http://venom.crowdstrike.com/ vulnerability in virtual floppy stuff for KVM, Xen and QEMU
If your web server can write to the floppy drive, you've already messed up big :P
haha
Of course it's still a valid vulnerability.... Just don't be upset when a burglar uses a key you've left under your front doormat :p
same could be said for nearly anything
Only the ones that rely on a pre-existing privilege escalation
user opens hosting account with derphost, derphost emails root password, user never changes root password, user's mail acct is compromised and root password and ip address are grabbed
problem is that another user on the same physical host can allow the host to be pwned and then we're all screwed
(there are plenty of hosts who do that, and plenty of users who don't know what they're doing who are looking for cheap hosting and don't know not to change host configured pws)
yes, exactly
err, know to* change
hi
everyone know status of bcp38 deployments around the world?
i know that page http://spoofer.csail.mit.edu/summary.php providing status, but now it's almost broken
m0unds: good point, I'd overlooked the obvious fact that this means we're all only as safe as the least-safe guest on the host.
http://marc.info/?l=openbsd-misc&m=119318909016582
openbsd-misc: "Re: About Xen: maybe a reiterative question but .." from Theo de Raadt <deraadt () cvs ! openbsd ! org> @ 2007-10-24 1:14:13
lol
brycec: yeah, i was just thinking along the lines of securing belongings in an apartment building, but your upstairs neighbor falls sleep with a cigarette in hand and burns the building down
i like the custom element blocking in ublock
i use it to block comments on sites i visit who don't use discus or livefyre, since i block those with ghostery
*disqus <.<
>.>
oh, whoops
I don't know why I even bother perusing comments on news articles and the like :(
i just block them so i don't even think about it :)
I should think about that
if i want to see them on a particular article, i just use the one-time load feature in ghostery
it'll reload the page so i can see it and then go back to blocking after
unfortunately, it only works with third party stuff like disqus***** and livefyre and the like
What does ghostery do that uBlock can't/won't? Why a second extension?
focuses on privacy related stuff
and widgets
it can block ads, but i just opt out of that list because it's not as good
uBlock has privacy-lists though
ghostery also gives you the ability to selectively toggle seeing stuff or not, so it's convenient
without having to disable it for the whole site
trying to find a site w/disqus so i can take a screenshot
http://www.spokesman.com/stories/2015/may/13/spokane-adopts-new-rules-for-short-term-rentals/comments/
(Kudos to that site for burying comments under another link from the article)
http://i.imgur.com/wfa52sf.png
("There are 44 comments on this story. Click here to view comments >>")
cute
the other thing is that they control the list, so it can be updated whenever vs predefined intervals on some lists
i think all the easylists include a minimum update interval of like 5 days
and if you're using their lists, they expect you to respect that and not update more often
(not to say you /couldn't/ just update anyway)
the other handy thing (imo) is that it blocks a lot of the junky media players that news sites use
and allows you to toggle them on/off if you want to see a video
our local news outlets are awful about autoplaying teaser videos for stories and stuff. i hate it.
I can't go to a local news site because my computer isn't powerful enough
lol
"i had to upgrade my pc to read local news" - story at 11
m0unds: I flashblock for that (hooray for Chrome having that builtin)
ah
Anyone use The Great Suspender on chrome?
i saw a suspending thing on firefox, it seemed annoying
m0unds: local news auutoplays videos here too, and they're terrible quality, and it gives you 5 seconds to cancel, but you can't say "always cancel", so have to cancel every time :(
I was not aware of TGS but I may have to play with it. I semi-often go through task explorer and kill unused tabs once memory usage gets heavy, but this could automate that
thx
erk this venom thing souunuds disturbing
people really shouldn't need floppy support these days
I don't mind fdc support in the emulator itself, because sometimes one needs that. But the fact that Venom is exploitable even without an FDC loaded in the guest is just silly.
what it brings to mind for me isr that normal processes on linux need more securing
like once youu break into qemu/kvm it shouuld be more bounded.
buut i don't think apparmour does much on ubuntu for kvm?
I thought you were limited to the whatever privs the qemu process has?
doesn't kvm split into two processes
i think it normally runs as an intermediate user though
so you won't have root, but will have access to other vm's
That's what she said!!
so like root/secondary user split process model
I imagine that paravirtualisation makes anything like apparmour rather difficult since you've moved the IO out of the host kernel's view
actually i think it's single process setuid to user, and kernel modules give it more root-like functionality
you still open a normal file for read/write
but how can they know what file the vm is associated with
or files
you really need to double-step that kind of thing
like libvirt could create a second template for the vm itself and both usued together?
i haven't looked into it, i duno if you can even do that
this packet of death thing seems to need some obscure driver loaded.
maybe i need a better place than phoronix to read about this stuff :)
What POD is that? I didn't see anything mentioned about a POD vector for Venom
lol phoronix...
http://www.phoronix.com/scan.php?page=news_item&px=OZWPWN-4-PoD-Linux
i hate phoronix's benchmarking
but really there isn't muuch benchmarking available for linux :(
and they did make a test suite.  it's just that there's no good tests for the test suite to execute.
i suppose the "graphics" side of things isn't too bad.
but the disk stuff is terrible.
looks like the POD affects a wireless USB device/stack. Not many people have those...
