Re: OpenBSD crypto and NSA/Bruce Schneier

2013-09-11 Thread David Eisner 
On Wed, Sep 11, 2013 at 10:00 AM, John Long codeb...@inbox.lv wrote:


 You think they need to target protocols? There are much easier ways of
 doing
 things. Strong crypto works if you do all the management stuff. Most people
 have no idea what's involved with that. Like Espie says there's plenty low
 hanging fruit. If you're somebody they want to know about the methods they
 use don't have anything to do with technology.


There's more than one threat model, though. Here are two:

1. They are targeting a specific individual or a small group. In that
case, protecting your electronic communications is going to be difficult.
They'll get around the crypto if they need to.

2. They are dipping their net into a fiber optic stream and fishing
(automated search) for interesting traffic.

Targeting protocols would be attractive to them for threat model 2, even if
they can handle threat model 1. And even in the case of threat model 1, a
vulnerable protocol makes their job cheaper, in terms of both money and
risk.

-David

Re: OpenBSD crypto and NSA/Bruce Schneier

2013-09-11 Thread David Eisner 
On Wed, Sep 11, 2013 at 2:56 PM, Geoff Steckel g...@oat.com wrote:

 Disk drives are (presumably) trivial to take over. They have firmware
 and mechanisms to
 use alternate physical blocks for a given logical block.



You're absolutely correct, and this is not theoretical: (page navigation is
in the links on the right):

  http://spritesmods.com/?art=hddhackpage=1

His proof-of-concept (for a remotely-compromised HD on a web server)
involves requesting a URL with a trigger string in it. When the URL gets
written to the web server's log file, the HD firmware sees this and arms
itself. Now, when /etc/shadow is next read, the firmware adds a hidden
account to it.

-David

dmesg garbage and RTC BIOS diagnostic error on Dell Optiplex 790.

2012-02-13 Thread David Eisner 
I just installed OpenBSD 5.0-stable i386 on a brand new Dell Optiplex
790.  I'm running the GENERIC.MP kernel, which I built after updating
to the latest -stable as of this morning.  However, I saw the garbage
even before rebuilding from source (i.e. with the kernel in
install50.iso).

I have two problems that worry me:

1. I see this in dmesg:

RTC BIOS diagnostic error
3fconfig_unit,memory_size,fixed_disk,invalid_time

2. There is garbage in the dmesg output, e.g.:

pci2 at 
phd0\M-X\^F\^X@\M^Wwevnt\^B\^B`(\M-/0v(\M-!0v\^PDh\M-Xx\M^Xv\M-z\^S1\M-H\M-GI\M^G\M-j\M^OC\
M-|\M-BQ\M^V\^A\^B\^B`\^PDh\M-Xx\^Xl\M-[x\240k\M-[xp\M-\M-Xxptal\M-Xction
0 Intel 6 Series USB r
ev 0x04: 
aphd0\M-0\^F\^X@\M^Ww\\\M-3\M-Xx\M^D\M-5\M-Xx\M-d\M-%\M-Xx`\M-\M-Xx`\M-\M-Xxp\M-\M-Xxp\
M-\M-Xxt\M-/\M-XxP\M-0\M-Xx,\M-1\M-Xxd\M-2\M-Xx\^P\M-4\M-Xx\M^X\M-3\M-Xxon
0 Intel 82801BA Hub-to
-PCI rev 0xa4ptal\M-0 ppb2 bus 3


This doesn't give me a warm fuzz feeling.  Should I file a bug report?

Here is the full dmesg output:

