On Heartbleed: Some Updated Guidance (A Newsflash)

Although Heartbleed has "fallen off the radar", it is still out there.    I received this from an IBM Contact.  The opinions are his own--some key insights to be aware of:

Important new/updated information is highlighted in green.

IBM's list of vulnerable products:  https://ibm.biz/BdRJfE

- V7000/Unified
- Campaign v9.1
- Contact Optimization v.91

Recent AIX & VIOS update:

http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq?mode=18&ID=3548&myns=pwraix61&mync=E

These are my opinions alone.  These are not IBM's opinions:

Why all the heartache about HeartBleed?

The 2012-2014 editions of the OpenSSL https/SSL/TLS authentication and encryption
protocols have a serious defect (named HeartBleed). On a 10-point scale, one respected
security researcher rates HeartBleed 9:10.

Why?  HeartBleed enables the mass theft of the security certificates (private keys) used
to negotiate the authentication and encryption used between clients and servers.

What appls & services are vulnerable?

Everything using OpenSSL's heartbeat function.

An incomplete list of home/SOHO devices are affected:

- Routers; Examples:  AirportExtreme, CeroWRT
- Firewalls; Examples:  WatchGuard, FortiGate
- Printers
- Backup devices; Example:  Apple Time Capsule
- NAS file servers; Examples: Western Digital's "My Cloud", Synology
- NEST thermostats
- Polycom video conference
- Plesk Panel

Note: OpenSSH is not affected, because it does not use OpenSSL's
heartbeat feature.  Other appls and services built on-top of OpenSSH are
not vulnerable.  Example:  scp
How-to Scan/Test for Vulnerable Systems/Devices on Your Local Subnet:

  http://www.crowdstrike.com/community-tools  (Windows-only)

BROWSERS ... for Users

Users need to insure that their web browsers (all of them), correctly handle revoked
security certificates. To test your browser, use: https://revoked.grc.com

Your web browser should return an error message in the spirit of:
- An error occurred during a connection to revoked.grc.com.
- Peer's Certificate has been revoked.
- Error code: sec_error_revoked_certificate

If your web browser connects to GRC without complaint, your
web browser is defective.  Hopefully, it will be patched.
WEBSITES ... for Users:

Users should "test" all websites they visit that use https/SSL/TLS.
I suggest testing using: https://www.ssllabs.com

Select the "Test your server" feature.  Once a website passes this check, you
need to change your password (because you have no definitive method to
determine if your login credentials were stolen during the vulnerability period.)

WEBSITES ... for Sysadmins

The most recent surveys show that ~17.5% (~500k) websites are running vulnerable
OpenSSL editions.  17.5% is little comfort ... as most of the remaining websites are
running even older editions, which have other substantive defects.

Required actions for those with web servers that support OpenSSL's 2012-2014 edition:

#1: Update/patch to the MOST CURRENT edition of OpenSSL.

#2: Update all appls & middleware that rely on OpenSSL.

#3:  Replace your encryption key & security certificate with a new key & certificate.
You must replace as you have no way to positively determine that your
certificate has (not) been stolen.

Please consider upgrading to Extended Validation certificates.  Yes, they
are more expensive.  Yes, they are a PITA.  But they will help secure iOS
Safari clients as soon as you adopt EV certificates.

#4:  Revoke the prior security certificate to insure that the blackhats cannot
re-use it.  If you do not revoke the prior certificate, your site is still
subject to impersonation/spoofing/MITM.

#5:  Force users and sysadmins to change their passwords; by mass expiring
all passwords.

#6:  Optional; but a REALLY good idea:

- Implement Perfect Forward Secrecy (Ephemeral Diffie-Hellman)

- Verify your website's security configuration using:

https://www.ssllabs.com

Sunset support for olde, tired, weak & broken encryption.

Browsers;  IMHO;  the Certificate Revocation Ecosystem is Insufficiently Trustworthy

The dirty secret about (all?) browsers' revocation defaults, is that they are all
defaulted to Soft-Fail if a security certificate cannot be validated.  Bluntly;  if
they cannot validate a certificate, they treat it as-if it is valid.

- Apple Safari & Google Chrome cannot be reconfigured to support hard-fail. For this
 reason, I am changing my opinion of all IE, Safari & Chrome implementations to "fail."

