Search the Community

Vulnerabilities in the Google App Engine cloud platform make it possible for attackers to break out of a first-level security sandbox and execute malicious code in restricted areas of Google servers, a security researcher said Friday. Adam Gowdiak, CEO of Poland-based Security Explorations, said there are seven separate vulnerabilities in the Google service, most of which he privately reported to Google three weeks ago. So far, he said, the flaws have gone unfixed, and he has yet to receive confirmation from Google officials. To exploit the flaws, attackers could use the freely available cloud platform to run a malicious Java application. That malicious Java app would then break out of the first sandboxing layer and execute code in the highly restricted native environment. Malicious hackers could use the restricted environment as a beachhead to attack lower-level assets and to retrieve sensitive information from Google servers and from the Java runtime environment. Technical details about the bugs, noted as issues 35 through 41, are available here, here, here, and here. In an e-mail to Ars, Gowdiak wrote: Gowdiak took to the Full Disclosure e-mail list to disclose the bugs and to call Google out for not responding to his private advisory, which he said included proof-of-concept exploit code. "It's been 3 weeks and we haven't heard any official confirmation / denial from Google with respect to Issues 37-41," Gowdiak wrote. "It should not take more than 1-2 business days for a major software vendor to run the received POC, read our report and / or consult the source code. This especially concerns the vendor that claims its 'Security Team has hundreds of security engineers from all over the world' and that expects other vendors to react promptly to the reports of its own security people." Google has received criticism in the past when its Project Zero has disclosed vulnerabilities in Windows and Mac OS X before Microsoft and Apple had patched them. Asked for comment on Gowdiak's Full Disclosure post, a Google spokesman issued the following statement: "A researcher recently reported a known issue affecting a preliminary layer of security in Google App Engine. We’re working with him to mitigate it; users don’t need to take any action." Source

1. Introduction The idea of Virtual Private Network (VPN) is to simulate a private network over a public network. A VPN tunnel can be used to securely connect LANs of the company over an insecure Internet (VPN gateways are responsible for making the connection secure). This article describes how tunneling and cryptography can be used to build VPN tunnels without going into the details of existing VPN protocols. 2. TCP/IP model and encapsulation One needs to understand these topics first before tunneling is discussed. There are four layers in the TCP/IP model: Layer 4: Application layer Layer 3: Transport layer Layer 2: Internet layer Layer 1: Network access layer From the point of view of the sender, the data goes through layers 4 ? 1 (1 ? 4 from the perspective of the receiver). L4PDU (Layer 4 Protocol Data Unit) is sent from the application layer to the transport layer. A TCP header is appended to L4PDU and L3PDU (Layer 3 Protocol Data Unit) is created. L3PDU is called segment. Then L3PDU is sent from the transport layer to the Internet layer. IP header is appended to L3PDU and L2PDU (Layer 2 Protocol Data Unit) is created. L2PDU is called datagram. This simplified description shows that L3PDU (segment) becomes a part of the L2PDU (datagram). In fact, the segment is included in the datagram and this inclusion is called encapsulation. Then the datagram is appended with another header and L1PDU (Layer 1 Protocol Data Unit) is created. L1PDU is called frame. Finally the frame is sent via transmission medium in the form of zeros and ones. From the perspective of the receiver, the exact reverse process occurs (layers 1 ? 4) and is called four step decapsulation. 3. VPN tunnel Normally the data of the application layer is encapsulated into the segment of the transport layer which is further encapsulated into the datagram of the Internet layer. Then the frame of the network access layer encapsulates the datagram and finally the bits are transferred via a physical medium. When VPN tunnel is concerned, one datagram (the internal one) is encapsulated in the another datagram (the external one). This encapsulation is used to carry private addresses through the tunnel. We want to carry private IP addresses through the tunnel, because the goal is to connect local area networks (LANs) at both ends of the tunnel. That’s why the external IP (the one which is not tunneled) is a public address used to connect to the VPN gateway and the internal IP (the one which is tunneled) is a private address. Let’s analyze the real world analogy of tunneling to better understand how it works. The car wants to drive from city C1 to city C2 and these cities are separated by the river. The car is loaded into the ship and transported from C1 to C2. This is exactly how the tunneling works. The internal datagram is tunneled inside another datagram that reaches the VPN gateway. Here the internal datagram is extracted and can be sent to another host. Although the private addresses are not routable in the Internet, they can be traversed using this approach. There is one thing missing. We need to make the tunneling secure, and cryptography is used for this purpose. 4. Using crypto to secure the tunnel The intention of this part of the article is to present briefly how crypto can be applied to make the tunnel secure without going into the cryptographic details. First of all we want the authentication to be achieved. Digital certificates can be used for this purpose. Moreover, the communication should be confidential so that unauthorized users can’t see it. The confidentiality can be achieved by symmetric encryption. Before the symmetric encryption happens, the symmetric key needs to be securely distributed. Asymmetric encryption is used for the purpose of key distribution. Let’s assume that A is communicating with B. The symmetric key is generated by A, encrypted with the public key of B and sent to B. Only B can decrypt it, because B is the only one that has the corresponding private key. In addition to this, we want to be sure that the communication has not been modified. HMAC is used for this purpose (hash of the message sent and the symmetric key). The symmetric key can be regenerated periodically. Then it is called a session key (randomly generated and valid only for one session). If an attacker learns the session key, then he can only decipher the messages sent after the last regeneration of the key and before the next regeneration. This is the way Forward Secrecy is achieved. As far as symmetric encryption is considered, some encryption mode is needed to change the ciphertext in a random way in order not to weaken the encryption key. The solution is a cipher block chaining (CBC) mode of encryption. 5. Summary Remote work via VPN is a standard nowadays. VPN simulates a private network (secure) over the public one (insecure). TCP/IP model and encapsulation were presented first. Then it was described how tunneling works. Finally, we’ve seen how cryptography can be used to make the VPN tunnel secure. Source

