COMP 3000 2011 Report: LPS - Revision history

Jeckhard: /* References */

2011-12-16T19:43:32Z

References

← Older revision		Revision as of 19:43, 16 December 2011
Line 236:		Line 236:

	"Linux-Kernel Archive: Re: 2.6.7 and khelper." Indiana University. Web. 16 Dec. 2011. <http://lkml.indiana.edu/hypermail/linux/kernel/0406.3/0318.html>.		"Linux-Kernel Archive: Re: 2.6.7 and khelper." Indiana University. Web. 16 Dec. 2011. <http://lkml.indiana.edu/hypermail/linux/kernel/0406.3/0318.html>.


	''NoScript - JavaScript/Java/Flash Blocker for a Safer Firefox Experience! - What Is It?.'' NoScript. Web. 10 Oct. 2011. <http://noscript.net/>.		''NoScript - JavaScript/Java/Flash Blocker for a Safer Firefox Experience! - What Is It?.'' NoScript. Web. 10 Oct. 2011. <http://noscript.net/>.

Jeckhard: /* References */

2011-12-16T19:43:25Z

References

← Older revision		Revision as of 19:43, 16 December 2011
Line 230:		Line 230:

	"GNU Project Archives." ''GNU Project Archives''. Web. 11 Nov. 2011. <http://ftp.gnu.org/gnu/glibc/>.		"GNU Project Archives." ''GNU Project Archives''. Web. 11 Nov. 2011. <http://ftp.gnu.org/gnu/glibc/>.

			"klogd - Linux Command - Unix Command." Linux Operating System and Linux Distributions.Web. 16 Dec. 2011. <http://linux.about.com/library/cmd/blcmdl8_klogd.htm>.

			"ksoftirqd(9)." tin.org - TIN newsreader development headquarters. Web. 16 Dec. 2011. <http://www.tin.org/bin/man.cgi?section=9&topic=ksoftirqd>.

			"Linux-Kernel Archive: Re: 2.6.7 and khelper." Indiana University. Web. 16 Dec. 2011. <http://lkml.indiana.edu/hypermail/linux/kernel/0406.3/0318.html>.


	''NoScript - JavaScript/Java/Flash Blocker for a Safer Firefox Experience! - What Is It?.'' NoScript. Web. 10 Oct. 2011. <http://noscript.net/>.		''NoScript - JavaScript/Java/Flash Blocker for a Safer Firefox Experience! - What Is It?.'' NoScript. Web. 10 Oct. 2011. <http://noscript.net/>.
Line 239:		Line 246:
	"Software Protection Initiative - Lightweight Portable Security." Software Protection Initiative. Software Protection Initiative. Web. 10 Oct. 2011. <http://www.spi.dod.mil/lipose.htm>.		"Software Protection Initiative - Lightweight Portable Security." Software Protection Initiative. Software Protection Initiative. Web. 10 Oct. 2011. <http://www.spi.dod.mil/lipose.htm>.

	"SourceForge.net Repository - [icewm] Index of /icewm." ''SourceForge.net Repository - [icewm]''. Web. 11 Nov. 2011. <http://icewm.cvs.sourceforge.net/viewvc/~~icew~~		"SourceForge.net Repository - [icewm] Index of /icewm." ''SourceForge.net Repository - [icewm]''. Web. 11 Nov. 2011. <http://icewm.cvs.sourceforge.net/viewvc/icewm>

	"The Linux Kernel Archives." ''The Linux Kernel Archives''. Web. 11 Nov. 2011. <http://www.kernel.org/>.		"The Linux Kernel Archives." ''The Linux Kernel Archives''. Web. 11 Nov. 2011. <http://www.kernel.org/>.

Jeckhard at 19:41, 16 December 2011

2011-12-16T19:41:49Z

← Older revision		Revision as of 19:41, 16 December 2011
Line 288:		Line 288:
	In Distribution: http://www.openssh.com/<br>		In Distribution: http://www.openssh.com/<br>
	Current: http://www.openssh.com/<br>		Current: http://www.openssh.com/<br>

