Other articles

  1. UEFI SecureBoot on Debian

    This post explains how to enable UEFI SecureBoot on Debian, using your own trust chain. The technical part itself is very light, most of the post is explanations and what and why.

    What is SecureBoot ?

    UEFI SecureBoot is a mechanism to verify a cryptographic signature of UEFI Images before loading them into the Firmware (the new name for the BIOS1). This provides a way to control which images are allowed, and also drivers and option ROM used by the Firmware, and to fight bootkits and malwares based on that. For an example of such dangers, see my past presentations on malicious UEFI Option ROMs ([FR] at SSTIC, and [EN] at PacSec).

    Roughly, SecureBoot will rely on cryptographic signatures (mainly using SHA-256 and RSA-2048) that are embedded into files using the Authenticode file format. The integrity of the executable is verified by checking the hash, and the authenticity and the trust by checking the signature, based on X.509 certificates, which has to be trusted by the platform.


    At a high level, the Firmware has 4 different set of objects (see figures for details):


    • the Platform Key (PK): this is the main key. This keys, usually belonging to …
    read more
  2. Debian SELinux Documentation

    Date Tue 04 October 2011


    When I installed this server, I have decided to enable SELinux, and run it in enforcing mode. And it works !

    Finding relevant documentation for SELinux and Debian was more difficult than expected, and even when it exists, it is often outdated. Also, It does not give real examples, and one problem I encountered very often is a policy module with correct labels, but created for another distribution, and thus not labeling Debian packages correctly. Some other distros (Gentoo and Fedora) have made huge progress on RBAC security, it would be nice to see the same on Debian.

    I have started a guide for SELinux on Debian. The goals are to:

    • give a practical approach on using SELinux on Debian,
    • fight some false ideas (like not being usable on a Desktop, or that you have to enable it globally etc.),
    • describe how to mix confined and unconfined services,
    • give some examples (Cyrus IMAP, git, redmine, PostgreSQL, etc) see the examples page
    • explain how to use it with PaX/Grsec
    • give some example on using the
    • give some generic hardening tips.

    Please notes that the examples and solutions given in the guide are only my own explanations and solutions, and that of …

    read more
  3. Project page for SIEM-live


    I’ve created a project in redmine for SIEM-live, so there is now a wiki, a tracker, and a repository. I’ll add some documentation and instructions on how to build the CD soon.

    Contributors would be gladly accepted :)

    I’ve also updated the Git repository for recent versions of live-build, where all variables have been renamed without keeping compatibility :/

    The bug where booting with no network (no DHCP, for ex.) made many command fail with a weird error message has been fixed:

    could not resolve address family for hostname not supported

    For the record, this was caused by .. IPv6 ! Disabling it during the configuration sequence fixes the problem.

    read more
  4. LE pare-feu OpenOffice

    Internet ça a du bon. Enfin, pas toujours .. Et en combinant une jolie boulette avec quelques outils, on peut réaliser des choses dont personne n’aurait pensé au début …

    En bref, et notamment pour faire suite au challenge que certaines personnes m’ont lancé au SSTIC 2010 (très bonne année d’ailleurs), le voila: LE pare-feu OpenOffice ! Mais attention: pas un truc codé à l’arrache, nan, un vrai pare-feu avec un design toussa

    Donc, comment ça marche:

    • on veut filtrer des paquets avec OpenOffice, donc on a besoin d’OpenOffice
    • n’ayant pas eu le temps de planifier le portage d’OpenOffice en mode noyau, j’ai donc fait l’inverse: amener les paquets en espace utilisateur avec nfqueue + python
    • on manipule OO avec python-uno

    Donc, je commence à coder: on crée une feuille calc avec les numéros de ports à filtrer, je récupère la valeur des cellules (et là je peux vous le dire: quand on a l’habitude de LaTeX, OO c’est pas la joie), et on s’en sert pour filtrer les paquets récupérés par nfqueue.

    Premier problème: pour utiliser nfqueue, il faut être root. Et faire tourner OpenOffice en root (donc avec une interface …

    read more
  5. Creating a live cd for open source SIEM Prelude and Suricata

    I have started to work on a Live CD for Open Source tools like Prelude SIEM, and software like Suricata, Snort, OpenVAS to send alerts. The goal is to easily test these tools, register new agents, get some alerts and be able to correlate them etc. I also want to add some visualization tools, so this CD could maybe become a reference for security alert detection and report.