- IE can be [re]configured to support Hard-Fail, but it requires a Registry hack.  There
are also other, very good certificate validation reasons that all editions of IE
ought not be trusted be trusted for secure ops.

- Firefox can be [re]configured to support Hard-Fail:

> Tools
>> Options
>>> Advanced
>>>> Certificates
>>>>> Validation
>>>>> Put a checkmark in the box:  When an OCSP server connection fails,
treat the certificate as invalid.

Preliminary findings compiled from a few trusted sources:

MAC OSX:

Safari: Fail - Cannot be configured for Hard-Fail.

Safari obeys system settings.  The default behavior is to
make a best-effort to determine if a security certificate
has been revoked.  i.e. If it cannot determine status, the
certificate is assumed to be secure.
Chrome: Fail - Ditto.

Firefox v3.x: Pass - Blocked by default.

Firefox v28.x: Fail - APPEARS to be configured, by default, for blocking...
but DOES NOT BLOCK.
iOS:
Safari: Fail - cannot be configured for Hard-Fail.

Standard validation certificates:  No blocking and no
apparent option to enable it.  Sigh ...

Extended Validation certificates:  Blocking is enforced.
Good news;  but, why did Apple choose to mishandle
standard validation?

Chrome: Fail - cannot be configured for Hard-Fail.
Windows XP:

IE9: Fail - Ignores revocation AND no apparent way to
enable.

There are other very good reasons certificate validation
reasons  to not trust any edition of Internet Explorer for
secure ops.

Chrome: Fail - Ignores revocation AND ignores its own setting.
Two fails in one.

Firefox v28.x: Fail - Erratic behavior observed.
Win7/64:

IE8: Fail - Not for HeartBleed, but for other serious certificate
(mis)handing matters. 

Defaults to Soft-Fail.  Hard-Fail support only by a
Registry hack.

IE11: Fail - Not for HeartBleed, but for other serious certificate
(mis)handing matters.

Defaults to Soft-Fail.  Hard-Fail support only by a
Registry hack.
Chrome: Fail - Cannot be configured for Hard-Fail.

Firefox v24.x: Pass - Properly handles/blocks sites with revoked certificates.

Firefox v28.x:  Pass - Properly handles/blocks sites with revoked certificates.

Android KitKat:

Chrome: Fail - Shows revoked content.  No visible way to turn it on.

Cannot be configured for Hard-Fail

Firefox: Pass - Properly handles/blocks sites with revoked certificates. 

On Success: Courtesy of "Ted Talks"

Ted Talks never seizes to amaze me.   This was which I shared over Twitter earlier tonight is ever so a testament to the essence of success and very much in line with what this blog channel is about:

Briefly "on the grid" catching up..hope friends enjoy this "view of the wk"..and wishing all a beautiful wk :-) http://t.co/oe5v6Aobav
— Mike Pouraryan (@mikepouraryan) May 4, 2014

View of the Week: Listening to the Great Stephen Hawkins

Ray Kurzweil--who I believe now works for Google--has advoacated such transformation through his singularity principles for years. Yet, the prospects that Stephen Hawkins reflects on is ever so dangerous. I am always reminded of the Battlestar Galatica scenario which can happen. What was amusing though, was how the Congress of the United States was obsessed with Benghazi as more pressing issues were before us... When he speaks, we should listen. As one should be excited about the Vision of the Possible, sometimes it will be scary:

A "Thought 4 the W-End"....When he talks, we should all listen...wishing all the best of w-ends :-( http://t.co/JXALAGGNTg

— Mike Pouraryan (@mikepouraryan) May 3, 2014

A "Thought 4 the Week" on Friendship :-)

As the new month begins, some "food 4 thought 2 remember"..it is an eloquent as ever--may we be ever so blessed...Thank you again Jonathan Lockwood Huie  

for reminding us all of the blessings

Onward to the new month!! :-)

 

A friend is someone who understands my past,

believes in my future, and accepts me just the way I am.

- Anonymous

A true friend is one who believes in you

when you have ceased to believe in yourself.

- Anonymous

Friends are those rare people who ask how we are

and then wait to hear the answer.

- Anonymous  

A friend knows the song in my heart

and sings it to me when my memory fails.