ptal\M-Xt acpi0: C3, C2, C1, PSS
acpicpu3 at 
acpphd0\M-X\^F\^X@\M^Wwevnt\^B\^B`(\M-@\^Nv(\M-_\^Mv\^P\^T\^D\M-Xx\M^Xv\M-z\^S1\M-H\M-GI\M^G\M-j\M^OC\M-|\M-BQ\M^V\^A\^B\^B`\^P\^T\^D\M-Xx\^Xg\M-[x\240f\M-[x\240h\M-[xptal\M-X
1800, 1600 MHz
pci0 at mainbus0 bus 0:
phd0\M-X\^F\^X@\M^Wwevnt\^B\^B`(2\^Ov(\M-M\^Nv\^PD\M-_\M-x\M^Xv\M-z\^S1\M-H\M-GI\M^G\M-j\M^OC\M-|\M-BQ\M^V\^A\^B\^B`\^PD\M-_\M-x\^Xh\M-[x\240g\M-[x\240i\M-[xptal\M-X
screen 1-5 added (80x25, vt100
emulatiophd0\M-X\^F\^X@\M^Wwevnt\^B\^B`(\M-:\^Qv(,\^\v\^PD
\M-Xx\M-t\^W\M-Xx\M^Xv\M-z\^S1\M-H\M-GI\M^G\M-j\M^OC\M-|\M-BQ\M^V\^A\^B\^B`\^PD
\M-Xx\M-t\^W\M-Xx\^Xi\M-[x\240h\M-[x\240j\M-[xptal\M-XLM rev 0x04:
msi, address 
d4:be:d9:8d:1phd0\M-X\^F\^X@\M^Wwevnt\^B\^B`(\M-F\^Rv(\M-:\^Qv\^P\M-|\M^_\M-Ax\M^Xv\M-z\^S1\M-H\M-GI\M^G\M-j\M^OC\M-|\M-BQ\M^V\^A\^B\^B`\^P\M-|\M^_\M-Ax\^Xj\M-[x\240i\M-[x\240k\M-[xptal\M-Xries
HD Audio rev 0x04: msi
azalia0: 
cophd0\M-X\^F\^X@\M^Wwevnt\^B\^B`(\M-!0v(l0v\^PW\M-Xx\M^Xv\M-z\^S1\M-H\M-GI\M^G\M-j\M^OC\M-|\M-BQ\M^V\^A\^B\^B`\^PW\M-Xx\^Xk\M-[x\240j\M-[x\240l\M-[xptal\M-Xs
PCIE rev 0xb4: apic 2 int 18
pci2 at 
phd0\M-X\^F\^X@\M^Wwevnt\^B\^B`(\M-/0v(\M-!0v\^PDh\M-Xx\M^Xv\M-z\^S1\M-H\M-GI\M^G\M-j\M^OC\M-|\M-BQ\M^V\^A\^B\^B`\^PDh\M-Xx\^Xl\M-[x\240k\M-[xp\M-\M-Xxptal\M-Xction
0 Intel 6 Series USB rev 0x04:
aphd0\M-0\^F\^X@\M^Ww\\\M-3\M-Xx\M^D\M-5\M-Xx\M-d\M-%\M-Xx`\M-\M-Xx`\M-\M-Xxp\M-\M-Xxp\M-\M-Xxt\M-/\M-XxP\M-0\M-Xx,\M-1\M-Xxd\M-2\M-Xx\^P\M-4\M-Xx\M^X\M-3\M-Xxon
0 Intel 82801BA Hub-to-PCI rev 0xa4ptal\M-0 ppb2 bus 3
pcib0 at pci0 dev 31 function 0 Intel Q65 LPC rev 0x04
ahci0 at 
pcphd0\M-(\^F\^X@\M^WwRUNTSERV\^B\M^H\M^RH\M-kJ03\M-Xx\M^H3\M-Xx\^D4\M-Xx\^\4\M-Xx(\M--\M-Xx\M-,\M-Xx\M^H\^R\M-Xx0\^S\M-Xx\M-4\^S\M-Xx(\^C\M-Xx\M^P\^X\M-Xx\M-t\M-\M-Xx\^L\M-%\M-Xx\\\^T\M-Xxptal\M-(ixed
naa.5000c5003f89cf88
sd0: 238475MB, 512 bytes/sector, 488397168 sectors
sd1 at scsiphd0\M^X\^F\^X@\M^WwIBI
SYST\^Bx\M-!N\^W\M-v(c\M-Lxx\^B\^D\^X\M-u\M^\up\M^_\M-Lx\^X\M-u\M^\u\^P\M^_\M-Lx\^Xn\M-[x\M-p\^Z\M^Ww\^F\^X^\M-[xptal\M^X
targ 2 lun 0: TSSTcorp, DVD-ROM TS-H353C, D100 ATAPI 5/cdrom
removable
ichiic0 at pci0 dev 31 function 3 Intel 6 Series SMBus rev 0x04: apic 2 int 18
iic0 at ichiic0
spdmem0 at iic0 addr 0x53: 2GB DDR3 SDRAM PC3-10600
isa0 at pcib0
isadma0 at isa0
com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 b\^Ae fifoptal\M-h\M^@at
isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
lpt0 at isa0 port 0x378/4 irq 7
npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
mtrr: Pentium Pro MTRR support
uhub2 at uhub0 port 1 Intel product 0x0024 rev 2.00/0.00 addr 2
uhub3 at uhub1 port 1 Intel product 0x0024 rev 2.00/0.00 addr 2
uhidev0 at uhub3 port 2 configuration 1 interface 0 Dell Dell USB
Entry Keyboard rev 1.10/1.15 addr 3
uhidev0: iclass 3/1
ukbd0 at uhidev0: 8 modifier keys, 6 key codes
wskbd1 at ukbd0 mux 1
wskbd1: connecting to wsdisplay0
vscsi0 at root
scsibus1 at vscsi0: 256 targets
softraid0 at root
scsibus2 at softraid0: 256 targets
root on sd0a (b0a500a867c9d0a0.a) swap on sd0b dump on sd0b
syncing disks... done
rebooting...
OpenBSD 5.0-stable (GENERIC.MP) #0: Mon Feb 13 07:24:50 EST 2012
r...@sisyphus.umd.edu:/usr/src/sys/arch/i386/compile/GENERIC.MP
RTC BIOS diagnostic error 3fconfig_unit,memory_size,fixed_disk,invalid_time
cpu0: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz (GenuineIntel
686-class) 3.30 GHz
cpu0: 
FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,SBF,SSE3,PCLMUL,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,SSE4.2,POPCNT,XSAVE,AVX
real mem  = 2022690816 (1928MB)
avail mem = 1979523072 (1887MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 11/24/11, BIOS32 rev. 0 @
0xffa10, SMBIOS rev. 2.6 @ 0xf21e0 (80 entries)
bios0: vendor Dell Inc. version A10 date 11/24/2011
bios0: Dell Inc. OptiPlex 790
acpi0 at bios0: rev 2
acpi0:

Re: dmesg garbage and RTC BIOS diagnostic error on Dell Optiplex 790.

2012-02-13 Thread David Eisner 
On Mon, Feb 13, 2012 at 4:44 PM, Theo de Raadt dera...@cvs.openbsd.org
wrote:
 RTC BIOS diagnostic error
 3fconfig_unit,memory_size,fixed_disk,invalid_time

 Increasingly common.  Ignore this.

 2. There is garbage in the dmesg output, e.g.:
...
 These errors are in your earlier boots.  Your machine is corrupting
 (during a reboot) or not your memory is very stable during a power
 cycle.  As a result, this shows.

 The newest boot in the log, though, is clean.


OK, good to know.  I will forge on, then.

Thanks for the quick reply.

-David

Dell Optiplex 790 NIC support (Intel, Broadcom)

2012-01-30 Thread David Eisner 
I'm putting together a system to serve as a dedicated OpenBSD
firewall.  I want to know whether the network interfaces are supported
by OpenBSD.

The system I'm looking at is a Dell Optiplex 790. Here is what Dell's
website has to say about the NICs in question:

  * On board: (LOM) Intel. Gigabit LAN 10/100/1000 Ethernet.
  * Second NIC: Broadcom 5722 NetXtreme 10/100/1000 PCIe Gigabit NIC
Card, Full Height

Unfortunately there are no model numbers.  It looks like the em [1]
and bnx [2] drivers might provide support. Is this likely?

Thanks.

-David

[1] http://www.openbsd.org/cgi-bin/man.cgi?query=emarch=i386sektion=4
[2] http://www.openbsd.org/cgi-bin/man.cgi?query=bnxarch=i386sektion=4

Re: Dell Optiplex 790 NIC support (Intel, Broadcom)

2012-01-30 Thread David Eisner 
On Mon, Jan 30, 2012 at 11:57 AM, Michael T. Davis
dav...@ecr6.ohio-state.edu wrote:
According to Dell's documentation (at http://support.dell.com), the
 OptiPlex 790 LOM is an Intel 82579LM, specifically cited by em(4).  I
believe
 you've already identified the Broadcom model (i.e. BCM5722); it appears
this
 is handled by bge(4):

  http://www.openbsd.org/cgi-bin/man.cgi?query=bgearch=i386sektion=4


Thanks, Mike.  I had trouble finding the Intel model number, but I now
see it is indeed available from support.dell.com (in the system
manual).  So it looks like this hardware is supported on OpenBSD, as
you said.  Thanks again.

-David