			==Appendix==
			===1: PS -e output after first logging into desktop===
			PID Uid VmSize Stat Command
			1 root 580 S init
			2 root SW< [kthreadd]
			3 root SW< [ksoftirqd/0]
			4 root RW< [events/0]
			5 root SW< [khelper]
			6 root SW< [kblockd/0]
			7 root SW< [kacpid]
			8 root SW< [kacpi_notify]
			9 root SW< [ata/0]
			10 root SW< [ata_aux]
			11 root SW< [kseriod]
			12 root SW [pdflush]
			14 root SW< [kswapd0]
			15 root SW< [aio/0]
			16 root SW< [aufsd/0]
			17 root SW< [aufsd_pre/0]
			18 root SW< [kpsmoused]
			19 root SW [pdflush]
			61 root 892 S < udevd --daemon
			154 root SW< [ksuspend_usbd]
			156 root SW< [khubd]
			317 root 4488 S /bin/haveged -w 4096
			406 root 552 S acpid
			473 root 524 S crond
			512 root 508 S syslogd -m 0
			514 root 504 S klogd
			727 root 840 S /bin/pcscd --debug
			1208 root 856 S < udevd --daemon
			1212 root 752 S < udevd --daemon
			1239 messageb 812 S /bin/dbus-daemon --system
			1842 root 3288 S NetworkManager
			1844 root 2248 S /sbin/modem-manager
			1855 root 740 S /bin/dhcpcd -B -K -L -c /libexec/nm-dhcp-client.actio
			1859 root 812 S /bin/wpa_supplicant -c /etc/wpa_supplicant.conf -B -u
			2079 root 628 S /bin/sh /bin/start-session 0
			2080 root 264 S init
			2154 root 12312 R Xorg :0 -fp /usr/X11/lib/X11/fonts/75dpi,/usr/X11/lib
			2169 root 656 S /bin/sh /etc/init.d/icewm console
			2405 root 300 S /bin/sh /etc/init.d/icewm console
			2406 root 580 S /bin/sh /bin/icewm_startup
			2427 root 2204 S /bin/icewmtray
			2439 root 3376 S icewm
			2484 root 6448 S /bin/volumeicon
			2485 root 8632 S /bin/nm-applet
			2486 root 7676 S pcmanfm -d
			2489 root 1128 R /usr/local/libexec/gam_server
			2493 root 692 S //bin/dbus-daemon --fork --print-pid 5 --print-addres
			2494 root 804 S dbus-launch --autolaunch 551c148ca109c4709c9560794eeb
			2496 root 2368 S /libexec/gconfd-2
			2498 root 8428 S /libexec/notification-daemon
			2500 root 2748 R xterm
			2501 root 720 R sh
			2582 root 296 S /bin/sh /etc/init.d/firefox window
			2583 root 91808 S /lib/firefox/firefox-bin
			2648 root 18832 S /lib/firefox/plugin-container /lib/firefox/plugins/li
			2652 root 660 R ps -e

Jeckhard: /* Software Packaging */

2011-12-16T19:40:52Z

Software Packaging

← Older revision		Revision as of 19:40, 16 December 2011
Line 87:		Line 87:

	==Software Packaging==		==Software Packaging==
	With my operating system there is no package manager, and hence no packaging utilities. Updates to programs and utilities are done with each new release of the operating system. This is likely the case because LPS is a non-persistant storage operating system, meaning upon restarting it, all previous session information is lost.		With my operating system there is no package manager, and hence no packaging utilities. Updates to programs and utilities are done with each new release of the operating system. This is likely the case because Lightweight Portable Security (LPS) is a non-persistant storage operating system, meaning upon restarting it, all previous session information is lost.

	This is not to say that a package manager and installation could not still be supported, with any packages installed during a given session just being lost in the next. However, with the security oriented focus of LPS, it can be reasonably assumed that the DoD wanted to make any initialization of the OS homogenous, so given any instance of the OS, they should be assured no “unknown” packages are being used.		This is not to say that a package manager and installation could not still be supported, with any packages installed during a given session just being lost in the next. However, with the security oriented focus of LPS, it can be reasonably assumed that the Department of Defence (DoD) wanted to make any initialization of the OS homogenous, so given any instance of the OS, they should be assured no “unknown” packages are being used.

	In order to determine the packages being used on LPS, the user is left to browse the file system to try and gain an idea of everything that is available, with /bin being the location that provides a good general idea.		In order to determine the packages being used on LPS, the user is left to browse the file system to try and gain an idea of everything that is available, with /bin being the location that provides a good general idea.

Jeckhard at 19:39, 16 December 2011

2011-12-16T19:39:43Z

← Older revision		Revision as of 19:39, 16 December 2011
Line 191:		Line 191:

	The method to determine LPS initialization involved opening the init files listed above, analyzing them, and following the breadcrumbs to the other init files they referred to.		The method to determine LPS initialization involved opening the init files listed above, analyzing them, and following the breadcrumbs to the other init files they referred to.