    First, a few points on applications used:

    • Debian Live for building the CD. It’s very easy, it’s based on Debian, and it allows me to re-use some work I’ve done
    • Suricata IDS, which is a very promising project
    • Snort IDS, with the free signatures
    • OpenVAS to be able to generate alerts
    • Prelude SIEM is the key point: suricata, snort, syslog etc. will send alerts to Prelude, which has a database, a correlator, a web interface (Prewikka) etc.
    • Standard useful tools: nmap, scapy, wireshark, p0f, etc.

    This first version is based on Debian Lenny and arch x86. Everything is based on packages (.debs) to make it easier to maintain, upgrade versions or add patches: most of the time, I just have to rebuild packages from squeeze or sid.

    The build …

    read more
  6. implementing the evil maid attack on linux with Luks

    This month, Joanna Rutkowska implemented the “evil maid” attack against TrueCrypt.

    This kind of attack can be done on any OS with disk encryption: when using whole-disk encryption, you have to infect to bootloader. Linux includes dm-crypt/LUKS, which has some nice features (including TKS1 and working encrypted suspend-to-disk). But how does it play with this attack ?

    Sadly, the answer is: pretty bad. LUKS has no protection against this attack, and even requires a /boot partition in clear. Before looking at the possible solutions, we’ll play with the /boot partition to see how simple the attack is.

    Linux boot sequence basics

    The boot sequence (See http://www.ibm.com/developerworks/library/l-linuxboot/index.html) is the following:

    • System startup: the BIOS is loaded, searches for a boot medium, loads the MBR, and yields control to it.
    • Boot loader stage 1: the job of the primary boot loader is to find and load the secondary boot loader (stage 2)
    • Boot loader stage 2: its jobs is to search and load the Linux kernel and initial RAM disk (initrd) images.
    • Linux kernel: it starts by uncompressing itself, then mounts the initrd image. This image contains modules and scripts required to find …
    read more
  7. Playing with OpenDPI

    So, Ipoque has published its deep inspection engine under a free license (LGPLv3): OpenDPI This is always good news when a company decides to release source code to the community, so first of all thanks to Ipoque for this.

    After downloading the source code on OpenDPI google project’s page, I started to look at it.

    Basically, the project looks quite unprepared for release (only a Makefile, no configure script - though no-one can be blamed for not using autotools -), but after looking at the code it seems not so bad:

    • the code is reasonably clean
    • it builds fine on x86 or x86_64 platforms
    • the code is provided with a decent list of identified protocols
    • the demo uses pcap files

    There are a few minor annoyances:

    • the provided lib is a static lib … building a shared library would be better !
    • the build system is pretty awful, rebuilding everything each time, without using deps, no install system etc.
    • no docs (looking at the demo file was sufficient to understand most of the function).
    • no correct website, forums or whatever. I’m sure it will get better in the future
    • pcap only

    This last point was the most annoying to me, so I …

    read more
  8. New Syslog RFCs

    Date Wed 27 May 2009 Tags Logs

    Several new RFCs for syslog have been issued in March:

    So what are the improvements since the previous RFC (3614), especially in RFC5424 1 :

    1. In section 5.1, “Minimum Required Transport Mapping”:

      All implementations of this specification MUST support a TLS-based transport as described in RFC5425.
      Yay ! So they discovered TLS, that’s great. Especially since RFC 5425 supports certificates authentication (section 4.2.1), certificate path validation, fingerprints, etc. 2. Improved timestamps (Section 6.2.3) with supports for milliseconds, time zones, UTC offsets 3. Section 6.3 describes structured data (name-value pairs) 4. Section 7: Structured Data IDs
      This allows using an enterprise ID (registered to the IANA) for the structured data elements

    However, nothing really useful on reliability (resending events, making sure they were delivered, etc.) except the very poor (and useless) section 8.5, which only acknowledges the lack of support :/ Well, Prelude IDS can do that pretty good.

    Also, nothing on taxonomy, though it may be improved with structured data. However, it would require a good definition of events …

    read more

Page 1 / 3 »