you see on TV is not written by Freemen, it is written by people that need to lick the balls! I don't change anything of my comedy, and I know that this makes someone upset because if you are a Freeman, you're existence by itself makes the slaves upset! And we are lucky because our Prime Minister Matteo Renzi had to clean up the public TV from politics: today's public television have a council so liberal that Scelba[2] looks like Gandhi. +> +> What do you really want for me to say in a consolatory speech? Do you want for me to say that (note: Prime Minister) Renzi promised one thing and made a different thing? Are you nut? Or you're kidding me? Do you really think that policitians can make anything without preventive authorization to the profiteering gluttons sect? The politician is like a kid on daddy's legs, truly believing to be driving the car because the steering wheel is in his hands! And we are there, fighting in the bars, eating hard to chew frozen brioches ... because of those kids! Is it the blonde kid more cute than the dark one? And I apologise to the Northern League Party guys for the word Moro[3]. I know, I have to respect your vote, in fact I respect it because I'm speaking about you and I'm serious but ... I've to admit that my asshole is laughing. Because I can't understand how you can go from "God River Po", that is blasfemy, to the nativity scene, without laughing. It is not possible! And please, stop saying on Facebook that I talk shit about the Northern League Party in order to get more Likes: do you really think that I live on Facebook's Likes? Do you know that most of the theatres are public managed by the thousands of Northern League managed town councils ... and I get my food from there! And you know how many more tell me... not only the Northern League! I'm tempted to read here the letters I receive from theatres's directors saying: "if you don't change your comedies you can't work here any more". Ongaro, director of Veneto's permanent theatre wish had never produced my comedy: his ass is burning so much that he walks always nearby some walls even without rain. Do you really thing that with all the pig-thick-skin I have in my stomach, I'm afraid of 4 words you leave to me on Facebook? Do you think I have fear of the shit you throw at me? I live in the shit. I share my house with bullfrogs. Rising the level is futile: I live down under. I fly under the radars. You cannot offend me because you can't perceive me. +> +> What do you want for me to say in a consolatory speech: to talk bad about someonelse's religion? We have already too many trobules because of our religion! When I was a kid the nuns told me I would have burned in hell in the case I don't exec their orders, burning of excruciating pain in the ethernal flames. Think how pitiful that life. And I'm not talking about mine! I'm talking about those poor nuns's life: at 40-50 years old they must go around with that think on their heads and make up stories for kids. About Bill Murray saying that in some countries half of the people goes around with beekeeping dresses, it worries me a lot about the consciusness level of the planet, but I don't oppose to it. I don't have the same bipolar approach: "For not being part of the blood-sucking mosquitos, we are part of the shit-eating flies". +> +> Or do you want for me to console you all saying that the Five Star Movement is a remotely servo-controlled device? It is true but I don't give a fuck about parties, I don't give a fucking shit of polit... even in my comedy I never talk about parties! I talk about the deamons inside us, I'm not one of those loosers pretending to be satyrs by hammering one time the iron and one time the wood of the barrel: if I could, I would rather hammer the pub owner's wife, because that poor man has always to live her alone to go having a look at the accounting made without him in place. I'm talking about ourselves, believing to be democratic, blaming others to be racist, and don't realise the racism inside us. We don't analyse it. When the taxi driver is arab I keep my hand on the door handle but I don't do it on purpose: it is pre-conditioning. When I see the Gay Pride Parade, my asshole gets smaller; I don't make it on purpose: it's just pre-conditioning. If I see a woman parking a car I think she can't do it because I don't like her; but if I like her, I ask her if she wants for me to help her parking. And I help her parking because I hope to fuck her. And maybe she is having the same fantasies. And after that we eat psycho drugs and watch tv-series because we are not Bonobos. But I never ever helped a truck driver to park! Yes we know that... probably the truck driver is probably more in need of help! +> +> To make it short: we are all good in watching others' stupidity, our instead have no flavour. We got used to it. We blow it every day and we wave it. Think how racist we are about intelligence: we hate dumber people, that is a stupid approach already. If you ask to a dog to bring you a protractor and it doesn't happen, do you get angry with the dog? Angry with a guy that in order to understand another guy ... needs to sniff his ass? +> +> And another aspect is that we always must find who's guilty for something; things simply can't just happen. Let's say that your grandpa dies at 94 years, for you is not enough to accept that he was old, just ageing; no, you sue the hospital ... they might have done something wrong but ... with other's mistakes we are animals, with ours we are more permissive than Madre Teresa. In this we are backwards when compared with barbarians: if one walks reading WhatsApp and break his head on a street light, it ends up citing the town council in court because the street light should not be there. The barbarian instead would just watch around to see whether someone notice his stupidity, second he would quickly stand, and third he would ask himself how come that he has been so idiot. We can't stop being bullocks and because of this, we made up an entire art out of being bullocks. It's cool to drive a jetski, it's cool to get fat out of spirits and talk like an ape, it's cool to smoke industrial tobacco ... the most stupid thing of the world: to suck smoke, keep the toxic part only, and spit smoke. Vomiting high volume music out of the car and the club, it's so cool to have so broken ears at the point that Kingkong's farts sounds like Peter Pan's flaute. Smoking weed, to have an excuse for the bullshit we say, it's cool. We had to infiltrate the bullocks concept even in our laws: you think is normal to have a law that mandates barriers in the theatres so that you can't see the show but you can't jump down either? A bullock only would jump from the second floor of the theatre seats. I mean: the movie on stage have to be terrible! +> +> Think how much we are idiot whenever we chose one side; I make you an example in the soccer context because with politics we do the same thing... + +To be continued. + +[1] Intrattenitore: someone that help to spend time with fun when waiting for something else. He is playing on the "panem et circensis" latin idiom; the "circensis" part, where the emperor opens the games to distract the romans from their serious toughts about the emperor. + +[2] Mario Scelba (September 5, 1901 – October 29, 1991): Christian Democratic politician, Minister of the Interior, 33rd Prime Minister of Italy, President of the European Parliament. 'As Minister, his hard-fisted record earned him the nickname "Iron Sicilian" for his ruthless suppression of left-wing workers protests and strikes, as well as Neo Fascist rallies.', 'Scelba built the country's dishevelled police into a force of some 200,000, heavily armed and equipped with armoured cars and special jeep-riding riot squads called the Reparto Celere.', 'Scelba had a conservative attitude toward certain issues such as scant bathing suits, public kissing and nude statues'. Wikipedia mashup. + +[3] Aldo Moro (September 23, 1916 – May 9, 1978): Christian Democratic politician, 38th Prime Minister of Italy, considered an intellectual and a patient mediator, He was kidnapped on March 16, 1978, by the Red Brigades (BR), a Marxist–Leninist urban guerilla organization, and killed after 55 days of captivity. Wikipedia mashup. + diff --git a/about.md b/about.md index 49c7e9c..1f3b7a4 100644 --- a/about.md +++ b/about.md @@ -4,38 +4,9 @@ title: About Me permalink: /about/ --- - +mfp is mfp. I'm making this spot to study some technological details, +and for fun. To there's not much I've to say. +Please, don't take it serious. -My name is Joanna Rutkowska (pronounced: _root-kov-ska_). I've been -contributing to several fields of computer security engineering over the past -10+ years. Chances are quite high you might have come across some of my -[projects or work](/papers/). These include: my work on desktop systems -security, especially the work on [Qubes OS](https://qubes-os.org/), my work on -virtualization (in)security, and other hardware-enforced security mechanisms, -such as Intel vPro technologies, their vulnerabilities, as well as how they -could be used to build more secure systems. Before that, my primary focus was -on kernel-mode rootkits and stealth malware (e.g. Blue Pill), including both -offensive as well as defensive research. + -On a more personal note: - -I strongly believe that freedom of individuals is the most important value. -This implies e.g. ability for individuals to make choices as to whom they want -to entrust with various aspects of their lives. - -I'm a human, although I can greatly separate emotions from work. This means I -can appreciate ideas and work of people who I might be otherwise despising as -human beings. Ideas, science and technology have no morality. It's annoying so -many people don't seem to understand that. - -I'm comfortable and happy being a woman, although I do realize the absurd of -the rigid classification of human beings into two simple subsets: males and -females, and always surprised how deeply this influences people. - -I'm also a feminist. I wish there were more women in science and technology. I -also wish more women had more self confidence. At the same time [I'm -concerned](https://twitter.com/rootkovska/status/530109601254223872) about -superficial promotion of females just because they are females... - -I've been lucky to be born and to live in a civilized part of the world, in a -big capital city in Europe: [Warsaw](https://vimeo.com/86112812). diff --git a/contact.md b/contact.md index b132e20..7a874f7 100644 --- a/contact.md +++ b/contact.md @@ -5,104 +5,97 @@ permalink: /contact/ --- Email -====== +===== I can be contacted via email using the following addresses: -* `joanna@invisiblethingslab.com` for ITL- and Qubes-related matters -* `joanna@invisiblethings.org` for other matters +* `mfp19@` for IT matters. +* `mfp19@` for Weed&Beer matters. +* `mfp19@` for other matters. + +Note: after being investigated 3 times, and stalked, and scared, I had to give up +my personal mail server and create my fake identity (see 'Public conversations'). +As a result I don't have an email address. Ten years ago my tools were Devective by design, +today I'm. Note on confidentiality ------------------------- +----------------------- Please note that, as most other people and organizations, I use a 3rd party -Mail Service Provider. The stuff who work at the provider is (technically-wise) -able to read all my incoming and outgoing mail. This is by definition of how -email infrastructure work, and it is irrelevant whether SSL or other encryption -is used between email clients and corresponding email servers. If you have -something confidential, please use PGP/GPG encryption to secure our -communication (see [keys.md](/keys/) for info