December 2010 - security-devroom

[Security-devroom] talk proposal: BOFH meets SystemTap: rootkits made trivial
by Adrien Kunysz 21 Dec '10

21 Dec '10

I submitted this as a lightning talk before realising the security devroom might be more appropriate. The Bastard Operator From Hell enjoys abusing his users. SystemTap allows for very easy dynamic code injection system-wide (kernel, libraries, applications). This talk gives a brief overview of what is SystemTap and its capabilities. We then demonstrate how it can be used to dynamically insert questionable code at any level to spy on users and modify behaviours of applications and system components very easily. This is not about novel techniques or breaking trust boundaries (we assume you are root already). This is only about making things easier for both the good and the bad guys. This is a 20 minutes talk (say 30 minutes with pleny of time for questions). About me: I enjoy playing with Unix systems, breaking things, fixing things, reading code and tinkering with low level components and tools (kernel, libc, debuggers,...). I have been using SystemTap a lot in the last few years and started to see it as the ultimate hammer. If you measure Open Source activity by amount of code written, I haven't contributed in any significant way to any project. I wrote small patches to fix or improve tools I use like arping, strace or SystemTap. I co-founded the Free Software Users Group Arlon (Belgium) where technical talks and social meetings are organised frequently. I am currently unemployed and using my free time to toy with ideas like the one described in this talk.

1 0

[Security-devroom] Talk: "Supporting seven SSL libraries and one SSH library"
by Daniel Stenberg 18 Dec '10

18 Dec '10

Hi friends, My suggested talk for the opensc room at FOSDEM is as given in the subject: "Supporting seven SSL libraries and one SSH library" - how libcurl does to support them all and something about their differences. We've supported SSL-based libraries for way over a decade now and to be able to support a wide range of different libs we've managed to come up with a way to make it work. Why so many SSL libs? They're all a little different and I'll provide an outsider's view of how they stack against each other. The SSH situation is different and I'll touch that as well. 30 minutes should be fine for this. I've already added it to the wiki Bio: I'm an open source contributor since over 15 years. I lead and maintain several open source projects (curl, libssh2, c-ares, etc) and I'm a co-founder and contributor to many others (Rockbox for example). See ya all at FOSDEM! -- / daniel.haxx.se

1 0

[Security-devroom] Talk submission : SSH Libraries
by Aris Adamantiadis 17 Dec '10

17 Dec '10

Hello, I'm sorry I did not follow the procedure for the submission of talks. I already put a brief description of the talk on the wiki [1] but give the official submission now. Affiliation: libssh project, BELNET Bio: I'm lead of the libssh project [2], started in 2003. I work at BELNET (Belgian Research and Education Network) as technical advisor. Talk duration: 30 minutes (20 + 5 + 5). Can do less if that's absolutely needed. Talk: SSH libraries - what they can do for you. Since 2003, a few libraries that implement the SSH protocol are around. However, SSL and TLS are very popular protocols. Why would one use SSH for secure connection ? We will present the differences between SSH and TLS, as well as an overview of the different SSH libraries. We will then focus on libssh and give the status of the project, the achievements, and its future. [1] http://www.opensc-project.org/opensc/wiki/FOSDEM2011 [2] http://www.libssh.org -- Aris Adamantiadis

3 3

[Security-devroom] Talk submission: unifying access to PKCS #11 tokens
by Nikos Mavrogiannopoulos 17 Dec '10

17 Dec '10

Affiliation: GnuTLS, Katholieke Universiteit Leuven & IBBT Bio: Original author of the GnuTLS cryptographic library. Has worked on several security related projects and products. Currently works as a researcher in K.U.Leuven. Talk Duration: 30 minutes Cryptographic services in modern operating systems today are being accessed by applications by using libraries, either high level ones that hide all details, or low level ones that force the user to deal with an amount of (un)interesting details of each cryptographic algorithm. Applications in the GNU/Linux and *BSD operating systems usually share the same libraries for cryptographic operations and protocols. Those can be one of Botan, OpenSSL, NSS, GnuTLS and maybe some more. This is quite a variety of choices which we believe is because of the different programming style that each library enforces, the different algorithms it provides and the ease of usage, which are subjective issues that depend on the eye of the beholder. However this diversity of cryptographic libraries has some disadvantages. For operations such as signing/encryption involving PKCS #11 hardware tokens, or software modules, objects need to be referenced. Currently there is no uniform way of referencing those objects and each of the libraries has its own conventions or delegate the burden of referencing objects to the application. This in effect makes sharing of those object references between different applications impossible and users are required to learn each application's unique interface. Moreover the fact that usually there are more than one PKCS #11 providers in a system, but no way to globally enable them for all cryptographic applications, leaves the burden of setup to users. We will discuss the challenges posed and and propose a solution.