- Anonymous 

On the Run w/a brief Update from Microsoft

Shared this earlier today--glad to see this development:

Good news from Microsoft http://t.co/iZ2u1bN2sW

— Mike Pouraryan (@mikepouraryan) May 1, 2014

A 'View of the Week" : The need to "Lighten Up & Live Well"

It is the end of a new month and the beginning a new one--and with it loads of possibilities.   It begins with the embrace and appreciation for life.   I was reflecting upon this as one of my friends from High School shared the predicament of her Grandson and as my own Uncle underwent surgery for Stomach Cancer yesterday--whereby 3/4 of his stomach was removed.

What also was quite hopeful, though, was what happened to the owner of the LA Clippers, Donald Sterling.   The NBA Commissioner, Adam Silver banned him for life for his nascent racist remarks.  I was on Twitter yesterday as news was breaking and just like Charles Barkley, my reaction was, "Wow".   It was a watershed moment that underscored how America has changed.  Although Mr. Sterling will walk away with close to a Billion Dollar Windfall for the forced sale of the Clippers, it underscores a level of maturity and transformation in American Society that will be better ever more for us all.    I could not agree ever more with the leading lights of the NBA including Dominique Wilkins, Charles Barkley and indeed the great Doc Rivers, the Coach of Clippers.

As I reflected upon that that day, I received from a very gracious old Friend brought it all home--and to constantly do our utmost to achieve the "Vision of the Possible" in our own way:

Lighten up and live well

You are an important, indispensable part of life on this day. Yet that is no reason to be arrogant.

You have a vital job to do. Yet that doesn’t mean you must be stuffy and overly serious.

You do things best when you do them joyfully. Lighten up, have fun, and spread true joy everywhere you go.

Be mature and responsible, but don’t be dull and brooding about it. Be purposeful and determined, but don’t be uptight about it.

Demonstrate your determination not with a rigid scowl on your face, but with joyous achievement. Life is an amazingly grand adventure, so allow yourself to experience and express delight in every moment.

See yourself as happily dancing through the moments of this day, and nothing will be able to bring you down. Live lightly, live joyously, and live well.

— Ralph Marston

On Heartbleed: Some Brief Thoughts from an Old IBM Associate

An Old IBM Associate was good enough to share his personal views on what should be done regarding Heartbleed.  I wanted to report on it here for all:

Important new/updated information is highlighted in green.

IBM's list of vulnerable products:  https://ibm.biz/BdRJfE

Why all the heartache about HeartBleed?

The 2012-2014 editions of the OpenSSL https/SSL/TLS authentication and encryption
protocols have a serious defect (named HeartBleed). On a 10-point scale, one respected
security researcher rates HeartBleed 9:10.

Why?  HeartBleed enables the mass theft of the security certificates (private keys) used
to negotiate the authentication and encryption used between clients and servers.

What appls & services are vulnerable?

Everything using OpenSSL's heartbeat function.

Note: OpenSSH is not affected, because it does not use OpenSSL's heartbeat
feature.  Other appls and services built on-top of OpenSSH are not vulnerable.
Example:  scp
BROWSERS ... for Users

Users need to insure that their web browsers (all of them), correctly handle revoked
security certificates. To test your browser, use: https://revoked.grc.com

Your web browser should return an error message in the spirit of:
- An error occurred during a connection to revoked.grc.com.
- Peer's Certificate has been revoked.
- Error code: sec_error_revoked_certificate

If your web browser connects to GRC without complaint, your
web browser is defective.  Hopefully, it will be patched.
WEBSITES ... for Users:

Users should "test" all websites they visit that use https/SSL/TLS.
I suggest testing using: https://www.ssllabs.com

Select the "Test your server" feature.  Once a website passes this check, you
need to change your password (because you have no definitive method to
determine if your login credentials were stolen during the vulnerability period.)

How-to Scan/Test for Vulnerable Systems on Your Local Subnet:

  http://www.crowdstrike.com/community-tools  (Windows-only)

WEBSITES ... for Sysadmins

The most recent surveys show that ~17.5% (~500k) websites are running vulnerable
OpenSSL editions.  17.5% is little comfort ... as most of the remaining websites are
running even older editions, which have other defects.