how to obtain and verify my GPG -keys). - -Note on integrity of my emails -------------------------------- +Mail Service Provider. The IT Guys who work at the provider are (technically-wise) +able to read all my incoming and outgoing mail. +And they are (technically-wise) able to filter out and write an email using my name. +And they even stopped to wear "I read your mail" t-shirts: +public authorities and company policies took over the good guys. -All email sent by me from the above-mentioned email addresses should be -digitally signed with my email [keys](/keys/). +This is by definition of how email infrastructure work, +and it is irrelevant whether SSL or other encryption is used +between email clients and corresponding email servers. -A notable exception is Qubes and other mailing lists hosted on Google Groups -- -recently Google has implemented logic that rewrites parts of the messages by -adding info on how to unsubscribe from a given ML. That, unfortunately, breaks -any attached digital signatures to the messages, of course. +Please use PGP/GPG encryption to secure our emails (see [keys.md](/keys/) +for info how to obtain and verify my GPG keys), on daily basis, +whether or not you have something to hide. +Note on integrity of my emails +------------------------------ -Other notes on emailing me ---------------------------- +All email sent by me from the above-mentioned email addresses should be +digitally signed with my email [key](/keys/). But they aren't. -* I get lots of emails. This means I might not find time to respond to your -email. In some cases, although rarely, I might not read through the whole -message. Please understand that I would also like to have life outside of my -email VM... +This is because I can't be sure that my terminal is clean. Indeed I'm +pretty sure of the opposite. And if you can't secure your device, +there's no point to expose your key. There's no point to make one. -* Please do not write to me personally asking questions about Qubes OS -- -instead, please write to one of [our mailing -lists](https://wiki.qubes-os.org/wiki/QubesLists). -* I can only read email in English or Polish. +Phone, Skype, etc. +================== -* Please don't write asking me for advise about how to become a "hacker", or -"security researcher". +I don't believe phone (or similar means of communication) are that great for +technical discussions. In most cases discussions are clearer, faster, +and more comfortable using email! Asymmetric tools give you time to think enough +and work according to your timing and schedules instead of someone else's ones. + +Moreover Skype does not offer any meaningful security or privacy and +I have no illusions that other global PSTN or cellular telephony does +offer it either. + +Skype is a closed communication system based on +[proprietary protocol](http://en.wikipedia.org/wiki/Skype_protocol) +that forces the audio streams into the supernodes. And those supernodes, +all of them, are managed by a single central administration. +And the same occurs on most public phone networks, since ever. +We should be discouraging businesses and governments from forcing us into +closed centralised systems. -* I strongly prefer plaintext emails. If you send me an HTML-formatted message I -will still be viewing it as plaintext, and so I might be missing on some of the -extra information you put there, such as markings done with differently colored -fonts, etc. +Nowadays every conversation that doesn't occur in a bunker, +using a language customised in pairs, is public. +Basically there are no private conversations. +That being said, my puppet identity is available +for scheduled public conversations. -Phone, Skype, etc. -=================== -I don't believe phone (or similar means of communication) are that great for -technical discussions. My experience shows that phone-based conversations lack -technical depth, and are prone to misunderstandings, especially pronounced when -talking over VoIP connection across the Atlantic. Additionally, they require -fixed time slots allocations, suitable for both parties, which is generally a -PITA. In most cases discussions are clearer, faster, and more comfortable using -email! Not to mention they could be much more secure if GPG is used also. - -That being said, I'm available for scheduled phone or conference calls. Please -notice that I live in Warsaw, Poland, which is in UTC +1 (Winter) and UTC +2 -(Summer) Time Zone. I'm a late sleeper, and usually cannot do a phone call -before 1100 hrs of my local time. - -Note on Skype --------------- - -As a matter of principle I don't use Skype. It's not because Skype does not -offer any meaningful security or privacy (which I believe it indeed does not -offer) -- I have no illusions that other global PSTN or cellular telephony does -not offer it either. It's rather because Skype is a closed communication system -based on [proprietary protocol](http://en.wikipedia.org/wiki/Skype_protocol). +Public conversations +==================== -We should be discouraging businesses and governments from forcing us into -closed systems. Imagine a road system that allowed only one select make of cars -to be driven -- would that be fun? +To engage with me in public conversations via +my puppet identity (Michele Favara Pedarsi): +* [LinkedIn](https://www.linkedin.com/in/Michelefavarapedarsi) +* [Gmail](mailto:michele.favarapedarsi@gmail.com) +* [Skype](skype:michele.favarapedarsi) -Public conversations -===================== +Notes on communicating with my puppet +------------------------------------- -It is also possible to engage with me in public conversations via: +* He is a late sleeper, and usually cannot do a phone call before 11.00 hrs of his local time. -* [My Twitter account](https://twitter.com/rootkovska/) -* [Qubes Mailing Lists](https://wiki.qubes-os.org/wiki/QubesLists) (especially on `qubes-devel` ML) +* His personal tools (Personal Computer, Personal Smartphone, etc) are there for his needs, not yours. +If you don't get an answer don't take it personal. -Policy on LinkedIn -=================== +* Please don't write asking him for advice about how to become a "hacker", or +"security researcher". He is a puppet only, he can't help you. -I don't use LinkedIn anymore, I have deleted my account some time ago. The -stream of invites from total strangers, inability to verify trust, all makes -LinkedIn and similar platforms rather meaningless, IMO. +* He strongly prefers plaintext emails. He dropped the war against HTML-formatted messages +about 10 years ago. But I didn't: extra formatting is not welcomed. -Please do not send me LinkedIn or similar invites. These will be reported as -spam. diff --git a/blog.html b/issues.html similarity index 95% rename from blog.html rename to issues.html index 1faa7e8..b0d2abc 100644 --- a/blog.html +++ b/issues.html @@ -1,7 +1,7 @@ --- layout: default -title: Blog -permalink: /blog/ +title: Issues +permalink: /issues/ permalink: index.html --- diff --git a/keys.md b/keys.md index bf3fd75..4e5785c 100644 --- a/keys.md +++ b/keys.md @@ -4,105 +4,94 @@ title: My Keys permalink: /keys/ --- -I use [GnuPG](https://gnupg.org/) for email encryption and signing. I also use -it to sign various other things, such as documents, code, and this blog. - -I use different keys for different things (e.g. different keys for my personal -email and work email, different one for signing Qubes commits, and yet another -for signing of this blog). Typically these keys are kept in different VMs, and -often still separate from the VMs where they are actually being used thanks to -[Qubes Split GPG](https://wiki.qubes-os.org/wiki/UserDoc/SplitGpg) feature. - -The Master Key -=============== - -All my keys are signed by the following Master Signing Key: - - pub 4096R/D9AFBB99 2015-02-07 - Key fingerprint = ED72 7C30 6E76 6BC8 5E62 1AA6 5FA6 C3E4 D9AF BB99 - uid Joanna Rutkowska (Master Signing Key) - -This key is also attached to this repo in the [key/](/keys/) directory. You +I would like to use [GnuPG](https://gnupg.org/) for email encryption and signing. +I would like to use it to sign various other things, such as documents, code, and this blog. +I would like to use different keys for different things (e.g. different keys for my personal +email and work email, different one for signing code commits, and yet another +for signing of this blog). + +But I can't. + +I start to use GPG back in 1996 and I quit in 2000, started and quit again +a few more times in the past 20 years. I quit every time I figure out that +my systems might be compromised: I had very few peers to use encryption with +and too much bothering to keep the feature in place. +The last time I quit, my keys were on seized laptop while I was building up +the infrastructure to offload they keys from my laptop. Enough. +And because cops can still seize my hw, courts can keep you in jail +to force passwords disclosure, robbers can rob it, +and my government is not supportive to create an universal security buddy... +well: there's no chance for me to use it. + +In some jurisdictions the security systems are more reliable than others; +just cross your fingers. I keep experimenting waiting for better times. + +(WiP) The Master Key +==================== + +All my keys should be signed by the following Master Signing Key: + + pub 4096R/12345678 0000-00-00 + Key fingerprint = 123... + uid mfp (Master Signing Key) + +This key is also attached to this repo in the [keys/](/keys/) directory. You should verify the fingerprint of this master key using some other channel than -just this blog (e.g. [my Twitter account](https://twitter.com/rootkovska/), or -a [Qubes Mailing List](https://groups.google.com/forum/#!forum/qubes-devel)) as -in case somebody was providing you with a falsified repo, they would be sure to -also feed you with a falsified master key. +just this blog (e.g. [my Email or Skype account) as in case somebody was providing +you with a falsified repo, they would be sure to also feed you with a falsified master key. -* This key is attached here: [keys/joanna-master-key.asc](/keys/joanna-master-key.asc). +* This key is attached here: [keys/mfp-master-key.asc](/keys/mfp-master-key.asc). -Email encryption keys -====================== +(WiP) Email encryption keys +=========================== The following is my GPG key for work-related email communication: - pub 4096R/0DDC6718 created: 2015-02-07 expires: 2016-02-07 usage: SC + pub 4096R/12345678 created: 2015-02-07 expires: 2016-02-07 usage: SC trust: ultimate validity: ultimate - sub 4096R/0E467029 created: 2015-02-07 expires: 2016-02-07 usage: E - [ultimate] (1). Joanna Rutkowska (ITL Email Key) + sub 4096R/12345678 created: 2015-02-07 expires: 2016-02-07 usage: E + [ultimate] (1). mfp (Email Key) gpg> check - uid Joanna Rutkowska (ITL Email Key) - sig!3 0DDC6718 2015-02-07 [self-signature] - sig! D9AFBB99 2015-02-07 Joanna Rutkowska (Master Signing Key) + uid mfp (Email Key) + sig!3 12345678 0000-00-00 [self-signature] + sig! 12345678 0000-00-00 mfp (Master Signing Key) -* This key is attached here: [keys/joanna-email-itl.asc](/keys/joanna-email-itl.asc). +* This key is attached here: [keys/mfp-email.asc](/keys/mfp-email.asc). -Blog signing key -================= +(WiP) Blog signing key +====================== The following key is used to sign this blog repo: - pub 4096R/FF112935 created: 2015-02-07 expires: never usage: SC + pub 4096R/12345678 created: 2015-02-07 expires: 2016-02-07 usage: SC trust: ultimate validity: ultimate - [ultimate] (1). Joanna Rutkowska (Blog Signing Key) + sub 4096R/12345678 created: 2015-02-07 expires: 2016-02-07 usage: E + [ultimate] (1). mfp (Email Key) gpg> check - uid Joanna Rutkowska (Blog Signing Key) - sig!3 FF112935 2015-02-07 [self-signature] - sig! D9AFBB99 2015-02-07 Joanna Rutkowska (Master Signing Key) - -* This key is attached here: [keys/joanna-blog-key.asc](/keys/joanna-blog-key.asc). - - -Note on lack of expiration date on code-signing keys -===================================================== - -My signing keys (e.g. blog or Qubes code signing keys) do not have expiration -dates. This is not laziness. There is a fundamental problem with using an -expiration date on keys used for code signing (e.g. `git tag -s`), because it -is unclear what the outcome should be when one verifies some old code (written -and signed when the key was still valid) in the future when the key has already -expired? - -Naturally we would like the old code, written and signed when the key was still -valid, to continue to verify fine also in the future, after the key expires -(and the developer passed away, perhaps). However, it is very problematic to -prevent the attacker from creating falsified code pretending to be an old one. - - -Other keys -=========== - -There is a bunch of other keys in the -[keys/](https://github.com/rootkovska/rootkovska.github.io/tree/master/keys/) -directory -- these are implicitly signed by my master key by being part of this -(tag-signed) repo. - - -Other notes -============ - -* I proudly use empty passphrases on all of my private keys. This is because if -somebody was able to execute malicious code in the VM where a private key -lives, then the key should be considered compromised no matter how complex -passphrase I used to protect it. Passphrases on private keys are classic -example of [Security Theater](http://en.wikipedia.org/wiki/Security_theater) in -my opinion. - -* I have included also the [Qubes Master Signing -Key](https://wiki.qubes-os.org/wiki/VerifyingSignatures) in this repo [here](). -I don't consider it proper to sign it with my personal Master Key, or, -especially, the other way around. It is signed implicitly by being part of this -(signed) repo though. + uid mfp (Email Key) + sig!3 12345678 0000-00-00 [self-signature] + sig! 12345678 0000-00-00 mfp (Master Signing Key) + +* This key is attached here: [keys/mfp-blog-key.asc](/keys/mfp-blog-key.asc). + + +Notes +===== + +* My signing keys (e.g. blog and code signing keys) do not have expiration +dates. This is not laziness. It is made on purpose to allow anyone to verify +some old code (written and signed by me when the key was still valid) in the future +when the key has already expired. The developer could have been kidnapped +to push malicious code into the code base but ... again ... if a bank +or a government doesn't support this security model and an individual have +no proprerty nor trusted peers to secure the keys himself, +no way to do The Right Thing. + +* I don't have keys because currently I don't have home +and peers to physically secure my keys. The keys you might see on these page +are for experimenting only; they require for you to contact me to +check the developer integrity (ex: alive, not kidnapped, not blackmailed, etc). +And be sure, by other means, to be talking to the right person. diff --git a/keys/joanna-blog-key.asc b/keys/joanna-blog-key.asc deleted file mode 100644 index 6009e35..0000000 --- a/keys/joanna-blog-key.asc +++ /dev/null @@ -1,39 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBFTWbWEBEADbaAHjo2TDnUDO1cKk7mEN9hFC7bA4sHlhEYmNk2FKsbpX0sJA -ibxP92GxRMHoFiJwJQ923wXjkjJAOwb5b3IRYdwPYLZhpZbBuYPh8yCdKLifBpL7 -HsqwhB8UJQ4h96uIEvpbOKYAzj1qAJ5EP2DlgKuHexaWQx03cxRWbS73erZeIfkf -zRY6E80EE+kFqvnLnTpF9GgS4ukIcJn6qQACtiS5jBR02Y9ly+0A/FjkNgdXh2Gt -yJnuFc1lxLwzBVD65TITFGW/nkpiguSwKr7ubH6K1hNoNLUo/TcP0Wre5mEE5+pa -/DK3COak0zVJBWzw+QUZgPTYxKVwrJ4k0Cpi5v7lbCkypjeuyZVVVYrXStKO47xF -Ti2/fFmLAJSgTiwmCVo+/3elVQ9tQs9DTR+7MfpuueNYI4qK+l3f0DMOIitYgfp+ -4Xzg82DpfE8yGgiciCOe43vN/DkP84GVuZ9NqbsWLe686x5huDRg72LPN75uh9EM -ej8oeerv8YVuIBEOvDvTdYvm3/D5rjehToqyVHmQL4gMx8MXkW8pO+cfRGFzlher -KkM932oK0f6v8wzANrQdVhmVWRfuhJJjrUl20L4NtsvgHZD50RCbZmmRkheqSQox -OZcXsQSosQ+QyyNjutAY+6OBtx/hy4Q4KDZCD8d128M0RGXH7axOGgziCQARAQAB -tCNKb2FubmEgUnV0a293c2thIChCbG9nIFNpZ25pbmcgS2V5KYkCOAQTAQIAIgUC -VNZtYQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQocNBuP8RKTUgEhAA -g0oXo8RKRzWvNMBz9Y+vUGOzHbZ814IFz169KaAzx6zrI5910/vKfLtcYzkbxrZd -bBtCY0Z2gj/kbF6yt3hmgqWZGqjRW1On6bg31l+PgHsNaHsqm6qTfDqcGnDv9H43 -/Hlj1I89xRO9x2eTYUwSlJheWc1Yi/8M9iMATQkMPrdw/+iy6JYFIcI5SjVv1JiK -uRHDcRniUktHAIZBWm2UiJZmIZd8NvP0BFmdtc3SZ9tVpvuTkKFYU4mNo+4WslL2 -Vbg+ktps3s3izFkO0V5KL0pJin0/9mGYPrf0vNMTTZT1/9yxVmG+iAgwMl9dmmjN -N6nGrT+/NsKWHVQItkz6tymnveeSjzQFUckr6ba8y8lb2p/JLaWvmDoxK+rCgpKw -z6t0oCgLTOW3DWvNKySxmOuJditPMQlVZD0BV5nRr17uH7Rbd0AFjyAYFfpQchIp -wAC0DnARk1IMdPosDqDMY0ZPypCvAkSiIc6z0j72IjaOGZTDQb7Vg8E83nWymJes -LNKmvTkI2trBC6xV9dd3RpLq53sJNVw6jKqpx0FdtOU6d0L6KwbRn0I5Q4/UpAvj -lBdmzOUPC7Zm7SbI8UH21Y9PhpcAVWO1uJTx3Jkk6eCXv/cwoMj86Xr+a4Wx5Zqq -0qqpXL9KHkVI64+14EZo2iM+XTnLjifWrOvfAkcIzDmJAhwEEAECAAYFAlTWh8cA -CgkQX6bD5Nmvu5mHUhAAhU15uEkSXTjDKNGcHTlYREU7fe1Ov7IfRjPrbiXG092T -wDw0T9c3gXXoGZI7sNaFYQ/jv4aqTHtpoNPbrntREMY2F4tBG0mKlK4NBxuF5i0k -GaxJlgVIcRbHO2cAOGhpJqQNODkn0B/gBk3Lv/WDlKdq5B7MrSh7+aM5Mz+AtQj2 -9ZSSX1Gljfct9Dx9f9pMMm7mPg7fnszXOt96ZkOvv5qdrmQ2fVsiFcZ2WZddpdOk -MsNuNgBzniWluK9sG/E4WDFAIivNW2yZ78pAqTqLKmhxq4SwtAAgyQBdw7eqRxqy -PoMAhgvctX5M3f4hjHEN9aAi7OKBJ8zUsO/CChB8Z/5CtKx9x0T2+PZSst7T/amy -kv43gJQ75A4SzkUgrBqc1e/cvlv4PfOyUhEIdoH1QGjUNcHbQsr49wNPYNy+Mf0g -z8j99lqDdaokcpkNAFc7fhmlYz8/irQFDeAgfKxQjhu54I0yZqBl2zZtZGVSrQ8O -zNtMNiUhVgvH0KuaoRC4v1yHoIdsbtROSs//6Tkh+Yk94kNUayvWYYanGPOCg8nm -EPLqLMa6iPEMPkqUnW9UYKc/DhZpq9Cj3qadCxeS2wfQ1n79q/pYBmZAgMTbjOZV -PyeAjHE0SK8yBe1SZryI0eFC7P7LQYxmQZEFeHJdUVHpL8vaTmnvVffYKsedOBQ= -=uMXO ------END PGP PUBLIC KEY BLOCK----- diff --git a/keys/joanna-email-itl.asc b/keys/joanna-email-itl.asc deleted file mode 100644 index ac0f13d..0000000 --- a/keys/joanna-email-itl.asc +++ /dev/null @@ -1,64 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBFTWcsgBEADceXJTZFAYUQAnoi8FXjZssvSgIulGOjnQRPwgkjfr7NtsnFx7 -XUO+1Owu3f5LHvIQ0TyLxbKWRuELNNTJoGNjUaLS1Cn2m3hEbV0bem3AOkBcu79k -7E9YXCqzT4jAk8Cwk8M3wJ38x8wD1vat/5T2DxjCPiYFEO+/XXcwoMpmvtQuGiFs -4FOY+5zIj1xvaXFwSl8yJ3Cmpq7dTDL4if+wgiUPZus71Ve0vMaXfS+3S8YNbcyA -jp3DLocJMqf1xAvKtKGomu/PBp0VJW1oFyJZ1niWdB5JuvtQAv0uoCFMvAo110cw -ZMUtxjYTlCpg4GPa9OQauIOyFkXxJSf5Qx/G8qN1TTCB0G0AnF0YDkPPT8DaASYN -Rk7wNM5V3rFU9CmZ9m6JGBAadwA3uUGLMfEVCXsm1pOWq9I0T57sv1HWQuxA4sRH -gnSkuMLgA7SRNdGMaCNQPP7LZnDSDYZNSTB/4SBTRmevZsKE8ASj55JL8VRWDcPS -la6JuKuOvYdOZX925HtMRA21Zu8vEQInu5Cjx3asfZBA28tApnWyfGCApXpo0PZ9 -k5iUDkbpnkUOBQQ7+eAoxk0DFQsHfevMP2Xo3aUwBBsml1cPf4H+5ZKNREnkOXh0 -TFSq1SNUkKyasmlSjoLmShUNXeBPKJjtHTTWSNKQgx4uNPXFwH49hIEPcQARAQAB -tEBKb2FubmEgUnV0a293c2thIChJVEwgRW1haWwgS2V5KSA8am9hbm5hQGludmlz -aWJsZXRoaW5nc2xhYi5jb20+iQI+BBMBAgAoBQJU1nLIAhsDBQkB4TOABgsJCAcD -AgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAzk9i/DdxnGAlqD/wKXauSsXj+4Tn0dpui -cok7YSQPfjPh+t1zyB1iFjQtrJmzbg2Qeki2BBlG62N9oCaXSdUn0gENZzpJS40b -BWjD2JrRRFLyUy9C0dyAZJjYBM4AUhLvRAxpBalKt0TwQbOCz/6gc4Ks/JdXaGG+ -rNx0LhinajdXov4H3rBIzoE2v1SJcq3cn2HV66JzPMvDzQf7hrdm5ZhKE4lNIdlI -xPKkDKIWaVGMkFkiQSqczFD0ruk2cygf2JmH6H+wieI2jD9sC+j90RiJ/zpYAU3t -poxEGG3avxcwd78CAm4mE/x5F/bkuZ9Yh6qQQSFZAuJYAmwPm0yvQS2C5s7ohKOp -gdpN7ZFzPF5wDY5t22AbLUxCOyhaJZn/fZY7j+/CYZzpmjNuOAeLn1S4LZtWIhRv -O69nVNsX5SEqvfoO48lHoX8OxjcenZ+9Esxhw1hUcdSc3qLBn4TOJywMDORH2EjJ -3ABKxYvYFnhHr7YvVjEAOJ1t8Eufq6EH7GPzSlUTvWBmurZpJTSRnDmnLyMgiOtO -mLpFtiFeNa/HeHq7Nv07asvSJ84RpPlOhdb4E2RletR/DKWd7U/wyon5MdnE2QD0 -WuQI89BRvAp1qYCamjYK5NPgmRf/5i226QTxeVfsMWcGpz3BnkrTtjXdLBSVuSb1 -9zj7NlKhI93jqFu863aCsaDNQ4kCHAQQAQIABgUCVNaC4gAKCRBfpsPk2a+7mUf9 -D/9+O9570fcOBW1/10/2+9Q+RnY0RmBsWUwEgYIyKHaqJzOVlvZXkExVKXOtbA9c -Z866kE63JJxm+QlzeQnl/xXDuF2uiVsLqWNRkuJLW8SCj85nnETE7UEldZ0aKvqq -VNUsiDoUvRpzb9k/Ou0nNYFnloG+EtLfUm6l+jmUI40LBmmKN6mhlxz18KCJCWSw -TRgkFrmJoiSaLQVIxHKPFiQG9WkRoD/mb7MWyJv34wStC6n5mfj5qnkHxSXEcx2p -2kr9UK9ayBkU7xJ/53un4sKb7nK4w1sbvTrCBrftsPlBJmpGMrpKlOE67WqucC/e -AfOsDxwJCryDgBkaRA4ASBfKy+3KAjIi3Vje1WQih3ND6f3HaLvkBxKfp2hz4fkr -ZrjBRGBbPvYAU2gxISIAgYwT1TnaZUa4CiO1YJzyCaVtf5M+7jO7h6hmeFWaJ5g8 -Ni0NkjuPKXeo99+UhpPmlzAceYVFvlNs68+r9NN/rVufvmJYFwq84S21kwFLdhWR -8u0tVTTABSJvRdFguE51jQPq7uyCAY8kxPnzfciYziyLNuGJX1mhpyksRv3XZRT3 -qgxbRzuk1AtXpHcY+TcSpTr6eYG2jQ7CeEo9CdQJy0J9tzly9jXukKyRYXBumq74 -SwW43nollUyojainPnqIP5vfoJhQAu8VCT2DKzPPMNfTAohGBBARAgAGBQJU20BV -AAoJEDkXZKLXxFvOe7oAn0mxLnjmlNxaDtUjDTBBq1CxFYdpAKCKVM5CsFkN4fS0 -ZNIoCB2ioC4KWbkCDQRU1nLIARAA+cHu4KUVE7zxqlnjJ6nOjrLM5HyUwo6RhNXO -Lj9o5+B+VOUJKCvG1XDFyx97R8VrV8Vq3YrPrPBcIhCqN77Hi0PNFhdoac1ITwd6 -LVt2Kyte6H/thASVUByxIvn2f0wdFD9nwF/UWE8HZywzgZH4O5ziiQ5cswZ7/AvC -bLiqrnbVH7E4DCugHjnXx2wfJkAvI6qgujs0Chjyzx8Eeed1DcE4ZuF1KejOxoez -Y2/P9iw1xaLAaE5Yb2n9QBtUAHoANXDO8FEpwUA9vpre8rCqaBa4m7zF3SzU86xp -+n95PytzjWOBlw2hvVJHyISzLs+Ff80WEKiErHnpGtwxCEZyiYGuFxAYnSjsiVvG -3drWbW4U0RhMAOxwL3SrZ4acANFV5dcx++Q+8l/H5m6GQUHNjLYGNFatgkLVpjQS -KQMQkM9ah0gF93eh9tLFVnpg/bu4xNpbbj2oAqRBoPakxoyJ7UUeYYOxbTHagOAy -SXCPrEBPk0waxBFkthdjxUlv0gO+7Ptpn2MI8Ok8xuDMWgaNwC4LzDToWBKKODE5 -zurZJjKY+Nhc5SXdAeb4UwdyqTJjpdJTsgqHMQW+VFMeXOPLSLNrJq2UJ6z6QF+J -SaDTE3jZq4SLahLoswnRjVZ5GwvsOzP3axZmrJ1lUK8bXFpGnL/ENYZvpmmjzIBe -JX8MQQkAEQEAAYkCJQQYAQIADwUCVNZyyAIbDAUJAeEzgAAKCRAzk9i/DdxnGFvy -EADNrgKDrm6W215HSAlAmtz4/PImQhKbACcqd12OGT4FeAdqtKXLXdyLnC7ionUP -5T9VOb/Q0ZkS5vUyZlnlapPWLgp6ZLi5N64YpC/GPIwxVon2x8cn+u6eF0UaGbix -ZFtAxWGeSTEiD+odXxKIip4HdJxK6ECcUoRSsEK1j5uKycxAQ76hqOcZYYs45djX -vzvq9CewuX6s3S5H4F6sfEtusIPZKE+0y5oLmUn5WwHoZc0Z0uYAlUqDx5DPcCiO -nAECTRWTNY/tUxOYniIOGjMaXLPdwjFBoiCyEGpBrTH4wx0xxJ3so+Yteef6/nb4 -oPkjkz4pKOtxnrxK4hXShbIMktRzKYROy7Y6SiGH2Eq0YSzYeuAUMjmP3QRXWXp6 -dZPIoviG4r7YgKEhH4ZvnzAhyJjaGZgCR7SM7yFdIP3mlh/O7qjMF/Me3g1tAeMV -Qvc3CdFYo2qMpzEQxL8lmfrAFqcrSy5O6VkZFA05XOmEtaTQs/f0GXXu03zPgGmg -xZ6VuDAF+WztQktUFu1wvmXW0QZcqxM/sN+gzWV05M6b4mZvqlLsUqjSdPEvVADq -RTmDMfARDVyOCInrNJMizdSrh/Cz257JNxf+chBydlfdu4m2TiRIbZbi4+dFFZms -A0Dhz0MR/QZBdyAqBAE53kTm1JSd6nyNN98fPygDeOE+Dw== -=LeGt ------END PGP PUBLIC KEY BLOCK----- diff --git a/keys/joanna-master-key.asc b/keys/joanna-master-key.asc deleted file mode 100644 index cf9e8f1..0000000 --- a/keys/joanna-master-key.asc +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBFTWbPQBEADKJFbpEXvbwyU0vZXtLXfS5OsKV7gxQWr2G+GaUEqSv5Czv2DA -GgjmPIVdujEnnJizzr36FDGBCTCphYlqf3AuqLDwK8hukqlh7REOTbyE2h0J9RsS -PDYEi7uz7GQ00ylv8VpPTHgCVsRerGKQV4OCkb1ih56sZju5JiD1xExWtziYTg5V -yLR99UVbPVUNLva8nCXVZSKxM7112M/3bCWs960Mz3f1URYYuNPhuZ8Tt7mjwzv4 -GYllixumjzZwWBh+uEtD05XY4YXZiZX2CyPDoriDYB18Ocl7oB/xN/ZoAwPP16X9 -S+Q5zNQMdkrYq1i4kkMuyPteyoek6e2WmXFjISbjDiHKZo4DWYBEYsVziEDAeNk6 -crPxBx9SCgVxFa6wqF/Oqm2rBbFeeKrZ0+uR9xZhT0lxE5WmBUmmkgCRSujJTE2T -gy+EaO6CMqluoy5zid3408N03TKgK2twt07R28FObsoaKwOxCiaw1WfdnLzqS0sU -z7jq/dHrx3JnAUmICw/4kiqJtw6zutpEVAZfePd49zJDaStZ4dwtmcrGvuBMr/a1 -cGnd7dok1P1TM67LZhE2ODzkmr8ic4TRnq6kHunYCWlCPY6Ayav0uJ95CaaqX4G+ -AWFQZ15HCg/Q3WBOKYAQyagC5zOeilBGQs7oOqbcQ0WtcfX/T9Lnr++s3QARAQAB -tCVKb2FubmEgUnV0a293c2thIChNYXN0ZXIgU2lnbmluZyBLZXkpiQI4BBMBAgAi -BQJU1mz0AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRBfpsPk2a+7mc0T -D/47oIsbhKsvvCTrISyJobQo2A5BTwhUqDJzFRq1PVX4LcH4BtfR+L6/vQ7sB3lt -2QD/CdCCQbXBFdzR5nc+8AzjUect+9Kk2oCaYA6dC59c2zcG0rEWOUl75jpfuFQL -ntKBv1ZZXJ+iv/EDEyt+4kdcByIAWnh3o1jXhcvFcifI8a6yA+WDp6XtOGHyebbB -MK4cIuDPFA/x/iBEp8yI6cMO/LNpIKtFiTp/vDhrR5g6umAVvb6HMX/qSC1jfufa -Y+sfEgcYcIw3mSTxeJxIzrv+cIfwK3P7/zPfbtwxlq8xSQNP5JB70JHBWg74rGkc -rl+M4OM0YfaaMNG7iFzYM2qFownMtWrmB+J9GswIAwFIonUtBhac0+eVCguKc5zN -pFkxrUdqdF3ijolaN4wybu/KEg+7YjAh83Ql1Eh1EfeyKOr4eYt6SlR/RLrig+IX -oHVBo/ryGH4F1MDNCoB3txYU7+hMndnDY3lozcPfXL2jYp/ePTVdAAK2Uk3qXqQj -Rxt3a2O30elp5BsaKJs4A5/HPpGILdk5EZZ+EE4XFIo/S/2NX5xRaNyBcqGzEnxC -1iQZG95WZx2aTSA7XMsfSGDtAqWG27fpm3YWw+t0bt0pTwFOxtQRhBkpXdFVLLLQ -kGVQ5BTPIsLw5h0XWGeD8PQsnNVRwEP2eblIyrMPM0fsLQ== -=P6Mq ------END PGP PUBLIC KEY BLOCK----- diff --git a/keys/qubes-master-key.asc b/keys/qubes-master-key.asc deleted file mode 100644 