<?xml version="1.0" encoding="utf-8"?><rss version="0.92">
<channel>
	<title>codeblog</title>
	<link>http://www.outflux.net/blog</link>
	<description>code is freedom -- patching my itch</description>
	<lastBuildDate>Tue, 24 Jan 2012 19:34:14 +0000</lastBuildDate>
	<docs>http://backend.userland.com/rss092</docs>
	<language>en</language>
	<!-- generator="WordPress/3.0.5" -->

	<item>
		<title>fixing vulnerabilities with systemtap</title>
		<description><![CDATA[Recently the upstream Linux kernel released a fix for a serious security vulnerability (CVE-2012-0056) without coordinating with Linux distributions, leaving a window of vulnerability open for end users. Luckily: it is only a serious issue in 2.6.39 and later (e.g. Ubuntu 11.10 Oneiric) it is &#8220;only&#8221; local it requires execute access to a setuid program [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2012/01/22/fixing-vulnerabilities-with-systemtap/</link>
			</item>
	<item>
		<title>abusing the FILE structure</title>
		<description><![CDATA[When attacking a process, one interesting target on the heap is the FILE structure used with &#8220;stream functions&#8221; (fopen(), fread(), fclose(), etc) in glibc. Most of the FILE structure (struct _IO_FILE internally) is pointers to the various memory buffers used for the stream, flags, etc. What&#8217;s interesting is that this isn&#8217;t actually the entire structure. [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/12/22/abusing-the-file-structure/</link>
			</item>
	<item>
		<title>how to throw an EC2 party</title>
		<description><![CDATA[Prepare a location to run juju and install it: mkdir ~/party cd ~/party sudo apt-get install juju Initialize your juju environment. Be sure to add &#8220;juju-origin: ppa&#8221; to your environment, along with filling in your access-key and secret-key from your Amazon AWS account. Note that control-bucket and admin-secret should not be used by any other [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/12/07/how-to-throw-an-ec2-party/</link>
			</item>
	<item>
		<title>juju bug fixing</title>
		<description><![CDATA[My earlier post on juju described a number of weird glitches I ran into. I got invited by hazmat on IRC (freenode #juju) to try to reproduce the problems so we could isolate the trouble. Fix #1: use the version from the PPA. The juju setup documentation doesn&#8217;t mention this, but it seems that adding [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/12/07/juju-bug-fixing/</link>
			</item>
	<item>
		<title>EC2 instances in support of a BSP</title>
		<description><![CDATA[On Sunday, I brought up EC2 instances to support the combined Debian Bug Squashing Party/Ubuntu Local Jam that took place at PuppetLabs in Portland, OR, USA. The intent was to provide each participant with their own sbuild environment on a 64bit machine, since we were going to be working on Multi-Arch support, and having both [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/12/05/ec2-instances-in-support-of-a-bsp/</link>
			</item>
	<item>
		<title>PGP key photo viewing</title>
		<description><![CDATA[Handy command line arguments for gpg: gpg --list-options show-photos --fingerprint 0xdc6dc026 This is nice to examine someone&#8217;s PGP photo. You can also include it in --verify-options, depending on how/when you want to see the photo (for example, when doing key signings). If gpg doesn&#8217;t pick the right photo viewer, you can override it with --photo-viewer [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/12/05/pgp-key-photo-viewing/</link>
			</item>
	<item>
		<title>qrcodes</title>
		<description><![CDATA[Inspired by recent Planet Ubuntu posts, I submit a QR Code for your examination: &#169; 2011, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.]]></description>
		<link>http://www.outflux.net/blog/archives/2011/11/15/qrcodes/</link>
			</item>
	<item>
		<title>5 years with Canonical</title>
		<description><![CDATA[This month, I will have been with Canonical for 5 years. It&#8217;s been fantastic, but I&#8217;ve decided to move on. Next week, I&#8217;m going to start working for Google, helping out with ChromeOS, which I&#8217;m pretty excited about. I&#8217;m sad to be leaving Canonical, but I comfort myself by knowing that I&#8217;m not leaving Ubuntu [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/09/12/5-years-with-canonical/</link>
			</item>
	<item>
		<title>aliens hat-tip</title>
		<description><![CDATA[Picked up a Doctor Who comic today and saw a nice hat-tip to (or composite ship design plagiarism of) Aliens. The Colonial Marines ship &#8220;Sulaco&#8221;, from Aliens, 1986: The Scavengers ship, from the Doctor Who Spam Filtered story, 2011: Such a great ship. Not even remotely made to look aerodynamic. And to make this almost [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/07/11/aliens-hat-tip/</link>
			</item>
	<item>
		<title>non-executable kernel memory progress</title>
		<description><![CDATA[The Linux kernel attempts to protect portions of its memory from unexpected modification (through potential future exploits) by setting areas read-only where the compiler has allowed it (CONFIG_DEBUG_RODATA). This, combined with marking function pointer tables &#8220;const&#8221;, reduces the number of easily writable kernel memory targets for attackers. However, modules (which are almost the bulk of [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/04/27/non-executable-kernel-memory-progress/</link>
