Date: Fri, 11 Aug 2006 10:33:20 -0500 From: Paul Schmehl <pauls@utdallas.edu> To: "Marc G. Fournier" <scrappy@freebsd.org> Cc: Nikolas Britton <nikolas.britton@gmail.com>, freebsd-questions@freebsd.org Subject: Re: BSDstats Project v2.0 ... Message-ID: <44DCA340.2050204@utdallas.edu> In-Reply-To: <20060811100914.U7522@ganymede.hub.org> References: <20060807003815.C7522@ganymede.hub.org> <20060808201359.S7522@ganymede.hub.org> <44D91F02.90107@mawer.org> <20060808212719.L7522@ganymede.hub.org> <20060809072313.GA19441@sysadm.stc> <20060809055245.J7522@ganymede.hub.org> <44D9F9C4.4050406@utdallas.edu> <20060809130354.U7522@ganymede.hub.org> <ef10de9a0608091700x6cc268ear6566c26f93f1fdf0@mail.gmail.com> <ef10de9a0608100327r5b402d64xc4eef38a4f61ba4e@mail.gmail.com> <ef10de9a0608110342q62f81fc8p5fb4b4df37595593@mail.gmail.com> <20060811100914.U7522@ganymede.hub.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Marc G. Fournier wrote: > On Fri, 11 Aug 2006, Nikolas Britton wrote: > >> Ok... With my new script it took only 158 minutes to compute ALL >> TCP/IP address hashes. I'll repeat that... I have an md5 hash for >> every IP address in the world! All I need to do is grep your hash and >> it will tell me your IP address. yippee! :-) > > Can someone please explain to me what exactly you are trying to secure > against in this case? > If you know my IP, my hostname, what OS I'm running and *every* driver I have enabled on my box, you're half way toward breaking in to my box. What he's saying is that you've chosen the IP address as the index key for the database. Even though you're hashing it with MD5, he has written a script that generates, in less than an hour, the MD5 hash for every single IP address in the world. *If* he can break in to your database and extract its information, he can simply match his hashes against yours and "decode" every IP address. Once he's done that, he has a big fat list of juicy targets to go after. This is the reason that the only hosts I've submitted on the two that are on public IP addresses. You can get the same info by probing them directly. You won't be getting my other boxes until this problem is solved. I think two suggestions have been made that are quite worthy of consideration. 1) encrypt the data being fed to your systems by the script - this should be relatively easy using keys and would ensure that a man in the middle attack would fail. You can connect using ssh and a unique key without having to reveal passwords to anyone. 2) use a unique hash, generated at the time of first conneciton, that identifies the box regardless of its IP, hostname, MAC address or any of the other myriad parameters that can all change over time. This would actually make your data more reliable, since parameters change (IPs, MACs, hostnames, peripherals, etc.), boxes do not. I realize everyone is very enthusiastic about this project, but, if you want a high adoption rate, you're going to have to consider the concerns of the more security conscious among us. -- Paul Schmehl (pauls@utdallas.edu) Adjunct Information Security Officer The University of Texas at Dallas http://www.utdallas.edu/ir/security/ [-- Attachment #2 --] 0 *H 01 0 + 0 *H N00AA = e0 *H 01 0 UUS10U VeriSign, Inc.1<0:U 3Class 2 Public Primary Certification Authority - G21:08U 1(c) 1998 VeriSign, Inc. - For authorized use only1 0 U VeriSign Trust Network0 990331000000Z 090330235959Z01'0%U