The RPM package format, as used by RedHat Linux, CentOS and others provides multiple mechanisms for verifying package integrity and authenticity before installation. Mechanisms for integrity and authenticity include:
MD5 and SHA1 hashes of the rpm header (and optionally payload); and
GPG signatures of the package.
As a security company with a focus on utilizing hypervisor technology, the team at Star Lab wanted to research potential hypervisor-based solutions for cloud security. The demand for cloud services has skyrocketed worldwide, with an increasing amount of critical services being migrated to the cloud. Sophisticated adversaries will seek to exploit cloud platforms to access critical / sensitive information, and these new threats demand novel virtualization-based cyber security tools and techniques to keep pace and blunt the adversaries attacks.
Read MoreSuppose you have a very difficult threat model for your embedded system. Not only is your adversary technically skilled, but they are going to have physical access to your device.
Read MoreIn October 2018, the GAO released a report on cyber vulnerabilities in weapons systems. This report highlights the need to consider cyber survivability in the weapons system design process. At Star Lab, we think virtualization is an enabling technology that helps address many of the concerns raised in the GAO report. In this post we will share two virtualization techniques that we often use for securing systems: 1) minimizing a system’s attack surface and 2) isolating components within the system.
Read MoreNobel Prize-winning physicist Neils Bohr famously said “An expert is a man who has made all the mistakes which can be made, in a narrow field.”
A defense contractor providing a ground systems trainer was required by the government to provide anti-reverse engineering and cyber protections for the system.
Despite having never designed and engineered security for such technology, the contractor attempted to develop the solution in-house.
Read MoreTaking the leap when others hesitate is often the key to success.
A major defense contractor was looking to compete in airborne radar processing. It was a segment in which the contractor had not been competitive to date, and it needed an edge.
One of Star Lab’s product partners suggested that the inclusion of secure tactical virtualization could give the contractor the key differentiator it was looking for.
Read MoreThe Crucible Embedded Hypervisor mitigates the recent rash of CPU-based information leakage / unauthorized disclosure vulnerabilities, including those made public in CVE 2018-3620 and CVE 2018-3646. The Xen project further classifies these vulnerabilities under XSA 273. Crucible inherently mitigates these speculative execution (and related Spectre / Meltdown) vulnerabilities as a result of its explicit hardware resource allocation strategy, and overall secure-by-design configuration.
Read MoreA novel side-channel information leakage attack was made public this week which leverages the speculative execution features inherent within most modern processors, including those from Intel, AMD, and ARM. Several instantiations of this attack, known as Meltdown and Spectre, have been detailed by the Google Project Zero team. These vulnerabilities enable an attacker with local execution context to potentially infer (but not modify) the contents of memory across security boundaries which they would otherwise not be able to access. In particular, an attacker with user-level execution capabilities can utilize these attacks to access memory in other processes, the OS kernel, virtual machines, and hypervisor memory. Mitigations to the attacks are currently being implemented within multiple operating systems, including Star Lab’s Crucible product suite.
Read MoreOne of the key operating principles of LURE – The Linux, Unprivileged Root Environment, is to make ‘root’ or privileged access to an IoT or industrial control device, a “don’t care”. This “don’t care” principal enables LURE to provide brickerbot defense and protect devices from malware attacks such as BrickerBot
Read MoreMost systems have a super-user, such as “root” or “administrator” which is permitted to bypass access controls, disable security features, and interact directly with system hardware. Administrator-level access is generally restricted by the operating system kernel, as well as by authentication mechanisms for the root user. As a result, many systems developers are led to believe that they just need to prevent users or attackers from gaining “root” level access on the system in order to be secure. Unfortunately this approach has continued to be proven insufficient in real-world systems, most recently by the Mirai IoT botnet malware and the 9-year old kernel vulnerability (CVE-2016-5195).
Read More