1. Introduction The process of IP fragmentation occurs when the data of the network layer is too large to be transmitted over the data link layer in one piece. Then the data of the network layer is split into several pieces (fragments), and this process is called IP fragmentation. The intention of this article is to present how IP fragmentation could be used by the attacker to bypass packet filters (IP fragmentation overlapping attack). Finally, it is shown how this attack can be prevented by stateful inspection. 2. Understanding IP fragmentation Two layers of the OSI model are specially interesting when IP fragmentation is discussed – layer 3 (network) and layer 2 (data link). Data of the network layer is called a datagram and data of the data link layer is called a frame. From the data flow perspective – the datagram becomes included in the frame (encapsulation) and is sent to the receiver via the physical medium in the form of ones and zeros (physical layer – layer 1 of the OSI model). It may occur that the data of the network layer might be too large to be sent over the data link layer in one piece. Then it needs to be fragmented. How much data can be sent in one frame? It is defined by the MTU (Maximum Transmission Unit) – for example MTU is 1500 bytes for the Ethernet, which is commonly used at the data link layer. Let’s describe now how IP fragmentation actually works. We need some indication that the fragments belong to the specified datagram (please keep in mind that these fragments need to be reassembled later by the receiver). For this purpose the identification number is used – the same value is used for all fragments that are created as a result of the datagram’s fragmentation. These fragments need to be reassembled to the original datagram, but how should they be reassembled (order of fragments)? Offset is used for this purpose. How does the receiver know the number of fragments? Here the flag MF (More Fragments) is used. When MF flag is set, the system knows that the next fragment is expected. The last fragment is the one without MF flag. To summarize: the sender chooses the size of datagram that is not greater than the MTU of attached network medium and then the process of IP fragmentation is delegated to the routers, which connect different network media with different MTUs. There is also another approach to IP fragmentation – Path MTU Discovery. The idea is that the sender sends a probe datagram with DF (Don’t Fragment) flag set. If the router gets this probe datagram and sees that it is larger than the MTU of the attached network medium, then the problem occurs – the router has to fragment it, but the probe datagram is said not to be fragmented. Then the message about this problem is sent to the sender who interprets the answer and knows that the datagram needs to be smaller to avoid fragmentation on the way to the receiver. The sender wants to find out how large the datagram can be to avoid fragmentation by the routers. That’s why this process is called Path MTU Discovery and fragmentation in this approach is delegated to the sender. The problem with this approach is that the probe datagram might have been sent via different route than the next datagrams. As a consequence, it may turn out that the smallest MTU discovered by the sender is actually not the smallest one for the next datagrams, and the fragmentation done by routers will still be needed. What happens when the fragment is lost? The retransmission occurs when TCP is used at the layer 4 of the OSI model (transport layer). 3. IP Fragmentation Overlapping Let’s assume that the packet filter allows only the connections to port 80, but the attacker wants to connect to port 23. Although the packet filter is configured to block the connections to port 23, the attacker might try to use IP fragmentation overlapping to bypass the packet filter and finally connect to this port. This attack works as follows. The packet filter might be implemented in the way that the first fragment is checked according to the implemented rules – when the connection to port 80 is seen, the packet filter accepts this fragment and forwards it to the receiver. Moreover, the packet filter may assume that the next fragments just include the data, and this is not interesting from its point of view. As a consequence, the packet filter forwards the next fragments to the receiver. Recall at this point that the reassembling occurs when the fragments arrive to the receiver. The next fragment (as it has been said – forwarded by the packer filter) might have been specially prepared by the attacker – the carefully chosen offset has been used to overwrite the value of the destination port from the first fragment. The receiver waits for all fragments, reassembles them, and finally the connection to port of the attacker’s choice is established. The assumption here is that the packet filter looks at the first fragment that has all the necessary information to make a decision about forwarding or denying the fragment – the other fragments are assumed not to have interesting data (from packet filter’s point of view) and are just forwarded. How could we solve this problem? If the packet filter reassembled the fragments before making a decision (forward or deny), then the attacker would be stopped. As we can see this approach is about understanding the state or context of the traffic and is called stateful inspection (in contrast to the previously described packet filter that is stateless). 4. Summary IP fragmentation occurs when the data of the network layer is too large to be sent over the data link layer in one piece. It was presented how IP fragmentation can be used to bypass packet filter (IP fragmentation overlapping attack) and how stateful inspection can prevent this attack. Source

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide. Changes: Build fixes for the Windows and OpenVMS platforms. Download

Slicy totally reinvents Photoshop slicing. To export PSD elements as assets for your website or app, rename your layer groups once and let Slicy do everything else. Designers and developers, rejoice! Slicy exports layer groups independently, giving you total freedom to move, overlap or even hide design elements. Tagging for export is easy while organizing your PSDs, and quickly saves you tons of time. You'll soon experience how natural this revolutionary new way of exporting is. Precision exporting, including transparency Wonderful for App, Web and icon design No grids or templates, just use your mockup AutoSize or explicitly define areas to export AutoRepeat when you save in PS (optional) For you, or a team — no plug-ins required Fantastic advanced canvas/group slicing 99% real-world PSD support, including CS6 Free Download Source