(Looking at https://www.kernel.org/doc/readme/drivers-staging-ozwpan-README)
yeah exactly
So... fear mongering rather than bug reporting. *sigh*
a lot of linux vulnerabilities are in (obscure) drivers
No surprise there.
That's what she said!!
you read about scary vulnerabilitles
then realise it's fine because you don't have usb enabled
or wireless drivers or whatever it is :)
i have usb enabled these days.
but just like disk/keyboard/mouse
I really disagree with the use of "vulnerability" in this case, at least the way it's used. This is really more bug than vuln.
i'm not sure how i feel about that.
For a vuln to be a vuln, it should affect a large userbase and probably go back awhile too.
in some ways marking all buugs as vulnerabilities sounds like a "nice" idea.
I feel like "vuln" is more "intentional" than just an uncaught bug on an obscure driver.
true not for patching
ie from not being prudent?
i don't think most vulnerabiltiies are intentional.  i think they're oversight, from people not being prudent enough to check all input sizes etc.
like we normally don't get packets > 1.5k so we'll assign 2k buffer, but we don't check if there's more data, and we'll send as much data as is in packet
Yeah probably. There's plenty of grey-area here.
so someone uses 9k mtu on their network, and people send more than 2k of data and do an overrun.
Really not sure these bugs warrant CVEs though. https://lkml.org/lkml/2015/5/13/739
oh wow
that guuy seems to really putting himself ouut there, jusut looking at how many messages in the thread are his
i think he's probably trying to get a job or something :/
lkml is craaaawling
it's fast for me
1.28 seconds load time on page speed tracker
(back to normal now)
Any reason you didn't cc: the maintainer who could actually apply these
to the kernel tree?
hahaha
"You missed me, and the driverdev mailing list.  netdev could care less"
about this.
greg kh seems cool.
(I'd clicked a couple of messages and it was just "waiting...")
1.26 seconds now
That's what she said!!
yeh it's probably packet loss
what!  it's hosted on digitalocean.
I'm not really familiar with Linux's layout, but a directory called "staging" strikes me as "super-beta" type stuff. Definitely not worth a CVE let alone Phoronix's hype.
in europe
sigh
ok i need a better news site
with as much news as phoronix is good :)
so i check news.arpnetworks.com even though i know it's just hosting news rather than what i'm looking for..
http://www.itworld.com/article/2920349/security/for-containers-security-is-problem-1.html
and find this
"staging" is defined as "This option allows you to select a number of drivers that are not of the "normal" Linux kernel quality level. These drivers are placed here in order to get a wider audience to make use of them. Please note that these drivers are under heavy development, may or may not work, and may contain userspace interfaces that most likely will be changed in the near future."
And it recommends disabling staging drivers "If in doubt, say N here."
http://cateee.net/lkddb/web-lkddb/STAGING.html
yeah, i don't enable staging normally
i think i did once over 10 years ago
(Apparently Arch goes against the grain and has it enabled in their default kernel with ozwpan compiled as a module.)
And if you're curious about the whole Ozmo thing, here's a decent description from the Linux perspective http://fabiobaltieri.com/2013/02/14/hp-wi-fi-direct-mouse-on-linux/
Apparently the idea is to have wireless peripherals connect over WiFi instead of Bluetooth or RF dongles.
And broadly only supported under Winders. Except for this driver.
ahh
i really have to get away from the arch kernels
all ubuntu systems are using custom kernels.
hmm, so i don't have floppy enabled on kernel for my xen stuff
and i don't have it in the config for vm's, so i think that means i'm not vulnerable?
also there's no known exploit yet
According to what I read, you're vulnerable so long as FDC is supported in qemu, whether or not it's enabled anywhere else.
yeah so if it's not in the config it's fine
vultr took 3 hours to apply patch whilst giving downtime it seems
i have another vm with some cheap place that's got downtime right now
mercutio: still affected "And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers."
http://venom.crowdstrike.com/
yeh that sounds like disabling it insside the vm
rather than in the external vm config
err hangon did i disable it extenrakll
I read it as even if it's disabled in the config, you're still vuln.
oh
da,m
maybe i do have to patch
and i'm compiling from source for xen ...
but don't have random users with root
redhat seems to think that people not having root means you're "reasonably safe"
Well that IS the biggest thing you can do right :p
yeah
sweet vultr gave me an account credit
nice
I have a hard time taking this patch seriously. "+Signed-off-by: John Snow <jsnow at redhat.com>"
hahaha
(Because "John Snow" is a character on Game of Thrones)
yeh i know that, i don't watch it, but i still know it :)
(for anyone that doesn't get it)
I didn't watch it at first, but recently started (and caught up) and I quite enjoy it
i did try watching it, i just found it boring.
there's no good tv atm :(
i might have to watch mediocre stuff
venom's getting a lot of news about it
hmm i wonder if amazon is vulnerable.