			=== Major Processes Running ===
			The following is a description of five major processes that are running as indicated by executing the ps -e command after booting to the desktop:

			{\| class="wikitable" border =1
			\|-
			! Header Process
			! Header Description
			\|-
			\| kthread
			\| A kernel thread
			\|-
			\| kfoftirqd
			\| A kernel thread that handles processing soft interrupts if they are being triggered faster than they can be serviced (tin.org - TIN newsreader development headquarters, 2003)
			\|-
			\| khelper
			\| A kernel thread which provides the kernel a method of making calls out to applications (Indiana University, 2004)
			\|-
			\| crond
			\| A scheduler to execute commands
			\|-
			\| klogd
			\| Intercepts and logs Linux kernel messages (Linux Operating System and Linux Distributions, 2011)
			\|}

			The full list of processes is available in Appendix 1.



	== References ==		== References ==

Jeckhard: /* Chosen Packages */

2011-12-16T19:35:39Z

Chosen Packages

← Older revision		Revision as of 19:35, 16 December 2011
Line 97:		Line 97:
	==Major Package Versions==		==Major Package Versions==
	===Chosen Packages===		===Chosen Packages===
	{\| class="wikitable"		{\| class="wikitable" border =1
	\|-		\|-
	! Header Package		! Header Package

Jeckhard: /* Chosen Packages */

2011-12-16T19:32:17Z

Chosen Packages

← Older revision		Revision as of 19:32, 16 December 2011
Line 97:		Line 97:
	==Major Package Versions==		==Major Package Versions==
	===Chosen Packages===		===Chosen Packages===
	1. Kernel ~~<br>~~		{\| class="wikitable"
	~~Version:~~ 2.6.27.56 - ~~Released~~ November 22nd, 2010~~<br>~~		\|-
	~~Current version:~~ 3.1.1 - ~~Released~~ November 11th, 2011~~<br>~~		! Header Package
			! Header Distribution Version - Date
	2. libc~~<br>~~		! Header Current Version - Date
	~~Distribution Version:~~ 2.8 - April 2008~~<br>~~		\|-
	~~Current version:~~ 2.14 June 2011~~<br>~~		\| Kernel
			\| 2.6.27.56 - November 22nd, 2010
	3. X.org X Server ~~<br>~~		\| 3.1.1 - November 11th, 2011
	~~Distribution Version:~~ 1.7.1 - ~~Released~~ October 22nd, 2009~~<br>~~		\|-
	~~Current version:~~ 1.11.2 November 4th, 2011~~<br>~~		\| libc
			\| 2.8 - April 2008
	4. Ice WM ~~<br>~~		\| 2.14 - June 2011
	~~Distribution Version:~~ 1.2.38 - 2009 - Estimate~~<br>~~		\|-
	~~Stable Release:~~ 1.3.7 October 16th, 2010~~<br>~~		\| X.org X Server
			\| 1.7.1 - October 22nd, 2009
	5. Java SE Runtime Environment ~~<br>~~		\| 1.11.2 - November 4th, 2011
	~~Distribution Version:~~ 1.6.0_27 - August 24th, 2011~~<br>~~		\|-
	~~Current Version:~~ 1.6.0_29 - October 20th, 2011~~<br>~~		\| Ice WM
			\| 1.2.38 - 2009 - Estimate
	6. BusyBox ~~<br>~~		\| 1.3.7 - October 16th, 2010 (Stable)
	~~Distribution Version:~~ 1.1.3 - May 17th 2006 ~~<br>~~		\|-
	~~Current Version:~~ 1.19.3 - October 29th, 2011 ~~<br>~~		\| Java SE Runtime Environment
			\| 1.6.0_27 - August 24th, 2011
	7. Adobe Reader~~<br>~~		\| 1.6.0_29 - October 20th, 2011
	~~Distribution Version:~~ 9.4.2 February 11th, 2011 - Version is current~~<br>~~		\|-
			\| BusyBox
	8. Firefox ~~<br>~~		\| 1.1.3 - May 17th 2006
	~~Distribution Version:~~ 3.6.22 - September 6th, 2011~~<br>~~		\| 1.19.3 - October 29th, 2011
	~~Current Version of 3.6:~~ 3.6.24 - November 8th, 2011~~<br>~~		\|-
	~~Current Version (non 3.6): 8.0 November 8th, 2011<br>~~		\| Adobe Reader
			\| 9.4.2 - February 11th, 2011
	9. Open Office~~<br>~~		\| Version is current
	~~Distribution Version:~~ 3.3.0 - January 25th, 2011 - Version is current~~<br>~~		\|-
			\| Firefox
	~~10.~~ Open ~~SSH_5~~.9p1 - September 6th, 2011 - Version is current		\| 3.6.22 - September 6th, 2011
			\| 3.6.24 - November 8th, 2011
			\|-
			\| Open Office
			\| 3.3.0 - January 25th, 2011
			\| Version is current
			\|-
			\| Open SSH
			\| 5.9p1 - September 6th, 2011
			\| Version is current
			\|}

