Internet: Threat Level Red

Yesterday a Bessemer company rescued 42% of the internet...

As you probably read about in news coverage of the recent Black Hat conference, Dan Kaminsky brilliantly discovered a catstrophic vulnerability in the internet's Domain Name System (DNS). The vulnerability permits a hacker to "poison the cache" of DNS servers with incorrect IP addresses -- a phisher's dream come true. Even better for hackers, the vulnerability allows them to intercept email traffic so that they can collect our passwords simply by asking the bank's login screen to email forgotten passwords. They can fool Certificate Authorities into issuing them valid SSL certificates so they can spoof your bank with compelling authority. And lots of other nasties, too.

The Domain Name System is a distributed network of directories residing in programs like BIND and Nominum that respond to queries from network clients (browsers, email, VOIP...). By far the most common query is "What is the IP address of the domain name AAA.BBB ?" Thanks to DNS you can remember names (amazon.com) instead of an address (66.98.140.0). If your DNS server doesn't have the answer, it asks another DNS server, and then remembers the answer in its cache for some specified period of time before that record expires.

The "Kaminsky Attack" starts with a request for a DNS lookup and follows up with a message to your ISP's DNS server posing to be from an authoritative server. The fake message poisons the server's cache with an incorrect IP address, such as that of the hacker's fake Citibank web site. While cache posioning had been theorized before, it had always been an impractical attack, since the hacker never knew exactly when the DNS server would need to refresh an expired record. Kaminsky observed, however, that if a client asks a DNS server for the address of foobar.citibank.com (a non-existent sub-domain of citibank that the DNS server doesn't have in its cache), the server will ask its authoritative server for the address, and get tricked into using that fake IP address for all variants of citibank.com. To spoof the authoritative server, the hacker's fake DNS message has to have the right transmission ID, but there are only 65,536 possibilities. Each time the hacker tries, she can probably send 200 different guesses before the real server can respond for real, so if you attack once every four seconds as Kaminsky tried doing, it takes an average of ten minutes to steal a domain.

Prior to announcing at Black Hat, Kaminsky worked responsibly, diligently and quietly with several vendors to prepare for the announcement. I'm familiar with the effort because one of my portfolio companies, Nominum, is among the teams who prepared for the announcement. Nominum's chief scientist Paul Mockapetris had in fact invented the Domain Name System, and the NY Times has recently reported that his company's industrial strength DNS software now serves 120 million broadband internet subscribers through nearly 100 ISPs. In his presentation to Black Hat, Kaminsky graciously called out Nominum for moving quickly to protect 42% of all broadband internet subscribers from exposure to the Kaminsky Attack.
The other 58% of the internet is not so fortunate. The vast majority of those DNS servers run the antiquated freeware called BIND. The International Software Consortium moved fast to patch BIND, but the patch is not very effective, mostly undeployed, and reportedly unstable. (On July 28 BIND's lead architect Paul Vixie issued an email bulletin warning of performance issues with the patch.)

The BIND security patch randomizes the port used to ask other servers for help, so the attacker has to guess the port as well as the transmission ID. But hackers do have, you know, computers that can make lots of fast guesses. So the patch simply extends the attack from minutes to hours - still pretty easy for the bad guys. Sure enough, John Markoff reported in the NY Times last week ("Leaks in Patch for Web Security Hole") that Russian physicist Evgeniy Polyakov broke the patched security in 10 hours. (You can run Polyakov's exploit yourself.)

In addition, most DNS servers live behind routers, firewalls and load balancers that run Network Address Translation, which converts the randomized into an orderly sequence. You don't have to be a Russian physicist to break that scheme.

Unfortunately, there's about an even chance that you're reading this from an ISP running BIND. Patched or not, you're exposed to pharming, and many carriers and enterprises lack the awareness or motivation to act. Indeed, I heard one CIO of a major brand name financial institution declare immunity from Kaminsky attacks because he has "three layers of firewalls," as if his firewalls block the DNS ports.

The good news is that yesterday Nominum announced a new release of their DNS server that layers on several new defenses on top of port randomization. For example, Nominum's server treats the flood of wrong guesses as an attack, so instead of waiting for a the right transmission ID and accepting the spoofer's poisonous payload, Nominum logs the IP address of the sender.

Here's how Dan Kaminsky reportedly responded to Nominum's announcement:

"Layered defenses in the DNS system are an effective way to address serious attack scenarios that aren't covered by UDP Source Port Randomization alone. As new DNS vulnerabilities are discovered, a layered approach such as Nominum's will help in ensuring ongoing Internet security."

Blogged with the Flock Browser

Wet Shaving: Sinfully Joyful

27 כז לֹא תַקִּפוּ, פְּאַת רֹאשְׁכֶם; וְלֹא תַשְׁחִית, אֵת פְּאַת זְקָנֶךָ

Ye shall not round the corners of your heads,
neither shalt thou mar the corners of thy beard.