The University of Texas System1 0 U VeriSign Trust Network1;09U 2Terms of use at https://www.verisign.com/rpa (c)991200U )Class 2 CA - OnSite Individual Subscriber1-0+U$The University of Texas at Dallas CA00 *H 0 "zھ6p`0`S/5ɨ)=d}чTxxLIA ҥ~BQNths]1)%c#Dj9FXúKzI#C2 00)U "0 0 10UPrivateLabel1-1400 `HB0DU =0;09 `HE0*0(+ https://www.verisign.com/RPA0U 0 0 U 0 *H S ܲ P8yISo̲z|_a^_Zҕ"TTTTi!79]H9Y$ C܃tj 11#%,QYҴT 0s0ܠ 08'ƚE0 *H 01'0%U The University of Texas System1 0 U VeriSign Trust Network1;09U 2Terms of use at https://www.verisign.com/rpa (c)991200U )Class 2 CA - OnSite Individual Subscriber1-0+U$The University of Texas at Dallas CA0 060721000000Z 070721235959Z01'0%U The University of Texas System1-0+U $The University of Texas at Dallas CA1F0DU =www.verisign.com/repository/CPS Incorp. by Ref.,LIAB.LTD(c)9910U Mail Stop - UTD10U Paul Schmehl1!0 *H pauls@utdallas.edu00 *H 0 PL;帽NC4jDQB Tn"ΕQ#>D2+ٳE:z8""pXX $3\ Z%n;vwfcŀbF 00 U 0 0 U 0pauls@utdallas.edu0$U 00 `HE00++ https://www.verisign.com/rpa-kr0+0NOTICE: Private key may be recovered by VeriSign's customer who may be able to decrypt messages you send to certificate holder. Use is subject to terms at https://www.verisign.com/rpa-kr (c)99.0 `HB0uU n0l0jhfdhttp://onsitecrl.verisign.com/TheUniversityofTexasSystemTheUniversityofTexasatDallasCA/LatestCRL.crl0 U 0 U %0++0 *H 5 kuCO\GEzB?^2&?JF⠉ЪuPP̲+%&mTh}Q+bWqXXJȨV6U!00`G @±- _=c0 *H 01'0%U The University of Texas System1 0 U VeriSign Trust Network1;09U 2Terms of use at https://www.verisign.com/rpa (c)991200U )Class 2 CA - OnSite Individual Subscriber1-0+U$The University of Texas at Dallas CA0 060721000000Z 070721235959Z01'0%U The University of Texas System1-0+U $The University of Texas at Dallas CA1F0DU =www.verisign.com/repository/CPS Incorp. by Ref.,LIAB.LTD(c)9910U Mail Stop - UTD10U Paul Schmehl1!0 *H pauls@utdallas.edu0"0 *H 0 lSvNê7a_^ e7@m#eqb fjl2 O'R,ǹg<ҚS҃0}F,hz lNrFxlPe9TS$ 1Ǥ=:.niJܮmd)1t'fm8Z?P \/(=&h<|QqB&Pv)cfO>96S)tU_p\Z? I] KezcƷ! 00 U 0 0 U 0pauls@utdallas.edu0$U 00 `HE00++ https://www.verisign.com/rpa-kr0+0NOTICE: Private key may be recovered by VeriSign's customer who may be able to decrypt messages you send to certificate holder. Use is subject to terms at https://www.verisign.com/rpa-kr (c)99.0 `HB0uU n0l0jhfdhttp://onsitecrl.verisign.com/TheUniversityofTexasSystemTheUniversityofTexasatDallasCA/LatestCRL.crl0 U 0 U %0++0 *H =Pjcr:%s#N ܒEȴRB)'W Tѹv>!ɑog<\/ fbh!`ؓ?/)#D3?J}36'3uzbnK u9 | MG 10001'0%U The University of Texas System1 0 U VeriSign Trust Network1;09U 2Terms of use at https://www.verisign.com/rpa (c)991200U )Class 2 CA - OnSite Individual Subscriber1-0+U$The University of Texas at Dallas CAG @±- _=c0 + 0 *H 1 *H 0 *H 1 060811153320Z0# *H 1ުgM)Q0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 +71001'0%U The University of Texas System1 0 U VeriSign Trust Network1;09U 2Terms of use at https://www.verisign.com/rpa (c)991200U )Class 2 CA - OnSite Individual Subscriber1-0+U$The University of Texas at Dallas CA 08'ƚE0 *H 101'0%U The University of Texas System1 0 U VeriSign Trust Network1;09U 2Terms of use at https://www.verisign.com/rpa (c)991200U )Class 2 CA - OnSite Individual Subscriber1-0+U$The University of Texas at Dallas CA 08'ƚE0 *H D 7إzCyRs WV<8T%K@V]^n 1%F$k# hDm|%&z{BSiXӚpr#mL.v%)s?0!O }gG?1m.ȴ?C5|N^+ (k'D"ț v6J94 MS|-D^ A XJѩ#iN 1^c}dö S{w6ur+r=9<b=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44DCA340.2050204>