Side Channel Attacks in the Cloud

I saw this paper (by Yinqian Zhang, Ari Juels, Michael K. Reiter and Thomas Ristenpart in ACM CCS 2012) earlier this year, but thought it was a very specific threat model. In a  one line summary - it is possible to recover private keys when they are being used within a virtual machine, through observations of the activity of the virtual machine from the host machine. It is a very complex attack, and requires at least host access for these observations, so my initial thoughts were that this attack could only be carried out by extremely skilled admins of a cloud hosting provider; but the complexity would probably mean that there was no realistic threat in that regard.

With the NSA revelations of the past few months, this is an interesting approach that could be taken by an agency (such as the NSA) to recover private keys from cloud providers, without getting actual access to the servers themselves. Given that PRISM does provide such access to hosts, it is not inconcievable that systems that are hosted on public cloud services such as Amazon's EC2 could be monitored. However, given the description of events relating to Lavabit, it is likely that this type of attack hasn't been operationalised yet - but remains interesting on what could be achieved.

1820 Settlers National Monument

The 1820 Settlers National Monument is just outside Grahamstown, offering fantastic views of the town. A monument celebrating English settlers, it is in many ways a monument to colonialism - especially with cannons pointed towards the town; although the monument website talks about anything but that. The foundation building itself was closed on Sunday, but the views were worth the stop.

Grahamstown

This is my 3rd time in Grahamstown, though the first extended stay here. It's a small town with impressive colonial architecture (at least in the central part). The weather hasn't been great (quite chilly actually) it's a nice plae to visit regardless.

JPO's 2nd 2013 Season, 2nd Concert

Pianist Jan Hugo was completely focused on the keyboard as his fingers sped across the keys. He looked at the conductor for his cue, swayed slightly when it was just the orchestra; but mostly he was focused on the piano keys. It was a mesmerizing performance of Mendelson's 1^st Piano Concerto, which got a rousing applause from the audience; so muh so, that the pianist obliged with two encores.

Before the concerto, the JPO played Mozart's Magic Flute Overture; and finished off with one of the most well known symphonies - Beethoven's 5^th. Once again, conductor Daniel Boico brought great energy to the performance - especially for the symphony.

Yet another great concert from the JPO, and a great selection of pieces this week.

Movie: RED 2

I enjoyed RED, and the sequel is much more of the same. As in previous movie, ex-CIA black OPS, Frank Moses (Bruce Willis) and his best friend Marvin (John Malkovich) are being chased by a number of governments relating to an old operation known as Nightshade. Set up across 4 countries, there are brilliant performances by Anthony Hopkins as the deranged villain and Helen Miren gets to play the queen again - although this time it's in a psychiatric ward. 

Despite some amazing stunts, the movie felt less slick than the original. The plot has a lot of holes, the dialogue seems to have been written by different writers (of different abilities) and the story sometimes looses steam. It is still funny, and a very good antidote to the run of the mill action story.

JPO's 2nd 2013 Season 1st Concert

There was a noticeable influx of youth (well anyone under 50 would be young right?) at yesterday's JPO concert - in the audience, in the orchestra, which was also led by the relatively young conductor Daniel Boico. Daniel Boico brought some amazing energy to the orchestra - especially in the opening piece; Rossini's William Tell Overture. I have heard this piece performed before, but this JPO performance was something special.

Luis Magalhaes played Rachmaninov's Piano Concerto No. 4 next, which was sadly not at the same level. It was a strange piece - and it just didn't have the wow of Rachmaninov's earlier concertos. 

The evening ended with  Dvořák's Symphonny No 8. While it is not as recognisable as his 9th, it was a good mixture of emotional mood and was once again energetically conducted and performed. 

For an orchestra that flirted with its demise due to funding problems, this was the exact statement of revival that was needed. It's a pity that the hall wasn't sold out ...

Sport Development and Diversity

Business Day has a great article exploring why black rugby players who seem to succeed on the field in junior rugby do not succeed as they go up the age brackets.

It is an argument I have made before, in my experience with badminton in Cape Town. Sports development is not only about training and coaches - it is about nutrition, about emotional support, about family support, and a whole lot else. If kids are going to spend hours to get to training, development is not sustainable. If kids are not going to get good nutrition at home, they will physically not develop regardless of the hours they spend in gym as part of their training. If they do not get support in their education and family life (which may be in non traditional family structures) they will have other things to worry about.

That said, I am not sure that boarding school, as advocated, is the solution. In my own experience in Cape Town, the fact that top players (including national players) stayed an played in the community was in itself a promoter of the sport. Ultimately, I think a balance is required and it required support from multiple spheres of government and civil society.

