Virtual machine used to steal crypto keys from other VM on same server

By Dan Goodin Ars Technica Nov 6 2012
Piercing a key defense found in cloud environments such as Amazon’s EC2
service, scientists have devised a virtual machine that can extract
private cryptographic keys stored on a separate virtual machine when it
resides on the same piece of hardware.
The technique, unveiled in a research paper published by computer
scientists from the University of North Carolina, the University of
Wisconsin, and RSA Laboratories, took several hours to recover the
private key for a 4096-bit ElGamal-generated public key using the
libgcrypt v.1.5.0 cryptographic library. The attack relied on
“side-channel analysis,” in which attackers crack a private key by
studying the electromagnetic emanations, data caches, or other
manifestations of the targeted cryptographic system.
One of the chief selling points of virtual machines is their ability to
run a variety of tasks on a single computer rather than relying on a
separate machine to run each one. Adding to the allure, engineers have
long praised the ability of virtual machines to isolate separate tasks,
so one can’t eavesdrop or tamper with the other. Relying on fine-grained
access control mechanisms that allow each task to run in its own secure
environment, virtual machines have long been considered a safer
alternative for cloud services that cater to the rigorous security
requirements of multiple customers.
“In this paper, we present the development and application of a cross-VM
side-channel attack in exactly such an environment,” the scientists
wrote. “Like many attacks before, ours is an access-driven attack in
which the attacker VM alternates execution with the victim VM and
leverages processor caches to observe behavior of the victim.”
[…]
http://arstechnica.com/security/2012/11/crypto-keys-stolen-from-virtual-machine/

BITAG Announces Next Technical Topic on Port Blocking

Denver, CO (November 7, 2012): The Broadband Internet Technical Advisory Group (BITAG) is pleased to announce the launch of a new technical review on the topic of Port Blocking best practices. BITAG’s Technical Working Group elected to take up this topic through a self-initiated vote, as Port Blocking is of interest to many stakeholders in the Internet ecosystem.

ICE Releases Documents Detailing Electronic Surveillance Problems and then Demands Them Back a Year Later

ICE Releases Documents Detailing Electronic Surveillance Problems . . . and then Demands Them Back a Year Later

November 5, 2012 | By Jennifer Lynch
This is a first for us in all of EFF’s history of Freedom of Information Act (FOIA) litigation—Immigrations and Customs Enforcement (ICE) has demanded we return records it gave us more than a year ago. The release of these documents doesn’t endanger national security or create a risk to an ongoing law enforcement investigation. Instead, it seems that ICE simply wants to stymie further FOIA requests from EFF as we try to get answers about the government’s electronic surveillance procedures.
< – >
It took ICE almost a year to get back to us on the narrowed request, and when it did, its response was frustrating. Not only did the agency decide that it would still be too burdensome to conduct any kind of a search for similar records, but ICE also told us it never should have turned over the original records in the first place—and it wanted them back. The problem for ICE is, these records have already been in the public’s hands for over six months—we filed them as an exhibit (pdf) in our FOIA litigation (pdf) in March 2012, and they’re readily available on the PACER docket for the case (or from the Internet Archive).
This is yet another example of the federal government failing to comply with the letter and spirit of the Freedom of Information Act—reverting to secrecy when it should be promoting transparency. It’s hard to imagine what harm could come from the release of these documents. ICE was careful to block out any information in the records that would identify the target of the investigation, and the information that isn’t blocked out seems to reinforce the government’s position on CALEA.
And it’s another disappointment from an administration that lauded its commitment to transparency on the first day the President took office four years ago. We can only hope that if the President wins this tight election, he’ll use the next four years to fulfill this commitment.
https://www.eff.org/deeplinks/2012/11/ice-releases-documents-detailing-electronic-surveillance-problems-and-then-demands

Carnegie Mellon Integrates Policy and Technology In New Master’s Degree for Privacy Engineers

First-of-its-kind Program Covers “Privacy by Design” Principles. Students who complete the master’s degree program will be prepared for the International Association of Privacy Professionals (IAPP) Certified Information Privacy Professional certification exam.

Carnegie Mellon Integrates Policy and Technology In New Master’s Degree for Privacy Engineers

http://privacy.cs.cmu.edu/
First-of-its-kind Program Covers “Privacy by Design” Principles
PITTSBURGH—People tasked with safeguarding privacy in this age of Big Data and easy Internet access need an unusual combination of technological know-how and policy savvy — expertise that will be honed in a new master’s degree program for privacy engineers offered by Carnegie Mellon University’s School of Computer Science.
The Master of Science in Information Technology-Privacy (MSIT-Privacy) is a 12-month program that begins in the 2013 fall semester.
“Privacy breaches, whether through poor design or as the result of attacks, have become a staple of the daily news,” said Norman Sadeh, professor of computer science, who will co-direct the MSIT-Privacy program withLorrie Faith Cranor, associate professor of computer science and engineering and public policy.
“Leaders in social media, tech and Internet companies, financial service firms and government agencies all tell us that they see an increasing need for privacy engineers who can help them design and maintain systems that protect people’s identities and personal information,” Sadeh added.
Until now, however, this critical expertise has been acquired only through on-the-job experience, said Cranor, director of the CyLab Usable Privacy and Security Lab. “Carnegie Mellon has a number of faculty with deep expertise in privacy and offers a variety of privacy-related courses,” she added. “This new program goes a step further by integrating privacy engineering with product design, software development, cyber security and human-computer interaction, as well as legal and business considerations.”
The program includes two semesters of courses taught by leading academic privacy and security experts. In the Carnegie Mellon tradition of learning by doing, the program also includes a summer-long capstone project in which MSIT-Privacy students will serve as privacy consultants on projects for commercial clients.
The program will emphasize the concept of “privacy by design,” in which safeguards are incorporated into the design of systems and products from the very beginning of the development process. Students will be trained to identify points where privacy may be at risk, propose and evaluate solutions to mitigate risks, understand the capabilities and limitations of privacy-enhancing technologies, assess the usability of privacy-related features and understand current privacy regulatory and self-regulatory frameworks, among other skills.
“To embed privacy by design into all things involving information technology, we will need to have privacy engineers, of which there are currently very few,” said Ann Cavoukian, Information and Privacy Commissioner in Ontario, Canada. “Professors Cranor and Sadeh have provided an excellent remedy to this problem by developing their new MSIT-Privacy program at Carnegie Mellon.”
Students who complete the master’s degree program will be prepared for the International Association of Privacy Professionals (IAPP) Certified Information Privacy Professional certification exam.
“As the field of privacy grows around the globe, we are seeing a clear need for highly trained engineers who can translate the complexity of privacy into technology,” said J. Trevor Hughes, president and CEO of the IAPP. “There are too few of these professionals today, and we look forward to welcoming Carnegie Mellon graduates into this burgeoning profession.”
The MSIT-Privacy program is primarily intended for students who already have a technical degree, such as computer science, computer engineering or software engineering, or have comparable work experience. Students should apply for the program by Feb. 1, 2013. For more information, see the program website athttp://privacy.cs.cmu.edu/.