Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5758

Re: debcheckroot v2.0 released

Show all headers | View raw

Hi folks

   You can now download the indicated program at 
https://www.elstel.org/atea/ and read some documentation at 
https://www.elstel.org/DANE/.

Kind Regards,
Elmar

Am 17.01.20 um 16:52 schrieb Elmar Stellnberger:
> Hi Cindy Sue! Hi folks!
> 
>    I must confess there is little you can do about missing emails with 
> debcheckroot. You can spot rootkits with hindsight but intelligence can 
> also break in and go without leaving any trace. What would to my mind be 
> necessary for a more secure email communication is a better penetration 
> of DANE. Many CAs are known to issue rogue certificates to secret 
> services so the public key is the only thing that may be trustworthy of 
> a certificate. If that public key is signed and bound to a domain with 
> DNSSEC (this is then called DANE) it shall be safe. I would guess that 
> email dispatching was safe if encrypted and saved by DANE all the way to 
> its target. F.i. it seems likely that intelligence just tries to halt 
> email delivery if some suspicious email is in the queue until they have 
> assessed what they wanna do about it. And it is questionable how those 
> emails which seem to be sent successfully but which do not reach their 
> target get lost.
> 
>     Something I as an end user can do about the emailing problem is to 
> write and send my emails on a secure machine. If I am using webmail or 
> an emailing program this requires to preconfigure certificates known to 
> be safe and to only allow these. All CAs need to be disabled since the 
> average user will never know which CAs issue rogue certificates. 
> According to my knowledge any simple web page invocation immediately 
> results in a cracked system if it is using a spoofed certificate which 
> can not be excluded for any simple web search. Luckily my hoster 
> provides DANE for the machines used for email delivery, webmailing and 
> my website configuration panel. And I am still using a Debian 8 read 
> only stick to boot such a secure system.
> 
>     Why the hell Debian 8? Isn`t that insecure? I believe it isn`t as 
> long as I only visit these two web pages of my hoster. Unfortunately 
> newer versions of Firefox have a special implementation for so called 
> HSTS (http strict transport security) certificates. You can not add a 
> security exception for such a certificate but you need to configure all 
> dependent certification authorities for such a certificate. However with 
> the first CA you acknowledge you compromise your system`s security. 
> Older versions of Firefox did not have this bug: 
> https://bugzilla.mozilla.org/show_bug.cgi?id=1606802
> 
>    I am currently looking forward to test which versions of Debian 9 
> would work. Firefox from Debian 10 does no more work. If you have good 
> luck your webmailing server supports DANE but does not use HSTS. Then 
> you can use a current Debian. With Debian 8 you simply need to delete 
> libnssckbi.so from libnss3 to disable all default CAs. You can not 
> delete them by hand. If you do you need to mark every singleton CA but 
> that does not prevent all deleted CAs to reappear a second after you 
> have deleted them. That is why you needed to delete the .so. With newer 
> versions of Firefox deleting libnssckbi.so does not stay without side 
> effects: You can then not acknowledge security exceptions by hand any 
> more. I have written a script to do that automatically though and I am 
> likely to publish it at https://www.elstel.org/DANE/ in the future if 
> sufficient interest is given in the issue. Once I know the last good 
> Firefox version I could also approach to resolve the bug from above for 
> newer Firefox versions. Unfortunately Dana Keeler has given this bug a 
> resolved invalid so that it is unsure whether they would accept the 
> bugfix upstreams. According to Dana`s comments the bug should in deed be 
> marked as WONTFIX. That would be correct. If you like vote or comment 
> for/on this bug.
> 
> Elmar
> 
> 
> Am 17.01.20 um 14:29 schrieb Cindy Sue Causey:
>> On 11/27/19, Elmar Stellnberger <estellnb@gmail.com> wrote:
>>> Am 25.11.19 um 12:35 schrieb Patrick Schleizer:
>>>> Yes, forget about NSA and alike. Let's not assume quasi-omnipotent
>>>> attackers. That leads to defeatist mindset which isn't productive.
>>>     I would not let myself be defeated easily. Who has thought about
>>> emails in your inbox which are deleted before you can see them? Easily
>>> doable. They would just need to know your password. Or about outgoing
>>> emails which do not reach their target. As far as I have learnt to know
>>> it you can see them in the sent folder but they never appear on the
>>> other side, not even in the spam-box. The worse thing is however if
>>> someone wants to contact you and you do not even know about it, the
>>> other one just thinking you did not reply.
>>
>> There have been two situations that, no, I can't name just this
>> second, so this is anecdotal material *until I stumble back upon* the
>> very real cases, BUT...
>>
>> Twice in the last maybe six months, there has been chatter about the
>> receiving end's server(s) stopping the flow of incoming emails for
>> unknown reasons. The occurrences were purely "glitches", NOT on
>> purpose. It was either machine failure or accidentally
>> Human-instigated mis-code or something that provoked the situations.
>>
>> End users found out when a sudden flood of sometimes OLD email
>> suddenly hit their email inboxes. The last one was just in last few
>> weeks. If and when I re-encounter that information, I'll post for
>> posterity. :)
>>
>> As for the once formerly viewed and then now missing emails, been
>> there, done there. Things being what they are in my own #Life, I've
>> most definitely... "wondered" how the emails "disappeared" when they
>> are NOT something I would have EVER deleted. It affects very few, less
>> than a handful of correspondences.
>>
>> Sanity is found in realizing I have a VERY LARGE inbox.. and I'm
>> surely just not using the right words for my queries. I've convinced
>> myself that I'm using words that convey the same thoughts as the
>> original messages but are not a search string-friendly match for the
>> specific words that were originally written. :)
>>
>> Cindy :)