Trevor Noah: It's My Culture

I bought my tickets to the show in August, and already most of the tickets had been sold out for the 3 week show. Trevor Noah has had a fairly meteoric rise as a comedian - I first saw him as a support act at a comedy club about 5 years ago, and now he has 2 hour shows across the world. 

The content of his act varied widely, and he is a great story teller (and writer); managing to get laughs from even difficult topics. The story about his meeting with Julius Malema was particularly impressive, as was the brilliant story of the arrival of the escalator in Zambia (which is not too say that Zambia is technologically backward). 

Earlier, the show opened with a drummer and a puppeteer with 2 dancing puppets (who put Miley's twerking to shame). It was followed by short act by Dusty Rich; which comprised of commentary on his name and blaming his parents for (in his opinion) various genetic defects. The puppeteer was amazing; Dusty was just ok.

I am not sure that the show itself lived up to its name; but that doesn't really matter. It was a great show that definitely lived up to Trevor Noah's well earned reputation.

The Price of Prepaid Mobile Data

The Economist has an analysis of mobile data prices (prepaid), with some surprising results. When the average prices are measured against the country's average income levels, SA prices do not come across as too bad - especially when compared to the US prices; and most of BRICS seem to be on par. With the recent announcement of even further cuts to mobile prices due to reduction in termination rates, the mobile data price should get better!

And Then Steve Said, ‘Let There Be an iPhone’

The NYTimes has a great article on the design and engineering challenges of building the iPhone, particularly leading up to its unveiling. It's particularly interesting how rough the initial demo units were, and how much improvement was actually done in the 6 months before the actual public availability. But best of all, it is a fantastic discussion on what it takes to deliver a brand new product; and the bets that Apple effectively took to deliver the iPhone (effectively stopping development of all other products to focus on the iPhone). 

There are a lot of articles on Steve Jobs today, and this is probably the best of the lot.

Carnivore

For a number of years, I have heard about the meat-lover's paradise called Carnivore. While discussing the rodizio concept with a Argentine-Brazzilian business-partner, I proposed that we go check out Carnivore.

Te restaurant is very much a rodizio, with the major difference being the variety of game meats, and the lack of a salad bar (some small amount of salad is brought to the table, but none of us had any). The decor in the restaurant is definitely geared for the tourists with iron statues of great African chiefs (Shaka, Moshoeshoe etc); some elaborate wood carvings an other curios. The service was very friendly, although quite slow.

The food (or rather the meat) was good; though some of the game was a bit tough. For meat lovers, it is certainly good value for money; and the variety of the type of meat is impressive. Unfortunately, unlike Brazilian rodizios, there wasn't too much variety in te type of preparation. It was a good evening, an certainly a great place to take meat loving tourists.

Buskaid Recital

Arcadia House in the Hollard Campus is a grand, but intimate location. It was a pity that there were still a number of empty chairs for the event. Instead of an orchestra, senior students performed a solo recital of their pieces, usually accompanied by Jill Richards on the piano.The program ranged from the well known (e.g. Beethoven's Romanze in F Major or Brahms' Scherzo for Violin and Piano) to the really obscure (Paul Patterson's Tides of Mananan). 

As usual the performances were of high quality - but a few performances did stand out - Cecilia Manyama's performance of the Dvorak's Sonatina for Violin and Piano; Pule Lekarapa's performance of  Faure's Sicilenne and Tisetso Mashini's performance of Tides of Mananan was the definite highlight of the evening.

At R50 a ticket, it was great value for money and an event that should have been supported more!

Movie: The Conjuring

As horror movies go, this one has a decent story, with good acting and some really scary moments. It is a ghost/poltergeist/demon story based around a large family (husband, wife, 5 daughters) that buys a dilapidated house which ends up being haunted with ghosts of a witch. In most ways its a straight forward story - well executed. I am not a fan of the genre, but I did like the fact that the horror was based on the actions of the demons/ghosts instead of gore of body parts flying around.

Naked and Afraid

Survivor made reality tv big, and Fear Factor exploited the viewer's fears (often of creepy crawlies and other gross things) and others have taken the viewers to exotic locations around the world. And in all examples of reality tv, it is a bunch of people competing for a prize. There are a lot of safety nets (in shows such as Fear Factor), and most reality tv shows are driven by the competition between the participants.