Required actions for those with web servers that support OpenSSL's 2012-2014 edition:

#1: Update/patch to the MOST CURRENT edition of OpenSSL.

#2: Update all appls & middleware that rely on OpenSSL.

#3:  Replace your encryption key & security certificate with a new key & certificate.
You must replace as you have no way to positively determine that your
certificate has (not) been stolen.

Please consider upgrading to Extended Validation certificates.  Yes, they
are more expensive.  Yes, they are a PITA.  But they will help secure iOS
Safari clients as soon as you adopt EV certificates.

#4:  Revoke the prior security certificate to insure that the blackhats cannot
re-use it.  If you do not revoke the prior certificate, your site is still
subject to impersonation/spoofing/MITM.

#5:  Force users and sysadmins to change their passwords; by mass expiring
all passwords.

Browsers;  IMHO;  the Certificate Revocation Ecosystem is Insufficiently Trustworthy

The dirty secret about (all?) browsers' revocation defaults, is that they are all
defaulted to Soft-Fail if a security certificate cannot be validated.  Bluntly;  if
they cannot validate a certificate, they treat it as-if it is valid.

- Apple Safari & Google Chrome cannot be reconfigured to support hard-fail. For this
 reason, I am changing my opinion of all IE, Safari & Chrome implementations to "fail."

- IE can be [re]configured to support Hard-Fail, but it requires a Registry hack.  There
are also other, very good certificate validation reasons that all editions of IE
ought not be trusted be trusted for secure ops.

- Firefox can be [re]configured to support Hard-Fail:

> Tools
>> Options
>>> Advanced
>>>> Certificates
>>>>> Validation
>>>>> Put a checkmark in the box:  When an OCSP server connection fails,
treat the certificate as invalid.

Preliminary findings compiled from a few trusted sources:

MAC OSX:

Safari: Fail - Cannot be configured for Hard-Fail.

Safari obeys system settings.  The default behavior is to
make a best-effort to determine if a security certificate
has been revoked.  i.e. If it cannot determine status, the
certificate is assumed to be secure.
Chrome: Fail - Ditto.

Firefox v3.x: Pass - Blocked by default.

Firefox v28.x: Fail - APPEARS to be configured, by default, for blocking...
but DOES NOT BLOCK.
iOS:
Safari: Fail - cannot be configured for Hard-Fail.

Standard validation certificates:  No blocking and no
apparent option to enable it.  Sigh ...

Extended Validation certificates:  Blocking is enforced.
Good news;  but, why did Apple choose to mishandle
standard validation?

Chrome: Fail - cannot be configured for Hard-Fail.
Windows XP:

IE9: Fail - Ignores revocation AND no apparent way to
enable.

There are other very good reasons certificate validation
reasons  to not trust any edition of Internet Explorer for
secure ops.

Chrome: Fail - Ignores revocation AND ignores its own setting.
Two fails in one.

Firefox v28.x: Fail - Erratic behavior observed.
Win7/64:

IE8: Fail - Not for HeartBleed, but for other serious certificate
(mis)handing matters. 

Defaults to Soft-Fail.  Hard-Fail support only by a
Registry hack.

IE11: Fail - Not for HeartBleed, but for other serious certificate
(mis)handing matters.

Defaults to Soft-Fail.  Hard-Fail support only by a
Registry hack.
Chrome: Fail - Cannot be configured for Hard-Fail.

Firefox v24.x: Pass - Properly handles/blocks sites with revoked certificates.

Firefox v28.x:  Pass - Properly handles/blocks sites with revoked certificates.

Android KitKat:

Chrome: Fail - Shows revoked content.  No visible way to turn it on.

Cannot be configured for Hard-Fail

Firefox: Pass - Properly handles/blocks sites with revoked certificates. 

A "Weekly Mojo" as the New Week is Before Us :-)

Post by Mike Pouraryan.

An "Outsiders" Newsflash: On the Future of Digital Public Service

As I write this, I am attending a session on the Future of Digital Public Service sponsored by GovLoop--Never ever a dull moment...