			</item>
	<item>
		<title>Linux Security Summit 2011 CFP</title>
		<description><![CDATA[I&#8217;m once again on the program committee for the Linux Security Summit, so I&#8217;d love to see people submit talks, attend, etc. It will be held along with the Linux Plumber&#8217;s Conference, on September 8th in Santa Rosa, CA, USA. I&#8217;d really like to see more non-LSM developers and end-users show up for this event. [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/04/05/linux-security-summit-2011-cfp/</link>
			</item>
	<item>
		<title>ptracing siblings</title>
		<description><![CDATA[In Ubuntu, the use of ptrace is restricted. The default allowed relationship between the debugger and the debuggee is that parents are allowed to ptrace their descendants. This means that running &#8220;gdb /some/program&#8221; and &#8220;strace /some/program&#8221; Just Works. Using gdb&#8216;s &#8220;attach&#8221; and strace&#8216;s &#8220;-p&#8221; options need CAP_SYS_PTRACE, care of sudo. The next most common use-case [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/02/18/ptracing-siblings/</link>
			</item>
	<item>
		<title>shaping the direction of research</title>
		<description><![CDATA[Other people have taken notice of the recent &#8220;auto-run&#8221; attack research against Linux. I was extremely excited to see Jon Larimer publishing this stuff, since it ultimately did not start with the words, &#8220;first we disabled NX, ASLR, and (SELinux&#124;AppArmor) &#8230;&#8221; I was pretty disappointed with last year&#8217;s Blackhat conference because so many of the [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/02/11/shaping-the-direction-of-research/</link>
			</item>
	<item>
		<title>fun with game memory</title>
		<description><![CDATA[So, I was testing a (closed source) single-player offline game recently and thought this exercise might be fun to document. I didn&#8217;t want to spend any time actually earning in-game money since I&#8217;d played it before and I wanted to just skip ahead to other aspects of the game. I was curious how straight-forward adjusting [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2011/02/05/fun-with-game-memory/</link>
			</item>
	<item>
		<title>gcc-4.5 and -D_FORTIFY_SOURCE=2 with &#8220;header&#8221; structures</title>
		<description><![CDATA[Recently gcc (4.5) improved its ability to see the size of various structures. As a result, the FORTIFY protections have suddenly gotten a bit stricter. In the past, you used to be able to do things like this: struct thingy { int magic; char data[4]; } void work(char *input) { char buffer[1000]; int length; struct [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/12/16/gcc-4-5-and-d_fortify_source2-with-header-structures/</link>
			</item>
	<item>
		<title>TARPIT iptables target</title>
		<description><![CDATA[Want to use a network tarpit? It&#8217;s so easy to set up! Thanks to jpds for this whole post. :) sudo module-assistant auto-install xtables-addons-source sudo iptables -p tcp ... -j TARPIT Though no such thing exists for IPv6 yet. Here it is watching over the SSH port: iptables -N INGRESS-SSH iptables -A INPUT -p tcp [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/11/10/tarpit-iptables-target/</link>
			</item>
	<item>
		<title>security is more than bug fixing</title>
		<description><![CDATA[Security is more than bug fixing. Security fixing/updating, the thing most people are exposed to, is &#8220;reactive security&#8221;. However, a large area of security work is &#8220;proactive&#8221; where defensive abilities are put in place to try and catch problems before they happen, or make classes of vulnerabilities unexploitable. This kind of security is what a [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/11/07/security-is-more-than-bug-fixing/</link>
			</item>
	<item>
		<title>Jettison Jaunty</title>
		<description><![CDATA[Jaunty Jackalope (Ubuntu 9.04) went End-Of-Life on Saturday. Looking back through my build logs, it seems my desktop did 223 builds, spending 19 hours, 18 minutes, and 23 seconds doing builds during the development cycle of Jaunty. Once released, it performed an additional 99 builds, taking 18 hours, 3 minutes, and 37 seconds for security [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/10/25/jettison-jaunty/</link>
			</item>
	<item>
		<title>CVE-2010-2963 v4l compat exploit</title>
		<description><![CDATA[If you&#8217;re running a 64bit system, and you&#8217;ve got users with access to a video device (/dev/video*), then be sure you update your kernels for CVE-2010-2963. I&#8217;ve been slowly making my way through auditing the many uses in the Linux kernel of the copy_from_user() function, and ran into this vulnerability. Here&#8217;s the kernel code from [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/10/19/cve-2010-2963-v4l-compat-exploit/</link>
			</item>
	<item>
		<title>mountall umask</title>