National Geographic's Naked and Afraid series (not sure if it is screening in SA yet) somewhat turns most of this up side down. There is no prize money. There is no competition between participants. For 6 episodes, 1 man and 1 woman, both supposed expert survivalists, are placed naked (as in absolutely no clothes) in some inhospitable location, with 2 survival tools (usually from the group of cutting implement, fire starting implement and pot) and live for 21 days. Yes there is a camera crew - but only during the day. The participants have to do everything for survival - get water, get food, make shelter and survive the local inhabitants, ranging from snakes, to bugs to hyenas. 

What is most interesting, is what it really takes to survive in remote locations with no real help. All participants loose weight - some with drastic weight loss. Many almost give up - and 2 actually do. Making fire, with 2 sticks can take hours. Making fire, even with a lighter, can fail when there is nothing to burn. Despite being experienced hunters, all participants go for days without food. Almost every participant falls sick or gets injured in some manner. And the nudity - you don't see much, this being an American production - makes it difficult when temperature drops, or sun leads to bad sunburn.

 

Should a post-apocalyptic scenario painted by novels or movies ever take place - humanity won't be only wiped out by the event - but by the thirst for water, lack of food, lack of good tools and microbes. It also means that while we were once equipped to survive on primitive conditions, we have also lost those natural defences long ago. Progress has its downsides ...

NSA and Cryptography Attacks

There have been a few excellent articles on the NSA "breaking encryption", as reported in The Guardian and New York Times. In the talk 2 weeks ago Vint Cerf commented that we should use stronger keys - but as per the articles, key length may not be the issue at all. To summarise there are a few ways encryption can be broken:

1. Brute force the keys
2. Bugs in the software/hardware implementation
3. Bugs in the algorithm
4. Interception before encryption (in the case of network encryption specifically)
5. Steal the key

For point 1,  I think the maths of brute forcing the keys still hold out, we may be close - but I don't think we are there yet. But still, the advice of stronger keys always helps.

For point 2, there have been bugs in encryption libraries before and there are potentially still bugs in these libraries. Both Bruce Shneier and Matthew Green comment on the possibility that there are bugs in the Microsoft crypto library (which is closed source) and even Open SSL. Another possible attack vector, as noted by Ed Felten, is buggy components that make up crypto components, such as bad random number generators - which can then lead to weak keys etc. Faulty hardware (including deliberate backdoors) is also a possibility explored by Ed Felten.

For point 3, in most cases the maths in encryption algorithms seem to be right, and strong. But there have been cases were crypto algorithms have been broken (sometimes after years in operation) and cases where weak algorithms have been submitted for consideration in standards. I think most of the modern algorithms, such as AES are strong - but perhaps there are flaws that just haven't been published.

Point 4 raises an interesting attack vector, which I have seen being carried out by pentesters - basically a proxy service where a network call is intercepted at the initiation of a network session, and then network encryption is easily eavesdropped by the middle party. If the NSA is intercepting huge amount of traffic, it is possible to create such an attack - but automating this in a large scale is surely difficult?

The last point, of stealing keys - or rather forcing companies to hand over their keys under Prism is probably the easiest way for the NSA. There is some commentary on the possibility that the NSA had access to compromised keys at certificate authorities - which would assist this type.

Overall, I don't think there has been fundamental break in cryptography - but there has certainly been weak implementations followed by exploitation by the NSA.

 

The best form of defence is active defence

Over the past couple of years, Dave and I have had numerous discussions on various legal concepts around IT. As a noted privacy expert, and a IT professor at UNISA, the topics have been varied, and often straying to the esoteric.

Over the weekend, Dave and I recorded a podcast with Tony Olivier for the DiscussIT Pubcast on IT Security, covering the concept of active defence/hacking back. Dave and I previously presented the topic at a closed forum? And thought it would make it interesting to make it available to a wider audience. Tony is an excellent host, and managed to steer the discussion to additional points we had previously not covered. The podcast is a bit rough - it picks up a bit of the ambient noise, and is mostly unedited so all the umms and stutters are included for special effect :)

Car Guard Insights

When M & I got to my car after lunch at 44 Stanley, we noticed that the car behind us was parked funny; which I commented to the car guard. To that he replied, that the driver ran out of petrol, and thus had to park it as best as he could. 

But it was the ensuing short conversation, that made me think. The guard proceeded to comment  - "Us black brothers just don't seem to plan ahead - after all the petrol station is just there" (pointing to the other end of Stanley road). "He and another guy went to get petrol some time ago - no idea where they are".

"Have you heard about our president and his fight with the media" (pronounced as Med-ia) he continued - "and it's not the media's fault that they are talking about bad things. If Zuma had done good things, they would be talking about good things; instead he fights the media".