2 1

[Security-devroom] How to Store Trust: Assertions
by Stef Walter 09 Dec '10

09 Dec '10

Stef Walter -- stefw(a)collabora.co.uk Affiliation: Collabora Ltd, GNOME Maintainer of GNOME Keyring, and has been involved in a large number of security projects both in the open source community and otherwise. Demystifying crypto and security for users and allowing simple but powerful uses of security technologies is of special interest. Talk Duration: 30 minutes Talk: How to Store Trust: Assertions In order to provide a usable foundation for crypto on the desktop, the various crypto libraries need a way of accessing common information about the user's preferences with regard to certificates and 'trust'. "Trust Assertions" provide a way to represent certificate authority anchors, 'pinned' certificate exceptions, revocation lists, and other bits of trust information. A common method of accessing this information is missing from the open source desktop. We will show how we can make this information available through PKCS#11, so the user's applications (regardless of crypto library) can act consistently when making trust decisions. We'll present one solution, but more importantly: kick start progress in this area and discuss how we can move forward together.

1 0

[Security-devroom] Talk submission, EJBCA and OpenSC
by Tomas Gustavsson 09 Dec '10

09 Dec '10

Hi, Here is my submission for a talk at the security devroom at Fosdem. I can probably jam my session into a 30 minute slot. Who am I? Contact: Tomas Gustavsson Tel: 046-707421096 Email: see from field Affiliation: PrimeKey Solutions AB / EJBCA Bio: Project founder/manager of the EJBCA PKI project (http://ejbca.org/) and CTO at PrimeKey (http://primekey.se) Long time developer and consultant with PKI/security solutions (nowadays exclusively for EJBCA and SignServer). Contributor to projects such as BouncyCastle (http://bouncycastle.org/) Have also sent minor patches to other projects such as pcsclite and openscep. Talk duration: I can probably cram my session into a 30 minute slot. Talk description: "PKI smart cards in practice; usage lifecycle" The whole chain needed in order to use smart cards are quite complex. PKI, middle-ware and cards are needed and must all work together in order to make a succesful deployment in larger scale. This talk will demonstrate how opensc can be used together with EJBCA PKI, using smart cards as an HSM for the certificate authority, issuing certificates to user smart cards to be used for client authentication. We will show where the tricky integration points are and talk about what we can do about it together.

1 0

[Security-devroom] talk proposal: dynalogin two-factor authentication
by Daniel Pocock 08 Dec '10

08 Dec '10

Hi, I've recently released some code that I wrote a while ago for two-factor (particularly HOTP) authentication. http://www.dynalogin.org If you feel this is of interest, I would be happy to participate in or lead a session about this at the dev room. I understand that some of the other dev room participants have already contributed to this project indirectly through the HOTP toolkit and in other ways. My vision for dynalogin is a solution that can be deployed as a package on Linux distributions and be instantly up and running, enabling almost plug-and-play two-factor authentication for UNIX, RADIUS, OpenID and other technologies. Session duration: flexible, up to a full 1 hour slot is fine Open source background: long time user of Debian. Release of open source (but sadly not open patent) G.729 module for Asterisk. Contributed a B2BUA to the reSIProcate SIP stack project. Developer/release manager on Ganglia project, and possibly one of the largest commercial deployments of Ganglia/rrdtool. Professional: secure connectivity and messaging solution developer, investment banking Also of interest: B. CompSci received at Melbourne Uni (co-incidentally, the school where Wikileaks founder Julian Assange studied) Also, there is an error on your original message, linked to from the FOSDEM main page ( http://lists.fosdem.org/pipermail/fosdem/2010-December/001083.html ), you have (twice) a link to http://lists.fosdem.org/mailman/listinfo/fosdem and I think you mean to link to: http://lists.fosdem.org/mailman/listinfo/security-devroom Regards, Daniel

1 0

[Security-devroom] Security / hardware crypto devroom CFP draft.
by Martin Paljak 01 Dec '10

01 Dec '10

Hello, Please proof-read and improve if possible the CFP draft [1] for the security devroom. I'll send it out in the afternoon, to the generic fosdem list, this list and opensc-devel. This will mark the official CFP, please consider your submissions and spread the word about the event to possible presenters and participants. As many (most) of subscribers of this list represent libraries, getting the word about the devroom out to the users (developers using libraries and users using those applications) would be a very appreciated task. Thanks, Martin [1] https://www.opensc-project.org/opensc/wiki/FOSDEM2011/CFP -- @MartinPaljak.net +3725156495

1 0