Archive for the ‘Security’ Category

What is a read-only profile?

14 January 2010

In a multi-user Cardbox installation it is quite common to have a mixture of read-only users (who cannot make changes to the database or format file) and read/write users (who can). You can enforce this distinction by means of user profiles, as described in The Cardbox Book (page 253 onwards).

This has licensing implications for large installations, because read-only licences are much cheaper than read/write ones. All standard Cardbox licences are read/write, but you can buy read-only licences in blocks of 5 and add them to your server, or even buy an unlimited read-only licence that does not limit the number of read-only users.

Whenever someone opens a database on the Cardbox Server, the program checks to see what kind of licence is needed and allocates that licence to the user. If the database is being opened with a read-only profile, the Cardbox Server will allocate  a read-only licence; otherwise it will allocate a read/write one.

This leads to the question: what is a read-only profile?

(more…)

Posted in Licensing, Security | Comments Off

“Security Engineering” is free!

25 August 2006

Ross Anderson’s book “Security Engineering” is now available for free download. The idea is to make it available to people who can’t afford to buy the book; and for people who can afford the book, to let them read some of the text so that they can see it really is worth buying. (I can testify that it is beautifully printed and bound and definitely worth the money).

This is the best book on security I have come across and one of the best books on any technical subject. I recommend it to many of my friends who have no technical background at all, because it manages to convey the essence of security thinking with such a variety of interesting, well-researched examples. Although it is a serious academic book, it is accessible to people with no specialist background in mathematics or computing. Moreover, it is written in English.

Posted in Security | Comments Off

Tripping up on security

23 July 2006

In the 1980s we had great fun breaking a number of commercial encryption products. In a recent paper I described the ignorance and incompetence of vendors at that time but concluded that since then, with the growth of cryptology as an academic discipline and the emergence of standard encryption algorithms, “cryptology has grown up”.

This paper on the failures of Microsoft’s XBox security shows how wrong I was.

The XBox is essentially a PC with special-purpose hardware added. It is sold at a loss, with the aim of making back the money from the profits made on selling XBox games. Many people would like to have a cheap PC (never mind the games) and so the Linux community, in particular, had a strong interest in finding a way of breaking through Microsoft’s security measures and running programs other than games on the XBox.

The paper is detailed and in parts it is technical, but from a cryptologic point of view it shows that the old-fashioned errors can still be made, especially when changes are made at the last minute without realising the effect they can have on security. (For example, a late change from the RC5 to the RC4 encryption algorithm completely invalidated most of the protection that had been designed into the XBox). Still more, it shows that hurried corrections of security holes usually cause more trouble than they are worth.

(more…)

Posted in Security | Comments Off

Denial-of-service attack: executive summary

12 June 2006

Here is a summary of the attack described in detail in our previous post.

(more…)

Posted in Amazon S3, Security | 3 Comments »

Denial-of-service attack on Amazon S3

11 June 2006

You can see a non-technical summary of this article here.

Amazon S3 is a new service which uses Amazon’s world-wide network of computers to provide fast, secure, and essentially infinite data storage on the Internet, metered and paid for according to usage. It is beautifully implemented and it is the kind of elegant technology that makes you want to need it.

We are working on a new Cardbox feature that will use Amazon S3 and we’ll announce it as soon as it’s ready for people to test. But in the course of development we’ve come across a vulnerability. An attack aimed at this vulnerability makes Amazon S3 (and any data stored on it) completely unusable by the victim. Note: the vulnerability is not inherent to Amazon S3 itself and the attack would work against any similar service.

Interestingly, the attack only works if you are using security software to protect yourself from computer worms and viruses: it is your computer’s own immune response that does the damage.

(more…)

Posted in Amazon S3, Security | 4 Comments »

Follow

Get every new post delivered to your Inbox.