-- Leviticus

Thus was I commanded as a boy never to touch a razor to my face, lest I provoke The Lord's wrath for so offending His creation. (Reportedly, He's okey-dokey with electric razors.) So please forgive the ignorance of my 2006 blog post "Read This Only If You Shave" hailing the Schick Quattro razor, confidently published as though I knew even the first thing about shaving.

Fortunately, the blogosphere worked, as helpful comments on my post humbled me with links and advice. One reader in particular, Jay Batson, set me on a new, resolute mission that I've traveled every day (except weekends and holidays) to recapture the facial smoothness of my infancy.

I remember Jay Batson from my days as a director of ON Technology (acquired by Symantec), where Jay ran engineering sometime around 1996 when we went public. (ON, at the time, was the leading seller of Novell Netware based apps, which turned out to be unfortunate...) I hadn't kept in touch with Jay, but i'm grateful that he somehow stumbled upon my blog and introduced me to the art of wet shaving:

Jay Batson said...

IMHO, the razor is a second-order factor. You'll see an order of magnitude difference if you focus on the prep instead.

Go buy yourself a silver-tip badger hair shaving brush. Buy the most expensive bristles you can find, in a handle that matches your taste. Then, be *sure* to buy a glycerin-based shaving soap. Pop for a nice nickel soap dish, too, David -- you can afford it. Go here: Emsplace isn't the most sophisticated ecommerce site on the net, but ignore the amateur look of the site; they have the goods, and they're great help if you need to call them.

Then, before you shave, run the hottest water you can get into the cup (warming the soap), and wet the brush with it, too. Lightly shake the water out of the brush (leaving just a touch in), dump out the water, and lather up the brush.

Then lather your face. Two things:
1) You'll fall in love with the way the brush feels. It's almost as good as sex. And you can do it before you go to work and not be late for work.
2) You won't get a 1/2" thick lather like you do with shaving foam/gel. Don't sweat it; just make sure you've rubbed the brush bristles into your facial bristles for 15-30 seconds.

Then shave. Pick your razor -- it almost doesn't matter. The shave will be the most comfortable, luxurious shave you've ever had, and your shave will be as close and smooth as anything you've tried - ever.

I'm not kidding.

He's not kidding. I tried out Jay's advice and it was all goodness. I bought a beautiful silver-tipped badger hair brush, a stand, a nickel bowl, and glycerin soap. I get a much closer shave now, and the rate of bloody injury has dropped from once a month to once a year. It feels great (not quite "as good as sex" -- maybe I'm still doing one of them wrong). And once you get the hang of whipping up a lather, it doesn't take any longer than shaving with canned foam.

It now seems laughable to pump foamy cream from a can. The manufacturers tout the thickness of their shaving cream, and thick foam is great if it comes from brushing up a lather, but most of the canned foam never even touches your skin.

Compared to canned foam, the cost of wet shaving is "a wash". There is a capital expenditure for the brush, but the glycerin soap consumables last longer than canned foam. Em's is indeed the place to stock up.

Selecting the Right Razor

Although Jay dismissed the importance of selecting the right razor, straight blades have a very big following, so I recently tried switching from my vibrating 5-blade Gillette Fusion to Merkur's highly acclaimed, platinum-coated, double-edged safety razor (image right). To properly assess the new equipment, I conducted a study comparing straight blades to the mass market
disposables.

This iPhone shot (right) portrays the beard I shaved off as part of this investigation--one side with a fresh stainless steel Merkur blade and the other with Gilette's state of the art Fusion. I also collected data on other days with a cleaner face, switching the left and right sides. (Unfortunately I couldn't conduct a double blind study without risking serious blood loss.)

The costs are comparable. The Merkur razor handle is more expensive but the blades are cheaper. Neither razor nicked my skin more frequently or worse than the other. How close a shave did I get? The two razors performed equally well, but the Gillette "shaved off" a few seconds of work each time, perhaps because one needn't be so cautious with it around the corners. In addition, the Merkur blade takes at least an extra minute during the tri-weekly process of installing a new blade. So at the end of the day I'm back to the Fusion. Jay was right again.

Recommended Accessories

As Jay had pointed out, the warmer the water the better. I went so far as to equip my bathrooms with a $14 Proctor and Silex fast-acting water heater for hotter, faster and more energy efficient water.

LEGAL DISCLAIMER: Never apply boiling water to your skin. Submerge the brush, shake it out, swirl it along the soap surface, and test the temperature gently before rubbing it on your cheek. Better yet, forget the water heater and never put anything but ice water on your litigious face.

I also recommend a travel size shaving brush with cover. Soap bowls can get messy so I travel with a TSA-compliant 2 ounce cream pump (lots of choices here) that works only with brushes.