index f47ff8c..0000000 --- a/keys/qubes-master-key.asc +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBEu0kPkBEADHOaL53AVx8ECt+vsTFpNv/oyDXXs8dNmMsQhaCQ7BxTu95QKD -j5S0TiFoXegBwE8YhRg/8sBHOUbmdD1iQHxJSlJc8NYJkctq4KjiyeshquT1mIYx -wTGSuagX2PbM+Sv6Cuyo/DyhmzIH5dssFH25qnQ/RwednxWMG9qBW2JujDdwlMjB -1p6u5lzkwECO0Kk8w7rvSMJwPo2FPTpSTcdN7+Yc1i7WEv1fOpNYBfEn76Eck3LP -dndceRxnErvkEH7K95R1wEOqXxOEjE3BoUqh7q40GDW6bBMV5EauLBgMX4DQRIDE -uU0NW5Kk29/8RZaZrRXmpVmof1dMYVBWu4wM+Khm3IZ30pUR188jZz+eUhPDieJL -lN3iRKikSv7Rm9SETmwvvVOpP+RfkfaS6XGu3XfSv1diLy00p6Eh9J6LsfiCRuCI -svADNHsyFxJkIwEGVkUgvPFCRDY73LQuV5Bt5gutPFVnVS5nM9pwQEBFAha8wB5N -L+0fq47a1NJFbmKQ5PzOom3qQjee/3ic4wPcf9YtmLOdxukIEXvrGtcMt2kQHC9a -YypW/AYQB/TxpLP/aXSHiO9bR4hA4au26d6ytsgCZpPVQ5WchYetTVXfcjv6mbCS -g/QFYx1Ss/lZ2Uao/w7eYdAlvvJ1JBYotuMLuiONReRHGY5I94H8RRju8wARAQAB -tBhRdWJlcyBNYXN0ZXIgU2lnbmluZyBLZXmJAjgEEwECACIFAku0kPkCGwMGCwkI -BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEN36Gj42h5SU17kP/2sF0pzYETEJykY8 -MTfHpey+eAjP6Ejt2mkasiFMEIZ0mjFt9A/7I4gYgiI1pNRat2icbjK0HmUDSHzo -LRjCcuP39D5LRdoFMzMzXusHx7pCKkx9rvitOq/p4LN+O6orCJYhHN7Si3LXWYv6 -5HG9iGbeE262myPb43KTBbNF5recwkHZTufNMISGQiSkwFOPRbBX7q2c3/qHjmiw -RZ16DRSY1xHaV1HVplaDSCIXYcDhWsywB+5iuUFDsZGmfCncR7SZ00eSWpKVB5mp -P9vlk0Tri28dQWqfd63rDU9ZwxFpZfL+hlhA0W07np6L3yyai+jzaWFY7VsqdOnp -zBJe8sveMr8SP0QhrGEL0aj/R9XPKgfYm5wlf1qJ/Z/10jJm8D0MTMUxPUI07Hja -u5lIW7GZKFdI5DWt/JTvy3FJp0yDajaUOc84l5wJKl7cNCmeZH1/oNYkAb+JqqGX -/VPWEot7fOaqUrHswsE/YKK+9fv/aMY6qjF7qVGAfbd04kAZuPha7/s3USbdiRA7 -aJapZ/mtaUY+P9k1j/dI8sOPpxgl4c6esIBhwe5Sv3HUZc5SZhW3h1ISScvoeYTV -KLRIi9ELMmsqfESjDhnDbVsqIjL8+kKxegaRXwNxeZoe7EfiL8PKSJMSbaIhXLFC -QUkIyUJmS9aV8bQN8vheR4JNciA0 -=5mf9 ------END PGP PUBLIC KEY BLOCK----- diff --git a/keys/qubes-sec-team-email-key.asc b/keys/qubes-sec-team-email-key.asc deleted file mode 100644 index dac5789..0000000 --- a/keys/qubes-sec-team-email-key.asc +++ /dev/null @@ -1,73 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBFClORYBEAC05wuebboLRM/crcJXyXJsoSNtCmNQsYMrj+p8LFs2s5+dw4E5 -9ZAU5RDRuUWWE5YDCrHKXb2EFb6iENLm30Z2/zcZhrWKolzm0N5zPML/+MxrDu/5 -xabgwMQPA6TvDIxawqbJbn/pz+IvnQTK56GwP7HFo4EbKbpzwYqRz4Zo9n/3RSkC -xS/8fuFFHLgNVGWYlgE/vTZmShi15LoH4leoRRfjneSHWv1nWL0syJK1n6c1CVQc -5X5l8aw+LwWQPv1y6keQuYZfhXqQ0bATTfoGEFyEXl2JwcsfCYIAayJhaTB84GAC -Yxj7dG2zI654IO1IkX/tvfFpYc9Kh2JHVCQU5STihn847tMBoN5/hQFCTAKV7kzh -S+bO39CTB+T/JqSWJ9t2V9HuAZyM6HyP40lYgkXudT+mP7+C3wiw2VlCbKfVHABh -MiXY3kJkbCOnL3J67ZYhv6RLD2INedYluvVFS7la35gGAH+MMtwdcECxIK/bUXHS -T3uY0mexOeySIhlvx1+vhUNCZRHx2jeifjdU9WG2pZAaZIAc2oZMRLRMwEOrC11H -t2dUELffEY6NeaYb/km9lM1fGjT2EO/LOlYTRf0ywfc/zNmVwaaknsUxBqffxwyr -3o4ntqWUs8SuAFiQ4rpwibqe2Ax66UZXmzbKKVvUKHNTWpfO3iHvnQym0wARAQAB -tC5RdWJlcyBPUyBTZWN1cml0eSBUZWFtIDxzZWN1cml0eUBxdWJlcy1vcy5vcmc+ -iQI4BBMBAgAiBQJQpTkWAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCs -wmAvP0jLIQhZD/9QwDLuRJufNyoioCjL5UeoYVT7Kg8rYt/rAso7qxXhEynVAoGz -fKnGcAOuTG12PsaFMtxY2KHx18Ns0OsAiVm47eNzCWZgyRzbGI+bsDmRQZ/W8g8x -uwEXni1YdDJckJ9y2zbdTzyHfEuhLt8kVGzHnBw2MdKkYrvlZpWv2BwCTj85lhnf -W4LDEGtubRcDYmfLkNreSimeVIvlx5f1YXWQ8ImtmFeFqhHX9nXPSKn5idfj6DJI -aWJ5A8lw1JSMAW6zYukjN7Pz+PMBVTYBFcCaEf/8MlgV9qV3k4VUj/hqvt0IM/Qm -caWbDYJRskYQiPboRbYJHk0fhjsNuMnXpX7jl44Mn9y5yPPCep9cpWDG1WgQtHXJ -uwdwQkSZLnjleKa4743PguZZzgSFaI3Z/p3RjQLhDXPb/7Pp569FFyT3WuzjAOc1 -pu+vHMtDPKeV6nx9p1OK23RfLZwP9NmV2pJ1ZPo3NptkSqOf6GznF7+JaHcjqUnU -EAiaTGE30dcleNGF/xMF59ZlQm8rnZV83maDfWQgXHl29pSesm7DIs14DVtRavAw -vLfgHS6uiR0UK68tA+UJx3o9YeYaX867s9GqAmZi6qPry9VJ3Jgz/k+/pAVM2mkV -FgbiP7BbFdUj3+MsitW7PN3GOmn9CEpnu/Pxq5AOigIBiTWQno7yqrhcJ4kCHAQQ -AQIABgUCUKU/AAAKCRDd+ho+NoeUlPqwD/9IcdNOnI2shbSD48ly0oQwUOq9S6p2 -aVrlK5beiVtYuYBFj3tgZDq8/g/RiQIK+ya9kHnrGTw1QScPKqjj1jgSwdbyHZZv -Joiz9h0xAjqp7TYFcB4ZUNdLR9OBUJVXV7DNvn6QxrU5UFSLhscqTx3HSi/fGrVK -m6DhpMZ8DZprT7GySZaSFhAALvwCicvBSdw3g+Gg2bUFJgrKFUBeJ96qU/1IHFzi -AGQCyI8hCIFGvmLufd5aVgA0CUE8r3FvYY7k1Ffdo6iySQzBCnEkug1QezmxCg07 -SgWPge9UtQLQC2dZE22VALGgdweOBwVe1SL6UX6Rt+w3bmvNuoxjoxbNMORZBpz5 -GWfIFPA/9DtzH7+c4aH76sgtj4GmcRHXAhkaEdBSiKuu5xJrwDKvtNAQIPGZJTUx -TmZQzd8Xk6yI4Y7Nfryj11hEvrU0Z+dF9cas5rR2dewgTu6cpmKtTKw7g2wLzyF7 -iYVWdZknUX4IX8E+5TvIluL7w34CN1ag/bA6igXk1to8v7wP9aN09XKUwO5Gz92P -py8PgJZ5NY5kZfrmNMUVTPqdudH1sF+EDSI+yACDJrKtQFtVY1FkhnVhJ+GovKmC -vnUr8Lo/79oewHEFB3jIXyqCTEV5qMDyY+BHMDquasdfEGA6I0IEZ2ndoZO+ic95 -Z8IRlwwccs4G+IkCHAQQAQIABgUCVNaR6AAKCRBfpsPk2a+7mdHTD/9Vow8dtQGB -wr9xFVsAqYSfT4vvTpPb9cPIBBPdVcuEaBjHiu4jcgtv4Z8HYQpk7aYvOHWCRln0 -Lqeei955tCBqustYvSv5sGDdygGehdOx9xNUBPBRzPjP7ULfSGRpMwgaabfXExrp -gWxv7AxGOFe0bhPDh2vKds/atHHmYi67c/12o7s6SB7PnruiaSGNHQeQ3fq7XXAb -mCY+hFlWlD5iY56N5GTX6ZpogHGPSvHxQbB0CA1WtpbXaPQc4jqM9yBTLkQHVhgK -ys+ob7gX61R3Vj1SwwjvNi6gZFExNV9p3MUI00Jj4LnCsOL6NS8rpW9x4A1t1EDO -KW3qa2ExvfV5fK7pxA95048tkMTDWaD5PG2c/62RUCOQP90fZk3FbKOhB0sE6kXb -9cRz+BRchCo/QwOglFHVclDqkwYDLXPG+q4KjxwMRCdRIUlNErkHEfiF3t5p+5gr -eUda4KMCSApmGVloHTg03gH7waar5GtnAmg2G7Q1y2FzvTMSMPnvYBetaKAJB0RI -J5TRsMqF/PigX3pEKlnmlzSZme+PlLRyPRgN1WDsVxBI6fqxduDciZDpJNs6Dv5u -I3Po4IXAfLJrmtBp1byZY69NZ2tcFsSGgkflefxVoRb2YT8rnghkwEPMoUSmihs8 -5IaiN9IjdBgrhkOkITw/lMvaZykGh3l7y7kCDQRQpTkWARAA0u0oYVVsWmxZKcdS -w2CNZ7H9gDByGysQ5NEanVPJCNQr7XY29yqug7pHQ8eIx3JXQWlXFu4rCP3lYXDv -1Uq0n4m/ksI2qX3fwKFAN7a+FBjaesKZTjE6kcgu+DISAOEaDRmso34tQohSzw8V -co+XC+iBbZ7TD5zw5f5JSxT9+eEI+eWcbWr7QzPhtjL4KyCXx6AGmnZo4kpF1AoR -j+TXLheLN2i9/FB1kiViEeCeFyI3tlPCyeJW6tVBEI7260wMwlUV80conm2WkTPG -S8v341eXgg5Y/Sh5+inI8JzsEUTjcddIqFOMi7buo0CVKIprHZFHn3gZyHHG45mI -CgRsoHb8QN2xuX4Gx2/Xlz6xKGjwY1OWymXOFoxtEigeON9HGsVF6qF+dGhFDBK6 -V5zMvoyqkyGi/ffvKyIqbbSGt9NTCKXHrdjpQ7r0kFjKhdIZHbJXkwQTS/xo+VJG -1pg7EzdH/lCPjTGCLnmudV7pj4QPqjnhtQSi3T+0LDNLnNeLPdiKS1fQEklhJ7+f -rLFnKLcxaOyIvlRivuEFV4ZqcOHH47zXRMrd0xz45XWumu7BlKoix/WOeCLkRYvb -Bzy3xDIHC2cMKzZ0eBQ4cT9L1ddd9Yt0DY4H76kiWmmWNEXws/jXgWy4FtYAnYc9 -JUXVbphmQIcbU8/IL8wGj9ZtL4kAEQEAAYkCHwQYAQIACQUCUKU5FgIbDAAKCRCs -wmAvP0jLIQoHEACbXjjr2FUOAOIu53zVnyz5di8LkDiX38iAUOy1MvChyxvXaHy9 -XkL/TBmYrEhYtoo87jWkMBHiRuiZX+rrUfarDFFMQMVQvynzwqL1TfhzDSljknm2 -FtAYhAscglvo8L56eo4UJrcCvhOsPPjdl0riCA9eYq11LcPAd5cHlHeZLMHHQEhU -ibS+G8JKNNBvQ8uRH9Y8Egn/PV1Lg9aJOqXOrzygzx2lD5WTwuejLoDa2pl015PF -RTmvWZKE2j4HoDwlaxfOdvzlbl8/zWNUQ/Vx8nd7q59J0oVEJxCnZaAlHXwUI1ZN -epHbIoQi/IQ0hrDFHZ6vxVGvyJYEj2IXo5JTrShLvdjNSPVFsciLvaMYS0Se5lSX -OqbzWmXQJodHWxUSVyN8pJv7aERFGAFul6Zxe5CmSq6OkH3z6I8RyJcnVIOuvQnv -ARH6ztvK7tBNfVHxolwRdX5yKAaBXBrKxQ2mSkC80BAP/RCRWd7pIMQXdcu7lO3D -R/kD19hlgIToDDc55vTbgmogBNiWslr0TY1ftdNOCSbINMlhULLaeTTexYMN1TUr -8nqI4ETgWSY+6Fu1XIlVGBKRBcRHKgvAKNhCA7dGMM2t6BDNvBKkvXE0rkGv4I5H -sTbcQt0slItCwzKfXq2kmSk3OzD0w1bqC7Y75FpW3pNYJ1EFq4gk2dGnSQ== -=n4dg ------END PGP PUBLIC KEY BLOCK----- diff --git a/papers.md b/papers.md deleted file mode 100644 index 52f0546..0000000 --- a/papers.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -layout: page -title: Papers & Projects -permalink: /papers/ ---- - -Below is a list of select papers and projects I have authored (or co-authored) -over the past ~10 years, sorted by topic, and in inverse chronoloigical order. - -Qubes OS and Security through Compartmentalization (defensive work) --------------------------------------------------------------------- - -* _Qubes OS_ (generally), 2010-2015, [website](https://www.qubes-os.org/) -* _Software compartmentalization vs. physical separation_, 2014, [paper](http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) -* _Converting untrusted PDFs into trusted ones: The Qubes Way_, 2013, [post](http://blog.invisiblethings.org/2013/02/21/converting-untrusted-pdfs-into-trusted.html) -* _Playing with Qubes Networking for Fun and Profit_, 2011, [post](http://blog.invisiblethings.org/2011/09/28/playing-with-qubes-networking-for-fun.html) -* _Anti Evil Maid_, 2011, [post](http://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html), [code](https://github.com/QubesOS/qubes-antievilmaid) -* _USB Security Challenges_, 2011, [post](http://blog.invisiblethings.org/2011/05/31/usb-security-challenges.html) -* _Disposable VMs_, 2010, [post](http://blog.invisiblethings.org/2010/06/01/disposable-vms.html) -* _Qubes OS Architecture_, 2010, [paper](http://files.qubes-os.org/files/doc/arch-spec-0.3.pdf) -* _Running Vista Every Day! (Poorman's compartmentalization on MS Windows)_, - 2006, [article](http://blog.invisiblethings.org/2007/02/04/running-vista-every-day.html) - - -Trusted Computing & Virtualization (attacks mostly) ----------------------------------------------------- - -* _Exploring new lands on Intel CPUs (SINIT code execution hijacking)_, 2011, [post](http://blog.invisiblethings.org/2011/12/06/exploring-new-lands-on-intel-cpus-sinit.html), [paper](http://www.invisiblethingslab.com/resources/2011/Attacking_Intel_TXT_via_SINIT_hijacking.pdf) -* _Following the White Rabbit: Software Attacks Against Intel VT-d_, 2011, [paper](http://blog.invisiblethings.org/2011/05/13/following-white-rabbit-software-attacks.html) -* _Another Way to Circumvent Intel® Trusted Execution Technology_, 2009, [paper](http://invisiblethingslab.com/resources/misc09/Another%20TXT%20Attack.pdf) -* _Virtualization (In)Security Traning at Black Hat_, 2009, [agenda](http://invisiblethingslab.com/resources/training_virtsec/VirtSecTraining-Agenda-0.9.pdf) -* _Attacking Intel® Trusted Execution Technology_, 2009, [paper](http://invisiblethingslab.com/resources/bh09dc/Attacking%20Intel%20TXT%20-%20paper.pdf), [post](http://blog.invisiblethings.org/2009/01/05/attacking-intel-trusted-execution.html) -* _Bluepilling the Xen Hypervisor_, 2008, [slides](http://invisiblethingslab.com/resources/bh08/part3.pdf), [post](http://blog.invisiblethings.org/2008/08/08/our-xen-0wning-trilogy-highlights.html) -* _Detecting & Preventing the Xen Hypervisor Subversions_, 2008, [slides](http://invisiblethingslab.com/resources/bh08/part2-full.pdf) [post](http://blog.invisiblethings.org/2008/08/08/our-xen-0wning-trilogy-highlights.html) -* _Security Challenges in Virtualized Environments_, 2008, [slides](http://www.invisiblethingslab.com/resources/rsa08/Security%20Challanges%20in%20Virtualized%20Enviroments%20-%20RSA2008.pdf) - - -Rootkits and Stealth Malware (offensive and defensive work) ------------------------------------------------------------ - -* _Evil Maid goes after TrueCrypt!_, 2009, [post](http://blog.invisiblethings.org/2009/10/15/evil-maid-goes-after-truecrypt.html), [poc](http://invisiblethingslab.com/resources/evilmaid/evilmaidusb-1.01.img) -* _Attacking SMM Memory via Intel® CPU Cache Poisoning_, 2009, [paper](http://invisiblethingslab.com/resources/misc09/smm_cache_fun.pdf), -* _Understanding Stealth Malware Training at Black Hat_, 2007, [post](http://blog.invisiblethings.org/2007/04/20/understanding-stealth-malware.html) -* _Beyond The CPU: Cheating Hardware Based RAM Forensics_, 2007, [paper](TODO), [post](http://blog.invisiblethings.org/2007/01/20/beyond-cpu-cheating-hardware-based-ram.html) -* _IsGameOver() Anyone?