	===Modifications===		===Modifications===

Jeckhard at 19:23, 16 December 2011

2011-12-16T19:23:52Z

← Older revision		Revision as of 19:23, 16 December 2011
Line 59:		Line 59:
	Since the operating system was meant to provide workers with a secure environment for telecommuting, an attempt was made to replicate a “workday”.		Since the operating system was meant to provide workers with a secure environment for telecommuting, an attempt was made to replicate a “workday”.

	First, Open Office was used to create and save an assortment of text documents, and spreadsheets. Next, the ~~FireFox~~ browser was used to view a number of websites, including YouTube, WebCT, and CNN.com. All websites performed smoothly and as expected.		First, Open Office was used to create and save an assortment of text documents, and spreadsheets. Next, the Firefox browser was used to view a number of websites, including YouTube, WebCT, and CNN.com. All websites performed smoothly and as expected.

	I was a little skeptical of logging into any websites, including my personal email, and banking. Now, this is not because I did not expect my session to be secure, but at a stage of preliminary analysis, I am a bit too paranoid to enter login credentials into a DoD operating system.		I was a little skeptical of logging into any websites, including my personal email, and banking. Now, this is not because I did not expect my session to be secure, but at a stage of preliminary analysis, I am a bit too paranoid to enter login credentials into a DoD operating system.
Line 67:		Line 67:
	One of the features unique to this distribution that was tested was the Encryption Wizard. This is an encryption and decryption program that uses a 128-bit implementation of the Advanced Encryption Standard (AES) with a drag-and-drop interface (ATSPI Technology Office, 2011). It creates the ability to encrypt files using a pass key, with a PKI Certificate, or both, as well as add Meta Data, although this is not encrypted. Decrypting a file that was encrypted using the Encryption Wizard follows a similar point and click method. Both encrypting, and decrypting files was tested on the text documents created earlier in the session, and no problems were encountered.		One of the features unique to this distribution that was tested was the Encryption Wizard. This is an encryption and decryption program that uses a 128-bit implementation of the Advanced Encryption Standard (AES) with a drag-and-drop interface (ATSPI Technology Office, 2011). It creates the ability to encrypt files using a pass key, with a PKI Certificate, or both, as well as add Meta Data, although this is not encrypted. Decrypting a file that was encrypted using the Encryption Wizard follows a similar point and click method. Both encrypting, and decrypting files was tested on the text documents created earlier in the session, and no problems were encountered.

	After creating a number of files were created and downloading an assortment of PDFs, as well as extensive Internet browsing, an operating system restart was done to see if there would be any traces of the session. Upon completing the reboot, all files from the previous use of LPS were gone, and web history from ~~FireFox~~ had also been cleared.		After creating a number of files were created and downloading an assortment of PDFs, as well as extensive Internet browsing, an operating system restart was done to see if there would be any traces of the session. Upon completing the reboot, all files from the previous use of LPS were gone, and web history from Firefox had also been cleared.

	== Usage Evaluation ==		== Usage Evaluation ==
Line 80:		Line 80:
	LPS uses the latest versions of much of its software, including Adobe Reader and Open Office, but Firefox is using version 3.6.2.2, when the latest version as of this writing 7.0.1, and Adobe Flash 10.3.183.10, when the latest version as of this writing is 11. Using out of date versions of software is typically something that raises some eyebrows.		LPS uses the latest versions of much of its software, including Adobe Reader and Open Office, but Firefox is using version 3.6.2.2, when the latest version as of this writing 7.0.1, and Adobe Flash 10.3.183.10, when the latest version as of this writing is 11. Using out of date versions of software is typically something that raises some eyebrows.

	Next, ~~FireFox~~ itself does not use any common extensions that would be expected in a secure environment, such as NoScript, which helps the user to block unwanted scripts, extensions, and other malicious things from running in their browser (NoScript, 2011). There also do not appear to be any restrictions on what extensions a user can install, or disable, including built in DoD extensions.		Next, Firefox itself does not use any common extensions that would be expected in a secure environment, such as NoScript, which helps the user to block unwanted scripts, extensions, and other malicious things from running in their browser (NoScript, 2011). There also do not appear to be any restrictions on what extensions a user can install, or disable, including built in DoD extensions.