Auckland Park is the centre of two of SA's biggest media organisations - SABC and Media24 - so the comment is not completely out of place. But what made me think is, that even the ANC's traditional supporters - such as the car guard - are not accepting the spin. The question is, as with service delivery protests, are the disaffected going to vote for opposition; or are they just going to not bother voting. 

Interesting times ...

Movie: The Mortal Instruments: City of Bones

M wanted to watch the movie based on the trailer - neither of us had read the books, nor did we expect much. Based on a similar premise as Harry Porter and the excellent Night Watch series - there is a hidden world where the supernatural exists, and similar to Night Watch, this is constant fight between good and evil. 

In this particular series, the good is represented by Shadow Hunters (assisted by werewolves), while the evil is represented by demons (with vampires and a few others). The shadow hunters are constantly hunting demons - thought their ranks are small and dwindling further; and the main plot in the movie revolves around internal conflicts within the shadow hunters; with a character similar to that of Voldemort in Harry Potter.

The movie starts of promisingly; but devolves into cliches, predictability, and illogical plot development. It is visually great, with ok acting, but is not really as compelling a story as Harry Potter or as complex as Night Watch. It's a fun movie - just not a stimulating one; and I doubt I will watch any other future adaptations.

Movie: Elysium

Elysium is effectively set in a world where the current economic and political policies are taken to their extreme, logical conclusion. A world where there is an effective two-class economy - the very rich, and everyone else (extrapolation of the current discrepancies in countries such as South Africa, Brazil and India), where immigration of the poor is controlled with a degree of viciousness (Australia's new immigration policies?), where even basic health care is difficult to get (almost everywhere except Europe), dependence on warlords for safety and security (Hamas in Palestine, Somalia?), over-population leading to vast slums (India, Brazil, South Africa) and a scenario of factories working off effectively slave labour (China). It is a dystopian future that has been on screen and books before - but I just don't think it has been shown in such extreme brutality.

In this setting, the story of Max (Matt Damon) who inadvertently starts a fight against the system is compelling, but ultimately looses out of steam about 70% of the way in - but by then the movie needs to finish a story, and not provide a philosophical parable. Perhaps the most telling point is that ultimately, in the future, it is the android robots that are more humane than the humans.

It is visually stunning, backed up with some great acting - especially by Sharlto Copley as the renegade mercenary Kruger. It is definitely worth watching, on a big screen.

Buskaid 2013

It was yet another sold out event for the annual Buskaid concert at Linder Auditorium last night; which presented yet again an eclectic compilation of music; most of which has probably not been presented on South African stages before. Two pieces also featured German musician Uwe Grosser playing the chitarrone; a strange plucking instrument descendant from the lute - probably another first in South Africa. 

The classical ensemble pieces included selections from Rameau's Suite from Les Indes Galantes, Vivaldi's Ercole su'l Termodonte: Simfonia and selections from Johannes Brahms' Liebeslieder Walzer. Of the three, the Vivaldi piece was the closest to a standard symphonic piece; while the others are shorter works which were often meant to be accompanied by dances (in the case of Rameau) or singing (in the case of the Brahms). Perhaps, for future concerts it would be worthwhile for Buskaid to consider such accompaniments - as it would certainly make the concerts a richer experience.

There seemed to be fewer individual pieces (i.e. featuring soloists), but they were certainly the highlights of the evening for me. Recent graduates from the Royal Academy of Music in London - Kabelo Monnathabe and Tiisetso Mashishi played the first two solo pieces - Nigel Hess' Theme from Ladies in Lavendar (from movie of the same name) and John Woolrich's Ulysses Awakes. Of these two, Ulysses Awakes was the surprising piece - a very somber moving piece for the viola.

The highlight piece was certainly Simiso Radebe (also a current student at the Royal Academy of Music) performing Jenő Hubay's Hejre Kati. In previous concerts, Simiso has often performed the virtuoso violin pieces, and this concert was no difference - this was the flashy piece, showcasing a wide range of what the violin can perform, and Simiso delivered a brilliant performance.

As per other Buskaid performances, the concert ended with a selection of kwela pieces; after a vocal solo piece - Hoagy Carmichael's Lazybones. The kwela pieces were new arrangements, and both the vocal pieces and the kwela pieces differentiate the Buskaid concerts from run of the mill classical concerts with more energy and fun - for both the performers and the audience. 

It was once again, a brilliant Buskaid concert and a great showcase of musical talent. Buskaid is a great initiative that deserves more support and has the potential to be a cultural institution for South Africa.