_, 2007, [slides](http://invisiblethingslab.com/resources/bh07/IsGameOver.pdf) -* _Subverting Vista Kernel for Fun and Profit (incl. introduction of Blue Pill)_, [post](http://blog.invisiblethings.org/2006/06/22/introducing-blue-pill.html), [slides](http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Rutkowska.pdf) -* _Introducing Stealth Malware Taxonomy_, 2006, [post](http://blog.invisiblethings.org/2006/11/24/introducing-stealth-malware-taxonomy.html), [paper](TODO) -* _Rootkit Hunting vs. Compromise Detection_, 2006, [slides](TODO) -* _System Virginity Verifier_, 2005, [slides](TODO) -* _Cross-view detection thoughts_, 2005, [article](TODO) -* _Implementation of Passive Covert Channels in the Linux Kernel (NUSHU)_, 2004, [paper](TODO), [slides](TODO) -* _redpill... or how to detect VMM using (almost) one CPU instruction_, 2004, [paper](TODO) -* _Concepts for the Stealth Windows Rootkit (The Chameleon Project)_, 2003, [paper](TODO) diff --git a/resources/Delibera_19_2015_Astensione_30.11-4.12_def.pdf b/resources/Delibera_19_2015_Astensione_30.11-4.12_def.pdf new file mode 100644 index 0000000..dfea047 Binary files /dev/null and b/resources/Delibera_19_2015_Astensione_30.11-4.12_def.pdf differ diff --git a/resources/Manuale_Gratuito_Patrocinio_1.3.pdf b/resources/Manuale_Gratuito_Patrocinio_1.3.pdf new file mode 100644 index 0000000..fa26d47 Binary files /dev/null and b/resources/Manuale_Gratuito_Patrocinio_1.3.pdf differ diff --git a/resources/caspar.jpg b/resources/caspar.jpg deleted file mode 100644 index 971a644..0000000 Binary files a/resources/caspar.jpg and /dev/null differ diff --git a/resources/consulenti.pdf b/resources/consulenti.pdf new file mode 100644 index 0000000..26b2ab4 Binary files /dev/null and b/resources/consulenti.pdf differ diff --git a/resources/figli_mantenimento.pdf b/resources/figli_mantenimento.pdf new file mode 100644 index 0000000..3efa8a1 Binary files /dev/null and b/resources/figli_mantenimento.pdf differ diff --git a/resources/figli_ratio.txt b/resources/figli_ratio.txt new file mode 100644 index 0000000..3ee8904 --- /dev/null +++ b/resources/figli_ratio.txt @@ -0,0 +1,77 @@ +( http://www.fanpage.it/mantenimento-figli-maggiorenni-non-autonomi-economicamente-separazione-divorzio/ ) + +Il mantenimento dei figli maggiorenni non autonomi economicamente dopo la separazione o il divorzio +--- +Il mantenimento dei figli ex art. 147 cc e 155 cc, derivante dalla separazione o dal divorzio dei coniugi, continua anche dopo la maggiore età dei figli e dura fino a quando i figli non hanno raggiunto l'indipendenza economica, l'obbligo di mantenimento non viene meno per il protrarsi degli studi, per i regali ricevuti da altri parenti o dalla nuova convivenza dell'altro genitore +--- + +* Gli effetti della separazione e del divorzio + +La separazione e il divorzio dei coniugi determinano una serie di conseguenze, non solo personali, ma anche (soprattutto) economiche, del resto, è inutile negarlo, dopo la separazione o dopo il divorzio entrambi i coniugi si trovano a fare i conti con un diverso tenore di vita (inteso in senso economico). + +I problemi economici non riguardano solo l’aumento dei costi, infatti, entrambi i coniugi si trovano ad affrontare spese duplicate (due appartamenti, due telefoni, duplici utenze acqua, luce, gas ecc.). + +Le complicazioni sorgono anche per esigenze più concrete come l’abitazione, basta pensare alla sorte della casa familiare, del resto, se durante il matrimonio un’abitazione (la locazione di una casa) era sufficiente per entrambi, dopo la separazione, è possibile che almeno uno dei due coniugi dovrà trovarsi (e pagare) una nuova abitazione (basta pensare all’ipotesi in cui solo uno dei due coniugi è proprietario dell’abitazione, perché acquistata prima del matrimonio). + +Non è, neppure, da escludere che saranno entrambi i coniugi a doversi trovare una diversa sistemazione abitativa (si pensi all’ipotesi di una abitazione in affitto durante il matrimonio, il cui canone di locazione non può essere sostenuto solo da uno dei due coniugi). + +E questo sorvolando su situazioni ancora più complicate che danno vita a problematiche infine inerenti il diritto di abitazione della casa familiare in caso di separazione e divorzio: l’esempio classico è quello relativo alla casa familiare di proprietà di uno dei due coniugi e assegnata all’altro come abitazione dei figli, oppure, basta pensare al problema relativo alla casa familiare di proprietà dei genitori di uno dei due coniugi e sempre assegnata all’altro coniuge come abitazione dei figli. + +* La fonte degli obblighi verso i figli durante il matrimonio + +Quelli sopra indicati, di solito, non sono solo problemi economici (personali) degli ex coniugi, ma sono un ulteriore motivo di scontro e di conflitto tra i due ex coniugi, a questa breve carrellata occorre aggiungere tutte le liti ingenerate per giungere alla quantificazione del mantenimento per il coniuge debole o per i figli e le liti derivanti per quantificare la durata di detto mantenimento. + +Infatti, in presenza di figli sorgono anche gli obblighi di mantenimento verso la propria prole. Questi obblighi sono codificati nell'art. 147 c.c. rubricato con il titolo di “Doveri verso i figli” il quale dispone che “Il matrimonio impone ad ambedue i coniugi l'obbligo di mantenere, istruire ed educare la prole tenendo conto delle capacità, dell'inclinazione naturale e delle aspirazioni dei figli”. Anche se l'art. 147 c.c. fa riferimento ai figli nati durante il matrimonio, oggi, anche dopo la riforma ex legge del 10 dicembre 2012 n, 219, relativa alla sostanziale equiparazione dei figli nati durante o fuori dal matrimonio, (qui si può leggere l'articolo sulla riforma attuata e da attuare) si può dire che tali obblighi sorgono sempre a favore dei figli e a carico dei genitori (uniti o meno in matrimonio). + +Questi obblighi prima che giuridici sono anche morali e sociali "l'obbligo dei genitori di mantenere i figli (articoli 147 e 148 cod. civ.) sussiste per il solo fatto di averli generati e prescinde da qualsivoglia domanda (cfr., ex plurimis, le sentenze nn. 5652 del 2012 e 5586 del 2000), ed irrilevante, ai fini dell'an e del quantum del mantenimento del figlio minore, dei contributi eventualmente corrisposti da terzi non giuridicamente obbligati" (Cass. civ. sez. I, del 11 settembre 2012 n. 15162) + +* La fonte degli obblighi verso i figli dopo la separazione e il divorzio + +Nel momento in cui sopraggiunge la crisi del matrimonio il codice prevede, coerentemente con quanto indicato nell'art. 147 c.c., che i doveri di mantenimento verso i figli continuano anche dopo la fine del matrimonio (separazione e divorzio) e l'art. 155 c.c. rubricato con il titolo di “Provvedimenti riguardo ai figli” stabilisce che “ … il figlio minore ha il diritto di mantenere un rapporto equilibrato e continuativo con ciascuno di genitori, di ricevere cura, educazione e istruzione da entrambi. Per realizzare tali finalità il giudice che pronuncia la separazione dei coniugi adotta i provvedimenti relativi alla prole con esclusivo riferimento all'interesse morale e materiale di essa. [….] fissando la misura e il modo con cui ciascuno dei coniugi deve contribuire al mantenimento, alla cura, all'istruzione e all'educazione dei figli […..] ciascuno dei genitori provvede al mantenimento dei figli in misura proporzionale al proprio reddito; il giudice stabilisce, ove necessario, la corresponsione di un assegno periodico considerando: 1) le attuali esigenze del figlio; 2) il tenore di vita goduto dal figlio in costanza di convivenza con entrambi i genitori; 3) i tempi di permanenza presso ciascun genitore; 4) le risorse economiche di entrambi i genitori; 5) la valenza economica dei compiti domestici e di cura assunti da ciascun genitore”. + +* Definizione di figli + +Con la locuzione "figli" il legislatore intende i figli di entrambi i genitori che si separano, non rientrano in questa categoria (e, quindi, non c’è obbligo di mantenimento) per i figli di uno solo dei coniugi (c.d. figli unilaterali), per comprendere meglio il principio si pensi ai figli avuti da un precedente matrimonio o da una precedente relazione, per questi figli il coniuge non genitore non ha nessun obbligo di mantenimento in caso di separazione e divorzio. + +Per cui, presupposto per l’assegno di mantenimento dei figli (ex art. 155 c.c.) è che ci siano figli di entrambi i coniugi, in presenza di figli di uno solo dei coniugi (unilaterali) non è possibile che al coniuge (non genitore) possano essere imposti obblighi di mantenimento ex art. 155 c.c. (il quale, si ripete, presuppone il rapporto di filiazione in capo ad entrambi i coniugi). + +Il principio per il quale non sorgere l'obbligo di mantenimento per il figlio di uno solo dei due coniugi, non muta, neppure, se il figlio unilaterale abbia convissuto con i coniugi durante il loro matrimonio e tale principio non è, neppure, scalfitto, dalla circostanza che al mantenimento del figlio unilaterale abbiano provveduto entrambi i coniugi durante il matrimonio (Cass. civ. sez. I, del 4 dicembre 2012 n. 21675). + +* La legittimazione a chiedere il mantenimento + +La richiesta del mantenimento (o la legittimazione a chiedere il mantenimento) spetta al coniuge, quando i figli sono minorenni, in presenza, invece, di figli maggiorenni, non autosufficienti, ma conviventi con uno dei due coniugi, la domanda di mantenimento può essere fatta dal coniuge anche in sede di separazione e divorzio, in questa ipotesi ci sarebbe una legittimazione concorrente tra il figlio e il genitore con il quale convive, ferma, ovviamente, la legittimazione del figlio maggiorenne ad agire personalmente (però non in sede di separazione e divorzio). Questi principi sono stati espressamente ripresi dalla giurisprudenza "E' incontroverso che il genitore convivente col figlio minorenne, ovvero maggiorenne ma non autosufficiente, è legittimato jure proprio ad ottenere dall'altro coniuge il contributo per il mantenimento del figlio, il quale e' a sua volta munito di concorrente legittimazione (Cass. citata; nonchè Cass. nn. 21437/2007, 13184/2011) ad agire in via prioritaria per ottenere il versamento diretto del contributo, e, in senso speculare ma opposto, per resistere all'iniziativa giudiziaria assunta dal genitore che non intenda assolvere alla sua obbligazione. La legittimazione personale del genitore convivente presuppone la convivenza col figlio minorenne ovvero maggiorenne ma non autosufficiente e sussiste finche' persiste tale condizione e sempre che il figlio non abbia agito in via autonoma (Cass. n. 11320/2005) esplicando la sua personale legittimazione basata sulla sua personale titolarità del diritto al mantenimento (Cass. di recente n. 13184/2011). Siffatta costruzione esegetica non è mutata a seguito dell'introduzione dell'articolo 155 quinquies c.c., non applicabile però nella specie ratione temporis, che prevede al comma 1 che "Il giudice, valutate le circostanze, può disporre in favore dei figli maggiorenni non indipendenti economicamente il pagamento di un assegno periodico. Tale assegno, salvo diversa determinazione del giudice, è versato direttamente all'avente diritto" che incide sulle sole modalità attuative di tale diritto." (Cass. civ. sez. I del 13 dicembre 2012 n. 22951). "Deve ritenersi che, non essendo intervenuta una sostanziale modifica degli assetti normativi che disciplinano gli obblighi di entrambi i genitori nei confronti dei figli, ancorche' maggiorenni, la legittimazione del coniuge convivente (definita normalmente "concorrente", ma anche, da qualche autore, "straordinaria") ad agire iure proprio nei confronti dell'altro genitore, in assenza di un'autonoma richiesta da parte del figlio, per richiedere tanto il rimborso, pro' quota, delle spese gia' sostenute per il mantenimento del figlio stesso, quanto il versamento di un assegno periodico a titolo di contributo per detto mantenimento, sussista tuttora (Cass., 24 febbraio 2006, n. 4188). Il giudice, laddove investito da una domanda proveniente dal genitore convivente con figlio maggiorenne non autosufficiente, dovra' quindi (sussistendone i presupposti) riconoscere in ogni caso il diritto al contributo fatto valere dal genitore che abbia avanzato la relativa domanda, salva la facolta' di modulare in concreto il provvedimento, prevedendo un "versamento" (termine di per se' maggiormente aderente alla regolamentazione di un mero aspetto attuativo del diritto) nelle sue mani, ovvero direttamente nelle mani del figlio maggiorenne, ovvero in parte all'uno ed in parte all'altro. Assume, quindi, rilievo giuridico l'inerzia del figlio maggiorenne alla percezione dell'assegno di mantenimento, essendo comunque salva la possibilita' per lo stesso di iniziare un procedimento ordinario inteso al riconoscimento di quel