	Not only can a user install potentially vulnerable extensions, but as can be seen from the following screenshot, “signed” Java applications can be executed as well. In the case of WebCT, this not an issue, but it does provide the opportunity for a malicious attacker to use the Java Applet Attack Vector provided in tools such as the Social Engineering Toolkit (Social Engineer, 2011).		Not only can a user install potentially vulnerable extensions, but as can be seen from the following screenshot, “signed” Java applications can be executed as well. In the case of WebCT, this not an issue, but it does provide the opportunity for a malicious attacker to use the Java Applet Attack Vector provided in tools such as the Social Engineering Toolkit (Social Engineer, 2011).

Jeckhard: /* Modifications */

2011-11-15T23:42:50Z

Modifications

← Older revision		Revision as of 23:42, 15 November 2011
Line 135:		Line 135:

	===Modifications===		===Modifications===
	With the exception of Firefox, there do not appear to be any apparent modifications to any of the above listed packages. In the case of Firefox, there is a set of custom extensions installed, including incorporation of the Encryption Wizard, and a DoD configuration extension that allows the updating of DoD and Federal certificates, as well as the use of a Smart Card Reader for verifying user credentials. There are also a number of bookmarks to various United States ~~military~~ websites.		With the exception of Firefox, there do not appear to be any apparent modifications to any of the above listed packages. In the case of Firefox, there is a set of custom extensions installed, including incorporation of the Encryption Wizard, and a DoD configuration extension that allows the updating of DoD and Federal certificates, as well as the use of a Smart Card Reader for verifying user credentials. There are also a number of bookmarks to various United States Military websites.

	As for differences between versions, the breakdown is as follows: <br>		As for differences between versions, the breakdown is as follows: <br>
Line 149:		Line 149:

	''Ice WM''<br>		''Ice WM''<br>
	Between the distribution version and the current version there appear to be only minor fixes with ~~things such as~~ battery statuses displaying incorrectly, and task bar auto hiding (SourceForge.net Repository – icewm, 2010).<br>		Between the distribution version and the current version there appear to be only minor fixes with regards to battery statuses displaying incorrectly, and the task bar auto hiding (SourceForge.net Repository – icewm, 2010).<br>

	''Java SE Runtime Environment''<br>		''Java SE Runtime Environment''<br>
Line 155:		Line 155:

	''BusyBox''<br>		''BusyBox''<br>
	There have significant changes between the distribution version, which is altogether not surprising considering there was more than a four year time lapse between the two. These include new features, bug fixes, and improvements of the integration of various utilities (BusyBox, 2011).<br>		There have been significant changes between the distribution version and the current one, which is altogether not surprising considering there was more than a four year time lapse between the two. These include new features, bug fixes, and improvements of the integration of various utilities (BusyBox, 2011).<br>

	''Firefox''<br>		''Firefox''<br>

Jeckhard: /* Software Packaging */

2011-11-15T23:39:28Z

Software Packaging

← Older revision		Revision as of 23:39, 15 November 2011
Line 91:		Line 91:
	This is not to say that a package manager and installation could not still be supported, with any packages installed during a given session just being lost in the next. However, with the security oriented focus of LPS, it can be reasonably assumed that the DoD wanted to make any initialization of the OS homogenous, so given any instance of the OS, they should be assured no “unknown” packages are being used.		This is not to say that a package manager and installation could not still be supported, with any packages installed during a given session just being lost in the next. However, with the security oriented focus of LPS, it can be reasonably assumed that the DoD wanted to make any initialization of the OS homogenous, so given any instance of the OS, they should be assured no “unknown” packages are being used.

	In order to determine the packages ~~to be~~ used on LPS, the user is left to browse the file system to try and gain an idea of everything that is available, with /bin being the location that provides a general idea.		In order to determine the packages being used on LPS, the user is left to browse the file system to try and gain an idea of everything that is available, with /bin being the location that provides a good general idea.

			Since there is no supplied way of installing software packages, the user is left with what is given to them, which although sparse, should cover most basic computing needs. The software available allows the user to edit a variety of document types, browse the Internet, encrypt and decrypt files, and remotely access computers with Citrix Receiver, SSH, or Remote Desktop.

	Since there is no supplied way of installing software packages, the user is left with what is given to them, which although sparse, should cover most basic computing needs. The software available allows the user to edit a variety of document types, browse the Internet, encrypt and decrypt files, and remotely access computers with Citrix Receiver, SSH, or Remote Desktop.
	==Major Package Versions==		==Major Package Versions==
	===Chosen Packages===		===Chosen Packages===