More on it soon :-)

A "View of the Week": On Making A Difference :-)

It is another beautiful day as I begin another "Virtual Run" in the blog channels.     The idea of creating a "vision of the possible" starts with some random acts of kindness.   The folks @ Simple Truths sent out this sense of purpose that would ultimately determine whether we will making a difference--it is ever so possible: 

 

When you think about a random act of kindness you can do today, remember these 3 things:

1.  Anyone can make a difference. When 8-year-old Katelyn Indelicato heard about a local man who was shot and paralyzed as an innocent bystander in a drive-by shooting, she wanted to help him any way she could. She emptied her own piggy bank and raised money to pay for a physical therapy session for a complete stranger who was going through a tough time. “Anyone can make a difference,” Katelyn said. “You can be more than what you are right now. You can do more than what you’ve already done.” If a 3rd grader can make a difference, you can too. (From Why Not Me? Young People Making a Difference in the World p. 32) 2.  A single small act of goodwill has the potential to make a huge difference. In 1963, Edward Lorenz presented a hypothesis to the New York Academy of Science: A butterfly could flap its wings and set molecules of air in motion, which would move other molecules of air, in turn moving more molecules of air—eventually capable of starting a hurricane on the other side of the planet. He was laughed out of the conference, his hypothesis preposterous. More than thirty years later, the butterfly effect was found to be authentic, accurate, and viable. Just like the flap of a butterfly’s wings can cause a hurricane, an act of kindness by one person can make the world a more positive place. (From The Butterfly Effect: How Your Life Matters p. 6) 3.  Don’t forget to pass it on. It feels so great when someone goes out of their way to do something nice for you, doesn’t it? Pass that feeling on by doing a good deed for someone else because kindness is like a snowball that’s rolling down a hill. Each unselfish act or word is another snowflake that greets the others… creating something much larger than itself in the process. (From The Power of Kindness p. 33)

It is also to remember this admonition from William Wordsworth:

The best portion of a good man's life is his little,

nameless, unremembered acts of kindness and of love.

- William Wordsworth 

A "Newsflash 4 the Week": 5 Tips for Creating Strong Passwords - Techlicious

The folks @# always do great work in educating us all

Some Great advise to take advantage of: 5 Tips for Creating Strong Passwords - Techlicious

On Easter Sunday 2014: Remembering a Solitary Life

On this Easter Sunday, this clip says it all...

Happy Easter to all!! :-)

One Solitary Life: A Inspirational Movie

Watch Now

Pounding the "Virtual Pavement": On the Elections in #India

As someone who has served in a number of elections, I can't help but continue to be fascinated as over 800 Million People go to the polls in India: India election coverage map - Interactive - Al Jazeera English

As Good Friday is Upon Us :-)

....Remembering this admonition:  

“There is no medicine like hope, no incentive so great, and no tonic so powerful as expectation of something better tomorrow.” —Orison Swett Marden SHOP - Sunrise Inspiration Framed Motivational Prints Sign up for your complimentary Daily Sunrise Inspiration

On the "Social Grid": A Brief "Thought 4 the Week"

Yesterday was the 562nd Birthday of Leonardo.   May we all be ever so blessed to have even 1/10th of the vision he had:

“I have been impressed with the urgency of doing.
Knowing is not enough; we must apply.
Being willing is not enough; we must do.”

~ Leonardo da Vinci

As we also celebrate leaders, it is also important not to forget always to forgive for one's one sake:

Forgiveness is an act of self-love and respect.
- don Miguel Ruiz

The key to forgiveness is to forgive
from the heart -- not from the mind.
- Sheri Rosenthal

Forgiveness is not always easy.
At times, it feels more painful
than the wound we suffered,
to forgive the one that inflicted it.
And yet, there is no peace without forgiveness.
- Marianne Williamson

It  is by this that achieving "a vision of the possible" can be a reality.

It begins with us.

Onward!! :-)

View of the Week: Arundhati Roy on Her New Book, "Capitalism: A Ghost Story," and World's ...

For this "View of the Week" I decided to report on this from one of my favorite moralists of all time: Arudhati Roy.   She's been at the forefront of Social Justice not just in India--but around the World.  India has begun voting and what happens in India matters--and when she speaks, we all should listen.  The full broadcast can be accessed by clicking here.

A Reminder From Steve Jobs....

“You can’t just ask customers what they want
and then try to give that to them.
By the time you get it built,
they’ll want something new.”

~ Steve Jobs