diritto, in maniera tale da eclissare la legittimazione in capo al genitore convivente (Cass., Sez. 1 , 24.12.2006, n. 4188; Cass., Sez. 1 , 16.7.1998, n. 6950; Cass., Sez. 1 , 10849/1996; Cass. Civ., Sez. 1 , 12.3.1992, n. 3019; Cass. Civ., Sez. 1 , 7.11.1981, n. 5874), nonche' salvo il diritto del figlio stesso di intervenire nel procedimento relativo alla determinazione e all'attribuzione dell'assegno (Cass., 19 marzo 2012, n. 4296)". (Cass. civ. sez. I del 10 gennaio 2014 n. 359). + +* Modifica, riduzione o estinzione del mantenimento + +Una volta quantificato il mantenimento per i figli, potrebbero verificarsi delle circostanze che potrebbero mutare (aumentare, ridurre o estinguere) detto mantenimento. Si può chiedere l'aumento del mantenimento se la crescita del figlio comporta l'aumento delle spese e contemporaneamente il coniuge obbligato al mantenimento ottiene aumenti di reddito (dovuti a miglioramenti lavorativi o al progredire della carriera) Cass. civ. sez. I, del 17 gennaio 2014 n. 920 + +Sicuramente non comporta estinzione o riduzione del mantenimento per il figlio l’eventuale nuova convivenza del genitore (affidatario del figlio), questo perché il convivente non ha obblighi di mantenimento di un figlio non proprio, al massimo la nuova convivenza dell'altro coniuge potrebbe essere una causa per una nuova quantificazione dei rapporti patrimoniali tra i due coniugi. + +Il mantenimento dei figli non termina con il raggiungimento della loro maggiore età di questi ultimi, ma l’obbligo del mantenimento continua fino a quando i figli non saranno economicamente autosufficienti. + +Da quanto detto quindi, si deduce che la cessazione dell’obbligo di mantenimento non è automatico al raggiungimento della maggiore età, ma, soprattutto, (in altri termini), di fatto, si potrebbe anche sostenere che non c’è un limite di tempo certo superato il quale l’obbligo di mantenimento cessa automaticamente. + +* Elementi necessari per eliminare il mantenimento + +È, però, evidente che il legislatore non intende imporre (in eterno) al genitore separato o divorziato il mantenimento del figlio maggiorenne, quindi, lo stesso ordinamento offre al genitore una tutela, quanto meno, nelle ipotesi patologiche. Infatti, il genitore per liberarsi dell’obbligo di mantenimento deve provare che il figlio è diventato economicamente autosufficiente. + +Del resto, è principio consolidato in materia di “obblighi di contribuzione dei genitori nei confronti dei figli maggiorenni quello secondo il quale l’obbligo dei genitori di concorrere al mantenimento dei figli, ex art. 147 e 148 c.c., non cessa, automaticamente, con il raggiungimento della maggiore del figlio, ma dura finché il genitore interessato alla dichiarazione della cessazione dell’obbligo stesso non provi che il figlio ha raggiunto l’indipendenza economica, oppure che il mancato svolgimento di un’attività economica dipende da un atteggiamento di inerzia o di rifiuto ingiustificato dello stesso figlio così Cass. civ. sez. I, del 26 settembre 2011 n. 19589” (Cass. civ. sez. VI, del 29 ottobre 2013, n. 24424) + +Raggiunta la maggiore età il figlio non ha l’obbligo di cercarsi un lavoro, ma può continuare la propria istruzione, infatti, neppure, l’attività scolastica del figlio (dopo la maggiore età) è un elemento che elimina il mantenimento, sia perché non può considerarsi attività lavorativa retribuita, sia perché, lo studio – in quanto tale – non rappresenta un atteggiamento di rifiuto del lavoro o di rifiuto verso il raggiungimento dell’indipendenza economica. Salvo, ovviamente, ipotesi patologiche nelle quali lo studio (es. iscrizione all’università) è solo di “facciata” (es. nessun esame sostenuto in 5 anni di iscrizione universitari) o i risultati scolastici siano palesemente scarsi o inesistenti. In altri termini, il figlio maggiorenne può continuare ad avere il diritto ad avere il mantenimento se la sua formazione scolastica è reale ed è confermata da risultati. + +L’attività economica (che determina la fine dell’obbligo di mantenimento) deve essere stabile e deve essere conforme alle attitudini del figlio. Quindi, per far cessare l’obbligo di mantenimento non è sufficiente un’attività economica saltuaria o precaria, la quale, al massimo, può dar vita ad una riduzione del mantenimento. + +Non è equiparabile ad un introito derivante da attività economica e, quindi, non sono causa di riduzione o estinzione del mantenimento per il figlio, gli aiuti (veri e propri regali) che il figlio riceve dai propri nonni, posto che il figlio non ha diritto ad ottenere o pretendere tali aiuti dai nonni (di fatto, si tratta di vere e proprie donazioni). + +Equiparabile all'attività economica (intesa come introito da reddito) è il possesso di un patrimonio che rendono il figlio autosufficiente, in tali ipotesi potrebbe cessare l'obbligo del mantenimento; soprattutto se il figlio "ormai ultratrentenne, dotato di patrimonio personale e ciò nonostante, ancora dedito, a spese del padre, agli studi universitari in sede diversa dal luogo di residenza familiare, senza avere ingiustificatamente né conseguito alcun correlato titolo di studio né trovato, al pari del fratello minore, una pur possibile occupazione remunerativa" (Cass. civ. sez. I del 6 dicembre 2013 n. 27377). + +Il genitore per liberarsi dell’obbligo di mantenimento deve provare che il mancato svolgimento di una attività economica del figlio dipende da un atteggiamento di inerzia lavorativa del figlio o da un suo rifiuto ingiustificato di accettare offerte di lavoro ricevute o altrimenti trovate (il rifiuto di un’offerta di lavoro inferiore alle capacità e competenze del figlio potrebbe non essere un motivo sufficiente per eliminare il mantenimento). + +* Necessità dell'intervento del giudice per l'eliminazione del mantenimento + +Una volta raggiunta l'indipendenza economica, il diritto al mantenimento si estingue. Però, è opportuno precisare che anche nelle ipotesi in cui viene meno il mantenimento, il genitore non può sospendere “automaticamente” il pagamento dell’assegno di mantenimento, (in altri termini l'estinzione dei versamenti a titolo di pagamento non è automatica), ma deve essere sancita dal giudice, il genitore deve chiedere al giudice la riduzione e/o l’estinzione dello stesso, se non segue questa strada il genitore obbligato al mantenimento potrebbe commettere un reato sospendendo il versamento di quanto dovuto a titolo di mantenimento. Il fatto, che nel periodo tra la raggiunta indipendenza economica e la decisione del giudice sull'estinzione del mantenimento il coniuge versi somme (di fatto) non dovute non determina un danno per il genitore, poiché, quest'ultimo, potrà sempre chiedere la restituzione di quanto versato senza obbligo. + +Inoltre, una volta raggiunta l'indipendenza economica è possibile che il figlio perda il lavoro e, di conseguenza, perda l'autonomia economica, in queste ipotesi, non ri-sorge l'obbligo di mantenimento, ma al massimo, il figlio che si trova in ristrettezze economiche avrà diritto agli alimenti. + +È opportuno ricordare che il mantenimento dei figli è regolato anche dal punto di vista fiscale, in particolare, il fisco regola (in generale) la ripartizione tra i coniugi separati delle detrazioni per i figli a carico, il sistema tributario italiano considera anche il versamento di assegni di mantenimento per i figli, infatti, il genitore che versa il mantenimento, riceve un piccolo riconoscimento dallo Stato in quanto può dedurre tali somme dal proprio reddito, il fisco regola anche la posizione del genitore che riceve l'assegno, quest'ultimo può detrarre l'assegno dal proprio reddito. + diff --git a/resources/figli_reato.txt b/resources/figli_reato.txt new file mode 100644 index 0000000..038b661 --- /dev/null +++ b/resources/figli_reato.txt @@ -0,0 +1,27 @@ +http://www.fanpage.it/il-ritardo-nel-versamento-dell-assegno-di-mantenimento/ + +Il ritardo nel versamento dell’assegno di mantenimento +--- +La Cassazione del 02.07.2012 n. 25596 si occupa del ritardo nel versamento dell'assegno di mantenimento in caso di separazione e divorzio e afferma che non sempre l'inadempimento civile dell'obbligazione e la fattispecie prevista come reato penale dall'art. 570 c.p. coincidono, infatti, per il reato penale è anche richiesta la volontarietà di non versare e la presenza dell'inadempimento civile grave, mentre è escluso il reato penale in presenza di meri ritardi nel versamento (c.d. inadempimento civile non grave) +--- + +Dalla separazione (consensuale o meno) e dal divorzio possono derivare carico di uno dei coniugi obblighi di versamento di somme di denaro per il mantenimento dell'altro coniuge o dei figli. + +La fonte di questi obblighi si rinviene negli articoli 155 c.c. (rubricato con il titolo di "Provvedimenti riguardo ai figli") prevede che anche in caso di separazione personale dei genitori il figlio minore ha il diritto di mantenere un rapporto equilibrato e continuativo con ciascuno di essi, di ricevere cura, educazione e istruzione da entrambi e di conservare rapporti significativi con gli ascendenti e con i parenti di ciascun ramo genitoriale. Per realizzare la finalità indicata il giudice che pronuncia la separazione personale dei coniugi adotta i provvedimenti relativi alla prole con esclusivo riferimento all'interesse morale e materiale di essa. Valuta prioritariamente la possibilità che i figli minori restino affidati a entrambi i genitori oppure stabilisce a quale di essi i figli sono affidati, determina i tempi e le modalità della loro presenza presso ciascun genitore, fissando altresì la misura e il modo con cui ciascuno di essi deve contribuire al mantenimento, alla cura, all'istruzione e all'educazione dei figli". + +E dal successivo art. 156 c.c. (rubricato con il titolo di "Effetti della separazione sui rapporti patrimoniali tra i coniugi") il quale prevede che "Il giudice, pronunziando la separazione, stabilisce a vantaggio del coniuge cui non sia addebitabile la separazione il diritto di ricevere dall'altro coniuge quanto è necessario al suo mantenimento, qualora egli non abbia adeguati redditi propri. L'entità di tale somministrazione è determinata in relazione alle circostanze e ai redditi dell'obbligato. Resta fermo l'obbligo di prestare gli alimenti di cui agli articoli 433 e seguenti". + +Gli operatori giuridici che si occupano quotidianamente di separazioni e divorzi sanno quanto è difficile addivenire ad una quantificazione di questi obblighi di mantenimento, del resto, gli stessi operatori sono coscienti che la maggior parte delle separazioni contenziose sono dovute alla difficoltà (alcune volte oggettive, altre volte soggettive) di poter giungere a una tale quantificazione, ecco, quindi, che, quando manca un accordo sul quantum del mantenimento, la quantificazione dovrà essere demandata al giudice. + +Anche quando si giunge alla definizione (bonaria o contenziosa) dell'assegno di mantenimento, i problemi non finiscono, poichè durante il corso della vita delle persone (successivo alla separazione o al divorzio) si possono verificare degli eventi che influiscono sulle capacità economiche della persona obbligata al pagamento. Alcune volte l'influenza è positiva (nel senso che aumenta la capacità economica del soggetto obbligato al versamento) altre volte (la maggior parte) è negativa perchè le potenzialità economiche possono diminuire. + +Si pensi all'ipotesi in cui il soggetto obbligato al pagamento contrae un nuovo matrimonio dal quale nascono altri figli, in tal caso si può trovare nell'imbarazzante condizione di dover versare il mantenimento ai figli di primo letto, ma di non poter mantenere, in modo adeguato, i figli di secondo letto. Oppure, basta pensare al caso classico della perdita totale del lavoro del soggetto obbligato al mantenimento. + +In queste