Probably
then again, maybe not. Hmm. They have customized Xen pretty much, wouldn't be too surprised if they ripped out FDC entirely.
yeah they might have
they're not
they have a CVS advisory on their site
xen-pv isn't vulnerable either
oh xen pv is what i use, sweet.
http://aws.amazon.com/security/security-bulletins/XSA_Security_Advisory_CVE_2015_3456/
^
is amazon xen-pv?
i wondeer if pvhvm is vulnerable
i imagine probably not too
if it uses qemu, it's likely vulnerable
hmm i dunno if it does or not
it's just using the ept stuff with pv
ie the performance of hvm, but still need special kernels
mercutio: what did Vultr give you credit for?
skimming scrollback
mnathani_: 3 hours downtime to apply patch to kvm
it's not the first time i've had downtime with vultr, or that vm.
i haven't really got anything important on it, but to me 3 hours downtime seems like a long time.
i don't think i've had 3 hours total downtime on arp
there was one planned outage iirc
s/CVS/CVE
<m0unds> they have a CVE advisory on their site
and kudos to m0unds for the info
oh apparently apparmor is likely to block it on ubuntu
http://www.ubuntu.com/usn/usn-2608-1/
judging from that
err, ye
a
i'm the typo kid
"The guest operating system communicates with the FDC by sending commands such as seek, read, write, format, etc. to the FDC’s input/output port"
^^ so what if the guest OS doesn't have a floppy drive?
apparently you can't disable it in qemu properly.
i see: "even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers"
but that's confusing...
yeah i don't know if that means in bios, or the libvirt config.
yaeh
yeah
yea, administrator is kind of vague in this case
is it host admin or guest admin
haha
yeah
https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ up_the_irons
It is also exposed regardless of presence of any floppy related QEMU command line options so even guests without floppy disk explicitly enabled in the libvirt or Xen configuration files are affected.
ah ok thanks
i wonder if the long term fix is to allow to disable more devices in qemuu
haha brycec
i'm surprised the redhat bug tracker is visible
half the time redhat bug tracking seems to be closed
regarding venom, Ubuntu advisory states:
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
but no mention of 10.04, which I believe is not EOL'd just yet.  anyone know if 10.04 isn't affected?
EOL 4/30
2015
https://lists.ubuntu.com/archives/ubuntu-announce/2015-April/000196.html
Yeah, EOL'd.
oh fuck, just got EOL'd...
oh, is that the release you were just upgrading stuff to?
no, but what a PITA anyway...
freebsd released an update for freebsd-update today too
errata, errata everywhere
That's what she said!!
LOL
haha, BryceBot you're a goon
Sigh.
 freebsd apparently has resolved the reboot bug now too :)
is there anywhere that provides free wildcard certificaters?
or at least really cheap
http://www.garrisonhost.com/ssl-certificates/alphassl.html alphassl resellers are usually your best bet
hmm $45
let's encrypt will be around soon i'm hoping
i assume resellers are probably still more than 420
$20
myabe should just use cacert
just want it for testing :)
mercutio: i can do them pretty cheap
wildcards
less than $20?
no but i can do it cheaper then anyone likely advertises @ $35
the more years obviously the cheaper per year
yeah i want like 3 months
i can do a free 3 month ssl cert
but it won't be wildcard
That's what she said!!
cacert should be fine i think
you can ruin an installer to install it at least
startssl should work too and at least they're in everybody's cert chain
"ruin an installer" eh?
startssl don't do wildcard.
s/ruin/run/
<brycec> "run an installer" eh?
oh
i wanted to fix my one :)
i have one now :)
mercutio: not for free, no. neither does cacert.
:P
oh cacert isn't for free?
http://wiki.cacert.org/WildcardCertificates
Last I knew Cacert didn't offer wildcards
Evidently that seems to have changed in the last 10 years
Actually this wiki just talks about wildcards in general, but doesn't state whether Cacert offers them.
"we provide host and wild card certificates which you can issue almost immediately"
(From http://wiki.cacert.org/FAQ/AboutUs)
hmm
i could try it in nginx
mnathani_: Biggest down-side to The Great Suspender is that in Chrome Sync, all my remote tabs just show as "Suspended Tab"
it's being annoying in trafficserver and not working but i don't know if it's my config
yeah seems to work fine
wiki.cacert.org uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is unknown.
lol
yeah
what are they included in by default?
go to root
like.. a few linuxes?
and install their root cert
i dunno
i mean startssl is usable ebcause it's pre-installed root
i can't feasibly use cacert
you can use it for servers etc
because if i was making my clients install root certs i'd just use my own ca at that point
Exactly my points, hazardous
true, but just having a standard one seems good in some ways
if i'm using it for servers
wosign let you shove a few names in your free cert
yeah curl seems fine with it
I don't know about wildcards
i'd use my CA too
no wildcards gizmoguy
assuming you mean the free ssl
wosign give you 100 alternative names
hacky way of getting a half-wildcard cert
https://buy.wosign.com/free/
heh yes hacky
i have a wildcard tinydns domain name :/
*cough*
look up <anything>.ambitio.nz
woot, got http2 going.