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Have I caught a firmware attack in the act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-13 09:40 +0200
  Re: Have I caught a firmware attack in the act? Or am I just paranoid? Paul Wise <pabs@debian.org> - 2019-08-14 07:10 +0200
  Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-14 17:40 +0200
    Re: Have I caught a firmware attack in the act? Or am I just  paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-15 23:20 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Davide Prina <davide.prina@gmail.com> - 2019-08-16 10:40 +0200
        Re: Have I caught a firmware attack in the act? Or am I just  paranoid? CMH <chouck@binghamton.edu> - 2019-08-16 14:20 +0200
        Re: Have I caught a firmware attack in the act? Or am I just paranoid? Andrei Grosu <andrei_grosu@fastmail.net> - 2019-08-16 19:20 +0200
        Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:20 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:10 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:30 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 21:20 +0200
        Re: Have I caught a firmware attack in the act? Or am I just  paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-17 11:50 +0200
          Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-17 13:20 +0200
            Re: Have I caught a firmware attack in the act? Or am I just  paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-23 09:30 +0200
              Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-23 21:00 +0200
                debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-15 17:20 +0100
                Verified Boot, Secure Boot, dm-verity, debcheckroot Patrick Schleizer <adrelanos@riseup.net> - 2019-11-16 14:00 +0100
                Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Elmar Stellnberger <estellnb@gmail.com> - 2019-11-16 15:30 +0100
                Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Sylvain Beucler <beuc@beuc.net> - 2019-11-16 15:40 +0100
                Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Elmar Stellnberger <estellnb@gmail.com> - 2019-11-16 15:40 +0100
                Re: debcheckroot v2.0 released Patrick Schleizer <adrelanos@riseup.net> - 2019-11-19 13:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-20 12:30 +0100
                Re: debcheckroot v2.0 released Patrick Schleizer <adrelanos@riseup.net> - 2019-11-25 12:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-25 18:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-12-10 17:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-27 12:10 +0100
                Re: debcheckroot v2.0 released Cindy Sue Causey <butterflybytes@gmail.com> - 2020-01-17 14:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-01-17 17:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-01-17 17:20 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 20:20 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 20:50 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 21:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 21:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-23 17:10 +0100
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-24 04:40 +0100
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-24 11:20 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-24 15:50 +0100
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-25 03:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-25 11:30 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-26 11:10 +0100
                Re: debcheckroot v2.0 released "vince@vheuser.com" <vince@vheuser.com> - 2020-04-01 20:10 +0200
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-04-02 02:00 +0200
                Re: debcheckroot v2.0 released Lewis Yarema <lewisyarema91@gmail.com> - 2020-04-02 11:20 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 17:00 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-03 13:40 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 16:50 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-04 09:50 +0200
                Re: debcheckroot v2.0 released William Gagnebé <william.gagnebe@gmail.com> - 2020-04-05 12:20 +0200
                Re: debcheckroot v2.0 released l0f4r0@tuta.io - 2020-04-05 12:30 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-07 17:50 +0200
                Re: debcheckroot v2.0 released "Niall O'Reilly" <Niall.oReilly+lists@no8.be> - 2020-04-02 18:30 +0200
                Re: debcheckroot v2.0 released Lee <ler762@gmail.com> - 2020-04-02 21:00 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 21:40 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-03 13:50 +0200
                Re: debcheckroot v2.0 released Lee <ler762@gmail.com> - 2020-04-04 00:50 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-04 09:40 +0200
                Re: debcheckroot v2.0 released Bjørn Mork <bjorn@mork.no> - 2020-04-14 09:30 +0200
                arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-04-25 15:40 +0200
                Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-04-25 15:50 +0200
                Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-05-02 17:00 +0200
                Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-05-02 17:10 +0200
                Fwd: Re: arbitrary code execution on unformatted usb stick estellnb@elstel.org - 2020-05-02 20:50 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-21 17:40 +0100
      Probably a false alarm Re: Have I caught a firmware attack in the  act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-24 18:50 +0200

csiph-web