situazioni occorre comprendere come deve comportarsi il soggetto obbligato al versamento per non incorrere nel reato previsto dall'art. 570 del codice penale (il quale rubricato con il titolo di "violazione degli obblighi di assistenza familiare") il quale prevede che "Chiunque, abbandonando il domicilio domestico, o comunque serbando una condotta contraria all'ordine o alla morale delle famiglie, si sottrae agli obblighi di assistenza inerenti alla patria potestà, o alla qualità di coniuge, è punito con la reclusione fino a un anno o con la multa da euro 103 a euro 1.032. Le dette pene si applicano congiuntamente a chi: 1) malversa o dilapida i beni del figlio minore o del pupillo o del coniuge; 2) fa mancare i mezzi di sussistenza ai discendenti di età minore, ovvero inabili al lavoro, agli ascendenti o al coniuge, il quale non sia legalmente separato per sua colpa. Il delitto è punibile a querela della persona offesa salvo nei casi previsti dal numero 1 e, quando il reato è commesso nei confronti dei minori, dal numero 2 del precedente comma. Le disposizioni di questo articolo non si applicano se il fatto è preveduto come più grave reato da un'altra disposizione di legge". + +Nel caso in cui sorge l'esigenza di rivedere il "quantum" dell'assegno di mantenimento, al fine di evitare di incorrere nel reato previsto dall'art. 570 codice penale, è opportuno non smettere di versare l'assegno, ma occorre chiedere al giudice competente la revisione dell'assegno in base alle mutate circostanze (156 comma 7 c.c.) . Certo, quanto detto è fattibile quando le sopravvenute circostanze permettono di continuare a versare l'assegno, anche se con difficoltà e la decisione se versare (in tutto o in parte) l'assegno resta una decisione personale, del resto, l'art. 57o c.p. colpisce proprio il comportamento volontario del soggetto che in modo cosciente e volontario si rifiuta di versare l'assegno o si auto riduce il quantum versato (anche avendo le possibilità di continuare a versate detta somma) prima di una decisione del giudice civile sulla revisione dell'assegno. + +La questione, invece, si complica quando la situazione muta radicalmente (es. si perde il lavoro) e l'impossibilità di versare non dipende più da una scelta volontaria e cosciente, ma da circostanze estranee al soggetto obbligato. + +Identico discorso vale anche quando, manca una totale e grave inadempimento, ma si è solo in presenza di meri ritardi nel versamento, sul punto del ritardo nel versamento (quantificato come inadempimento non grave) la Cassazione ha affermato non sussiste il retato di cui all'art. 570 c.p., questo perchè l'articolo 570 c.p. in questione, pur basandosi sull'inadempimento civilistico, che presuppone un inadempimento grave (anche totale o parziale), non può sanzionare gli inadempimenti non gravi (come il mero ritardo nel pagamento). + diff --git a/resources/figli_reato_sentenza.pdf b/resources/figli_reato_sentenza.pdf new file mode 100644 index 0000000..0d6bf38 Binary files /dev/null and b/resources/figli_reato_sentenza.pdf differ diff --git a/resources/joanna.jpg b/resources/joanna.jpg deleted file mode 100644 index 02d7864..0000000 Binary files a/resources/joanna.jpg and /dev/null differ diff --git a/resources/lawyers_absents.txt b/resources/lawyers_absents.txt new file mode 100644 index 0000000..38ba02c --- /dev/null +++ b/resources/lawyers_absents.txt @@ -0,0 +1,66 @@ +GIUNTA DELL’UNIONE DELLE CAMERE PENALI ITALIANE + +Delibera del 3 novembre 2015 + + La Giunta dell’Unione delle Camere Penali Italiane, + + PREMESSO + + che abbiamo partecipato negli anni passati al durissimo scontro fra accusatorio e inquisitorio, due culture e due modi di intendere il processo che si sono confrontati negli anni ’90, contendendosi il corpo del processo. Da un lato le sentenze della Consulta, le controriforme, la conservazione della prova e, dall’altro la riforma della custodia cautelare, il nuovo art. 111 della Costituzione, il “giusto processo” e le indagini difensive, a chiudere il decennio. Oggi queste due categorie concettuali che avevano orientato la nostra azione politica sulla strada della realizzazione della riforma del processo penale, della implementazione del modello accusatorio e del contrasto alla sua “controriforma”, non costituiscono più efficaci strumenti di lettura della evoluzione della politica giudiziaria. Il contesto appare sempre più caratterizzato da nuovi modelli processuali, da nuove esigenze e da nuove strategie che impongono a loro volta una analisi nuova che si collochi al di fuori della classica polarità “accusatorio/inquisitorio” e che tenga conto della complessità del contesto. Una complessità ed una frammentazione nella quale si fa strada un processo dotato di una nuova “funzionalità mediatica”, del tutto privato dei suoi valori, che utilizza, distorce in chiave autoritaria, il modello accusatorio e consente una crescente mortificazione della funzione difensiva, con una sovrapposizione e confusione della difesa dell’imputato con la difesa del delitto e con conseguenti inammissibili discriminazioni quali quelle poste in essere nell’ambito di recenti rilevanti processi di criminalità organizzata (come da ultimo nel processo cd Aemilia); + + che assistiamo sempre più spesso al realizzarsi di un nuovo modulo nel quale la “rappresentazione” del processo anticipa il processo stesso: immediata diffusione delle immagini degli arresti più clamorosi (Carminati, Bossetti, ANAS …), puntuale diffusione dei materiali delle indagini preliminari dotati di particolare efficacia (audio originali delle intercettazioni, video ambientali, sequestri …). Tramite questa modalità, non solo si pubblicizza l’efficacia dell’azione delle Procure, ma si mostra il risultato dell’indagine come un dato definitivo ed indiscutibile, dotato in questa maniera di una oggettiva ed inconfutabile evidenza che si stabilizza nell’opinione pubblica, influenzandola irrimediabilmente, attraverso una inedita azione di imprinting mediatico e che condiziona ogni successiva fase del processo, fino ad intaccare irrimediabilmente la stessa verginità cognitiva del giudicante. Il circuito mediatico-giudiziario ha oramai abbandonato la sua vecchia modalità relazionale fra media e processo, per divenire un vero e proprio strumento strategico di compressione della dignità dell’indagato, di mortificazione e di condizionamento del processo. Che tali modalità hanno di recente raggiunto vertici intollerabili, risolvendosi di fatto in una inaccettabile forma di mistificazione processuale e mediatica, cui bisogna rispondere con forza chiedendo non solo l’immediato ritorno all’osservanza di tutte le regole che vengono sistematicamente ed inammissibilmente violate, proprio da coloro che dovrebbero per primi esigerne il rispetto, ma anche l’intervento del Governo e del Parlamento, affinché nelle loro rispettive competenze, si facciano garanti di un ritorno alla civiltà dei rapporti fra Procure e media, restituendo al processo, al giudizio ed all’informazione la dignità e l’autonomia che gli spetta in una società civile e democratica; + + che un nuovo rapporto valoriale di natura pragmatica si è oggettivamente instaurato fra prescrizione del reato e durata ragionevole del processo, travolgendo ogni precedente distinzione dogmatica. Quanto più si allungano, sull’onda populistica, i tempi della prescrizione, tanto più si allungano i tempi del processo, con la conseguente mortificazione dei valori della ragionevole durata e della presunzione di innocenza. Questi valori rischiano di essere travolti, non solo da una demagogica spinta ideologica al rifiuto della possibile estinzione dei reati, ma anche dall’irrompere di decisioni del giudice sovranazionale, nelle quali si fa visibile l’attrito fra il modello continentale che governa il nostro ordinamento ed il modello di common low che governa la giurisdizione europea. L’allungamento dei tempi della prescrizione finisce con l’allontanare in maniera irragionevole il reato dalla decisione. E quanto più sono gravi i reati, tanto più gli stessi sono destinati così ad essere giudicati a decenni di distanza dal fatto. Il risultato rischia di essere un paradossale ribaltamento, in virtù del quale se una volta la prescrizione sanciva la superfluità del processo a causa dell’oblio nel quale era caduto il reato, sarà ora il perdurare del processo, con i suoi tempi eterni, a costituire l’unico possibile “ricordo” del reato; + + che alla radice di una positiva ed equilibrata evoluzione del processo penale, che coniughi la durata ragionevole con le esigenze dell’accertamento e con la pienezza delle garanzie, vi è un razionale impiego delle risorse umane ed economiche. Che la presunta mancanza delle risorse costituisce un evidente alibi per volgere il processo verso approdi di mortificazione del “giusto processo” che resta smentito dal fatto che in Italia, sia il numero dei magistrati che gli investimenti, sono sostanzialmente eguali a quelli degli altri paesi europei, nei quali tuttavia non vengono dilapidati milioni di euro per intercettazioni spesso totalmente inutili, quando non per indennizzi per le ingiuste detenzioni. Un utilizzo dissennato ed irrazionale delle risorse ha condotto negli anni ad una situazione degli Uffici giudiziari assolutamente inaccettabile perché ridotti ad una gravissima inefficienza non consona ad un paese europeo. Tali condizioni risultano diffuse, tanto nelle aree settentrionali che in quelle meridionali del Paese, provocando, non solo un evidente disagio nella intera utenza, ma trasmodando infine, per via della loro diffusione e della loro gravità, così come denunciato di recente da numerose Camere Penali territoriali (tutte le Camere Penali del distretto della Corte di Appello di Napoli e da ultimo, quelle di Benevento, Napoli Nord, Nocera Inferiore e Prato), in una vera e propria compressione della funzione difensiva, spesso oggettivamente mortificata, se non impedita, nelle sue più elementari prerogative. E’ necessario operare una complessiva rifondazione della organizzazione del processo penale, operando una effettiva razionalizzazione delle risorse ed impedendo in radice la inutile proliferazione dei reati e dei processi, ricordando al Governo la assoluta necessità di procedere sulla via di una seria e risolutiva depenalizzazione, la cui delega è in via di scadenza; + + che anche nell’ambito del processo penale, esauritasi la spinta propulsiva della modernità, con l’avanzare di nuove forme della politica e di un tipo di giudice interprete non solo della legge, ma anche dei suoi fini e dei suoi valori, entrano in crisi il principio di legalità e la riserva di legge. Non si può rispondere a tali sfide con gli strumenti oramai obsoleti offerti dall’esistente. Non vi è dubbio che occorre ricostruire nuovi equilibri che regolino i poteri dello Stato, che rifondino il CSM – la cui presunta “autoriforma” ha, sino ad oggi, prodotto deludenti modelli volti esclusivamente all’autoconservazione – che tengano lontana la giurisdizione dalla politica e dall’amministrazione, e che ne rifondino il potere disciplinare, rendendolo efficiente ed effettivo (vedi da ultimo il caso Palermo), e che, soprattutto, introducano nuove regole ordinamentali che tengano lontane le funzioni del giudice da quelle della magistratura requirente, con ciò ponendo le basi della sua Terzietà e della sua piena indipendenza, interna ed esterna; + + che l’uso indispensabile delle tecnologie si pone oggi in un rapporto ambiguo ed incongruo con il processo. Piuttosto che essere pensata come uno strumento di valorizzazione dei contesti operativi sottesi ad una piena realizzazione e ad una potenziale espansione dei principi del giusto ed equo processo, la tecnologia viene utilizzata in una chiave puramente efficientistica ed economicistica, al solo fine