Other ideas that have been suggested to me over the years include:

• Nick-relief styptic powder, available for $3 (hat tip to Rob Chandra). Sure beats the toilet paper method.

• My Philips Norelco Ear/Nose Hair trimmer was a gift from Brad. He also gave me a Philips Norelco BodyGroomer. I'm not sure why. The instructions specifically warn against facial use, but when I had my beard I used the thingy as a trimmer with great results.

• The lip wipe. Woody Allen taught me this move in one of his early films (Bananas, I think). Once your face is lathered up with soap, wet a finger and outline your lips with it to prevent accidental ingestion.

Once you get the hang of wet shaving, both you and your wife will enjoy the change. Just don't tell your rabbi.

Blogged with the Flock Browser

My Internet Law

The time and money required to produce (design, develop, secure, test, launch, scale) a typical data-oriented form application on the web drops in half every 2 years.

This seems to have held true since the public emergence of the web in 1994. Do you agree? I don't have much hard data, but McCain proposes new internet laws with far less.

For example, I recall the large systems integration firms charging as much as $20 mlllion to completely outsource development of a web application. (I forget the name but I recall a DFJ-backed pay-me-to-advertise-to-me startup that spent as much in 1996 with someone like Perot Systems and the app still never worked.) Is there any doubt that most apps today can be launched with as much scalability for $300,000? The implied factor of improved efficiency is 0.5 to the sixth power over a 12 year period.

Cheaper hardware (Moore's Law) accounts for only a small fraction of this effect. The real gains seem to come from decoupling and automating specific steps of the process. Major disruptions that come to mind: Microsoft FrontPage, SSL, Exodus hosting, Apache, Java, ActiveX, Javascript, Shockwave, Flash, load balancers, PHP,  XML, Ruby on Rails, web service APIs, AJAX, Amazon S3, DIY communities (Ning).

Blogged with the Flock Browser

So Proud of My Sister Jill

and her husband David...

Needham Times
CANCER FAILS TO 'CLICK OUT' LOCAL PMC TEAM
by Will Bradford

    Jillian Segal won't be riding in the Pan-Mass Challenge for the first time in four years.
    Segal, 44, beat ovarian cancer in 1982 as an 18-year-old. After keeping the disease at bay for more than 20 years, she was diagnosed again in 2003. When Segal received treatment at the Dana Farber Cancer institute and the cancer went into remission, she decided she would take part in the Pan-Mass Challenge, the fundraising bike-a-thon that has raised more than $200 million for cancer research since 1980.
    "I've had cancer for a long time, and I've had people I know riding," she said about her initial decision to participate. "Everyone would ask if they could list me as someone they were riding for, so when I finished my chemo in 2004, I told my husband I was going to do it for myself."
    Segal's husband David, 45, also committed to ride and Team "Click Out. CLICK OUT!" was born. Consisting of, among others, the Segals, David's brother , sister and father, and one of Jillian's best friends, the team gets its name from what they yell to one another when braking, reminding each other to detach their shoes from the bike pedals.
    "The first time we rode, everyone was kind of teary every time we thought about it," said Jillian Segal. "I think out of the 5,000 riders there are 150 survivors who ride, so it's always kind of special because at the beginning of the race, they say if you're a survivor, raise your hand, and everyone gets choked up."



    As riders in this year's PMC made their way down Charles River Street in Needham Saturday, however, Jillian Segal was a spectator for the first time in four years. This past spring, her cancer came back, forcing her to withdraw from this year's event. So the team had no choice but to ride on without Jillian, although it was admittedly not the same.
    "I was worried about that," said David Segal. "All the other years she has been my pace car. I have the tendency to go out too quickly. But we didn't do that. I think we were all in tun, making sure went out at a good pace. We had her in our thoughts the whole way."
    According to Jillian Segal, the team has raised around $100,000 for finding a cure for ovarian cancer in four years.
    "Breakthroughs are being made every day," she said. "As my doctor says, it's not weeks away, but it's not generations away either."
    The Segals currently see no end for their careers as PMC cyclists. Since the doctors found the newest cancer in an early stage, Jillian has already turned her focus on next year's PMC.
    "It's disappointing," she said of not being able to ride this year. "But I've got next year to look forward to. it's a good goal for me."


--
The Pan-Mass Challenge funnels 100% of the funds raised to cancer research. Contributions can be made here in support of team "Click Out. CLICK OUT!"

Blogged with the Flock Browser

Taking Down Airborne

More bad news for Airborne in the form of federal penalties. And all this started because of the blog post I wrote.  (Seriously, Scientific American reported and validated my blog post, constituting authoritative scientific evidence that sparked and won the consumer class action lawsuit for deceptive advertising.)

Plus, yesterday I bowled a 231. Hoo-wah!

Blogged with the Flock Browser