		<description><![CDATA[The recent CVE-2010-2961 mountall vulnerability got a nice write-up by xorl today. I&#8217;ve seen a few public exploits for it, but those that I&#8217;ve seen, including the one in xorl&#8217;s post, miss a rather important point: udev events can be triggered by regular users without any hardware fiddling. While the bug that kept udev from [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/10/13/mountall-umask/</link>
			</item>
	<item>
		<title>new RSA4096 key</title>
		<description><![CDATA[As part of the Ubuntu Security Team&#8217;s overall OpenPGP key transition plans, I&#8217;ve generated a new GPG key (DC6DC026). If you&#8217;ve signed my old key (17063E6D), I&#8217;d appreciate it if you could review my signed transition statement and sign my new key too. :) Thanks! &#169; 2010, Kees Cook. This work is licensed under a [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/09/27/new-rsa4096-key/</link>
			</item>
	<item>
		<title>my part in the ecosystem</title>
		<description><![CDATA[I was asked to write about what I do at Canonical and what I do in the Free Software community at large. There is obviously a great deal of overlap, but I&#8217;ll start with the things I&#8217;m involved with when I&#8217;m wearing my &#8220;Ubuntu&#8221; hat. My primary job at Canonical is keeping Ubuntu secure. This [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/09/14/my-part-in-the-ecosystem/</link>
			</item>
	<item>
		<title>cross-distro default security protection review</title>
		<description><![CDATA[The recent work by MWR Labs does a reasonable job showing Debian&#8217;s poor pro-active security and why I am so frustrated about it: we have not been able to move very quickly at getting it enabled. While my hardening-includes package is available to maintainers that want to turn on protections for their builds, it&#8217;s still [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/09/07/cross-distro-default-security-protection-review/</link>
			</item>
	<item>
		<title>CryptProtect broken</title>
		<description><![CDATA[Dan Rosenberg pointed me to a paper from the 2010 WOOT conference that mentions my work to implement the CryptProtect function in Wine. Their research is awesome, and it was fun to compare my attempts at identifying the blob structure to what they discovered. Looks like I got the structure pretty well, but that was [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/08/12/cryptprotect-broken/</link>
			</item>
	<item>
		<title>Achievement Unlocked</title>
		<description><![CDATA[I think it would be fun to add an achievement system to the Ubuntu Desktop, like is done on Steam and XBox. The tricky part is tracking various events and finding amusing correlations. For example, if your screen-saver kicks in 40 times in a single 24 hour period, you could earn the &#8220;Alternating Current&#8221; achievement, [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/07/23/achievement-unlocked/</link>
			</item>
	<item>
		<title>gdb turns off ASLR</title>
		<description><![CDATA[Starting with GDB version 7, first appearing in Ubuntu with Karmic (Ubuntu 9.10), ASLR is turned off (via the ADDR_NO_RANDOMIZE personality flag) for the debugged process. If you want a more realistic view of how a process will appear in memory, you must &#8220;set disable-randomization off&#8221; in gdb: $ gdb /usr/bin/something ... (gdb) show disable-randomization [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/07/03/gdb-turns-off-aslr/</link>
			</item>
	<item>
		<title>reporting all execs</title>
		<description><![CDATA[I recently learned about the process event connector, and went looking for an example program that could report all the exec()s that happen on my system to help with debugging things like AC plug/unplug scripts, etc. After cleaning it up and adding some features to do a simple best-effort cmdline reporting, I&#8217;ve now got a [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/07/01/reporting-all-execs/</link>
			</item>
	<item>
		<title>kvm kernel console</title>
		<description><![CDATA[I know there are a lot of ways to do this, but I just wanted to note what works for me to catch early boot Oopses in the kernel. In virt-manager, I set up a serial device, as a &#8220;pty&#8221;. After the VM boots, I pause in Grub, and check the VM details for the [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/06/21/kvm-kernel-console/</link>
			</item>
	<item>
		<title>Linux Security Summit 2010</title>
		<description><![CDATA[The Call For Participation is open for the 2010 Linux Security Summit, being held just before this year&#8217;s LinuxCon. If you&#8217;re interested in helping make Linux more secure, you&#8217;ve got ideas to present, want to have your opinion heard, or generally just want to hang out, please join us and/or suggest a topic for discussion [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/05/29/linux-security-summit-2010/</link>
			</item>
	<item>
		<title>too lazy to recompile</title>
		<description><![CDATA[I have a camera that takes .MP4 files. MythTV&#8217;s Gallery plugin has a static list of extensions it recognizes. MP4 is not one of them. I can rename all my files (which is wrong &#8212; they&#8217;re MP4s not something else), or I can edit the source and recompile. Or, since I want to watch them [...]]]></description>
		<link>http://www.outflux.net/blog/archives/2010/05/27/too-lazy-to-recompile/</link>
			</item>
</channel>
</rss>