di risparmiare risorse incurante di irrinunciabili diritti. Piuttosto che la smaterializzazione dei fascicoli processuali, utile ad una rapida ed economica fruizione della conoscenza processuale (fondamento ineludibile del pieno esercizio del contraddittorio), si pratica, con un uso indiscriminato del “processo a distanza” (come da ultimo nel processo cd “Mafia Capitale”), la smaterializzazione dell’imputato, con ciò che questo significa in termini di disumanizzazione del processo e di compressione dei principi dell’immediatezza e del contraddittorio. Con la riforma dell’art. 146 bis disp. att. c.p.p. (nell’ambito del DDL di riforma del processo all’attenzione del Senato), si introduce nel processo penale uno strumento violento, arbitrario e visibilmente incostituzionale nella misura in cui bilancia incongruamente gli indeclinabili valori del contraddittorio, dell’immediatezza e del diritto di difesa con mere ed assai discutibili esigenze di risparmio, estendendo a tutti i processi la previsione della partecipazione a distanza ove vi siano ragioni di sicurezza, o qualora il dibattimento sia connotato da particolare complessità e sia necessario evitare ritardi; + + che occorre evidentemente denunciare nel suo complesso la logica emergenziale e securitaria che viene utilizzata surrettiziamente al fine di mantenere e di estendere normative eccezionali e straordinarie, già inaccettabili e di dubbia costituzionalità; + + che occorre, altresì, con rinnovata forza e convinzione criticare e contrastare agli strumenti del “doppio binario”, del regime speciale del 41 bis e dell’art. 146 bis att. c.p.p., che risultano manifestamente contrari ai suddetti principi ed utilizzati al di fuori di effettive esigenze di sicurezza e di contenimento della pericolosità e nel disprezzo della umanità del processo e della dignità delle persone; + + RILEVATO + + che occorre passare dallo stato di agitazione, a suo tempo deliberato, ad un segnale di protesta più forte al fine di proclamare in maniera inequivoca il disagio della intera avvocatura penale a fronte della paventata realizzazione di riforme settoriali criticabili, anche in materia di impugnazioni, portate avanti sotto l’impulso di spinte populistiche, quali la riforma della prescrizione che rischia di portare il processo penale verso un inaccettabile allungamento dei suoi tempi, in senso contrario al principio di ragionevole durata dettato dalla nostra Costituzione, ovvero inopinatamente tratte da ipotesi di lavoro efficientistiche ed autoritarie, che incidono pesantemente sulla natura stessa del processo penale, quale quella dell’art. 146 bis att., confliggenti in maniera evidente con i principi costituzionali del giusto processo, e con gli stessi dichiarati propositi di riforma del Governo; + + che la Politica deve affrontare le riforme del processo penale, con una idea complessiva e forte di processo, con un modello da realizzare. Questo significa porre essenzialmente al centro delle riforme, non solo una idea di Giudice, ma soprattutto una idea di processo che non sia più una macchina palingenetica, ma uno strumento laico di accertamento. Ciò significa costruire e predisporre nuovi strumenti volti alla decompressione del carico processuale, ma non in un’ottica meramente deflattiva, ma al fine di trovare nuove moderne forme di sanzione e di ricomposizione, e con l’obbiettivo finale di potenziare il dibattimento e il contraddittorio come luogo di composizione democratica di un conflitto, restituendogli pienezza ed efficienza. Nel processo penale non si gioca, infatti, solo la vita dell’imputato, ma la libertà di ogni cittadino; + + RITENUTO + + che occorre pertanto contrastare con assoluta determinazione la possibile estensione dello strumento del “processo a distanza” indistintamente a tutti i processi con detenuti e senza specifica motivazione, tramite la riforma dell’art. 146 bis att. c.p.p. attualmente all’esame del Parlamento; + + che occorre intervenire al fine di evitare la spettacolarizzazione dei processi e l’alimentazione dei circuiti mediatici che finiscono per consegnare all’opinione pubblica giudizi preconfezionati, attraverso l’esibizione e la gogna degli arrestati e la diffusione dei materiali di indagine, prima ed al di fuori di qualsivoglia controllo processuale; + + che occorre, dunque, segnalare al Governo la necessità di procedere ad una riforma organica del processo penale accelerando la razionalizzazione e la modulazione delle sanzione e realizzando una vera, seria ed estesa depenalizzazione che consenta di riservare al dibattimento la dignità che gli spetta all’interno del “giusto processo”; + + che occorre, pertanto, contrastare disegni di riforma volti, anche attraverso la limitazione delle impugnazioni, alla sostanziale vanificazione dell’istituto della prescrizione e la conseguente caduta dell’unico strumento capace di limitare la irragionevole durata dei processi; + + che occorre predisporre una seria e radicale riforma del CSM, e scrivere nuove regole che limitino in maniera rigorosa il passaggio dalla magistratura alla politica, e dalla magistratura all’amministrazione, ed operare un profondo riassetto ordinamentale che preveda una separazione della carriera del giudice, da quella dei magistrati requirenti, quale inderogabile presupposto della sua Terzietà. + + che occorre provvedere alla razionalizzazione ed alla nuova dislocazione di risorse al fine di rimediare con urgenza alle situazioni di collasso degli Uffici Giudiziari nei quali la mancanza dei minimi supporti organizzativi e materiali finisce con il costituire un gravissimo danno nei confronti di tutti i cittadini ed un inammissibile vulnus allo stesso diritto di difesa ed alla dignità della funzione difensiva; + + DELIBERA + + nel rispetto del Codice di Autoregolamentazione, l’astensione dalle udienze e da ogni attività giudiziaria nel settore penale degli avvocati penalisti dal 30 novembre al 4 dicembre 2015; + + INVITA + + le singole Camere Penali territoriali ad organizzare manifestazioni dedicate ai diversi temi della riforma del processo penale ed alle situazioni di degrado dei locali uffici giudiziari e di compressione della funzione difensiva, indicati nella presente delibera; + + INDICE + + una manifestazione nazionale a Roma, per la data del 2 dicembre 2015. + + DISPONE + + la trasmissione della presente delibera al Presidente della Repubblica, ai Presidenti dei due rami del Parlamento, al Presidente del Consiglio dei Ministri, al Ministro della Giustizia, ai capi degli uffici giudiziari. + + Il Presidente - Avv. Beniamino Migliucci + + Il Segretario - Avv. Francesco Petrelli + +Roma, 3 novembre 2015 + diff --git a/resources/lista_grat_patrocinio2.pdf b/resources/lista_grat_patrocinio2.pdf new file mode 100644 index 0000000..28530ec Binary files /dev/null and b/resources/lista_grat_patrocinio2.pdf differ diff --git a/resources/mfp19.jpg b/resources/mfp19.jpg new file mode 100644 index 0000000..a08d1a8 Binary files /dev/null and b/resources/mfp19.jpg differ diff --git a/resources/roadmap-2015-apr.png b/resources/roadmap-2015-apr.png deleted file mode 100644 index b0f403a..0000000 Binary files a/resources/roadmap-2015-apr.png and /dev/null differ diff --git a/resources/state_harmful.pdf b/resources/state_harmful.pdf new file mode 100644 index 0000000..47a70e3 Binary files /dev/null and b/resources/state_harmful.pdf differ diff --git a/resources/x86_harmful.pdf b/resources/x86_harmful.pdf new file mode 100644 index 0000000..9807112 Binary files /dev/null and b/resources/x86_harmful.pdf differ diff --git a/speaking.md b/speaking.md deleted file mode 100644 index 7662cbe..0000000 --- a/speaking.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -layout: page -title: Speaking -permalink: /speaking/ ---- - -This page (hopefully) contains some useful information for conference organizers -who wish to invite me to speak at their event, such as the current biography & -photo to be used for the conference page, as well as a few technical -requirements/constrains for travel and food. - -Bio ----- - -Joanna Rutkowska is a founder of Invisible Things Lab and the Qubes OS project, -which she has been leading since its inception in 2010. Prior to that she has -been focusing on system-level offensive security research. Together with her -team at ITL, she has presented numerous attacks on virtualization systems and -Intel security technologies, including the famous series of exploits against the -Intel Trusted Execution Technology (TXT), the still-only-one software attack -demonstrating Intel VT-d escape, and also supervised her team with the -pioneering research on breaking into the Intel vPro BIOS and AMT/MT technology. -She is also known for writing Blue Pill, the first hardware virtualization-based -rootkit, introducing Evil Maid attack, and for her prior work on kernel-mode -malware for Windows and Linux in the first half of the 2000s. - -Photo ------- - -Feel free to use this [photo](/resources/joanna.jpg). - - -Travel requirements --------------------- - -1. For any segment that requires more than 4 hours on a plane, I would require a - business class ticket. There is absolutely no exception from this rule, - sorry. - -Dietary constrains -------------------- - -1. I'm a vegetarian, and more recently, an aspiring vegan. Occasionally I might - eat egg-based products (i.e. bakery or pasta) if no viable vegan options - available. - -2. I enjoy mostly European cuisines (mostly southern). - -3. I don't tolerate anything spicy, sour, and generally don't like anything - exotic (in the meaning: different than European food) - -Other constrains ------------------ - -1. As a matter of principle, I don't travel to countries whose official laws are - in stark contrast with my personal believes and values. This includes e.g. - all the countries that discriminate women's rights _by law_ (such as most of - the Arabic countries), de-legalize love (such as, incredible and sad to - believe, Russia today), or otherwise limit people's freedom in some - unacceptable way. To be clear: it is absolutely irrelevant whether I - personally would be subject to any risk by such discriminatory laws or not. - - -Tips & Tricks --------------- - -1. Please don't ask me "how did you start with computers and security" -- as you - might imagine I have been asked this question about 1 million of times - already, and so I hardly enjoy repeating the answer yet one more time. There - are certainly more interesting topics to discuss! - -2. Please don't ask me how do I like the place I'm just visiting -- if I liked - it I would sure to mention it by myself. Most of the time though, when - traveling for business, I don't have enough time to get any opinion, and I'm - not quite the kind of person who would say "Oh, it's great!" just to please - you, sorry. - -3. Don't ask me to help with your IT security career or to scan your laptop for - malware, or how to implement advanced OpSec ;) - -4. I won't take an insult if you don't express excitement about my presentation, - last paper, or current project ;) - -5. Don't make it look like I'm being invited to speak because I'm a women. In - that case I will likely turn down your invitation. - -6. My name is pronounced: root-kov-skea - -Thanks for your understanding! - -Upcoming events ----------------- - -* "Security through compartmentalization" @ [Android Security Symposium](https://usmile.at/symposium/program), Sep 10, 2015, Vienna, Austria -* "Trust as the no. 1 enemy of security: the client systems study" @ [Next Generation Threat](http://techworld.event.idg.se/event/ngt15/), Sep 22, 2015, Stockholm, Sweden -* "Trust as the no. 1 enemy of security: the client systems study" @ [Next Generation Threat](http://techworld.event.idg.se/event/ngt15/), Sep 23, 2015, Goteborg, Sweden