Two-Factor Authenication - What's the right way

Following the numerous compromises of accounts to various online services (with the most news-covered being the Twitter account compromises), more and more online services are providing means for Two-Factor Authentication (2FA).

Just as a short primer, authentication is the procedure a service has in order to verify that the user claiming to want to authenticate is actually the user which holds the account. A good simple example (of one-factor authentication) is a username/password combination. I authenticate to the service by providing my username/password combination, and since I am the only on that should know this, I am authenticated as being the owner of the account.

The big problem with the above is what happens if my credentials are stolen or compromised? Well, the service can be tricked by a third person, which can provide the valid username/password combination, into thinking that the third person is me! Granted, there are cases where this is actually desirable (such as shared accounts) but in the end, the result is the same; the service has no way to identify that the person between the chair and the keyboard (or behind the touchscreen nowadays) is the account holder.

Give your Hyper-V Guest OS's Wireless Internet

I was playing around with creating a virtual lab for a Microsoft Certification I had to do, using Hyper-V on Windows Server 2008 R2. This involved setting up several VMs, which would need updates etc. 

Since my desktop computer uses a wireless USB card for internet connection (my home router is quite a ways away for an ethernet cable and I am too lazy to route one through the wall :) ), I had to figure out how to do this. 

First step, of course, is to make sure that the Hyper-V host can actually utilize the USB wireless dongle. Apart from drivers, you will need to install the "Wireless LAN Service" feature (or you might get stuck for a couple of days trying to figure out why the dongle doesn't work when it should - like I did :) ). 

Next you will need to do a couple of things; Ken Schaefer's blog post was the starting point. Though mostly text based, he links to a blog post by John Paul Cook which provides an illustrated version of Ken's post (as well as an alternative method). Basically, you leverage the Windows Server RRAS role, namely NAT, to route traffic from your Hyper-V Internal network (it needs to be internal - external binds the network to a physical NIC, whereas private does not allow access to the host machine) to the Wireless interface.

What the above blogs failed to mention was a small but important detail: when assigning an IP address to the internal network interface, that address needs to be in the range of the IP addresses used by the VMs. So, if your Hyper-V internal network uses a 10.0.0.0 network, you should allocate an IP within that range (as an example, 10.0.0.250).

Once that is done (assuming the VMs are server OSs and are assigned a static IP address), you need to make sure you can both communicate with the Internet and with any Domain Controllers you may have as a VM (at least, in my case - remember, this is my lab setup). So, the final step is re-configuring the NICs in the VMs to have as a Gateway the IP you assigned to the Internal network NIC (i.e.10.0.0.250) and the DNS servers should be your Domain Controller's IP as primary, and the Internal network's IP address.

The above allowed me to access the internet from the Hyper-V VMs, and do what was needed. Cheers :)

FIM 2010 With ORACLE MA

For a recent FIM 2010 installation, I had to connect to an ORACLE DB (which was the authoritative source).

I had found a number of articles and forum posts that had bits and pieces of information about what to do, none of which was complete. So, I decided to add this blog post as a short how-to.

Since FIM 2010 runs on Server 2008 R2, you need the 64-bit client tools for ORACLE. I found that the 64-bit 11.2.0 client setup package works best (for ORACLE 11g) and can be found here. Install the Full Client.

Now, there are a couple of steps you need to do (or make sure they where done by the installer) for the configuration to work:

• Set (or create) the ORACLE_HOME environment variable. Should have a value of the installation path up to the client_X folder.
• Add to the PATH environment variable the value leading up to the path where you have placed your TNSNAMES file.
• Give access to the Synchronization Service account to the ORACLE client installation folder (make sure they are inherited up to the folder where your TNSNAMES file is stored).

After the installation completed, I fired up the Synchronization Service Manager, created an ORACLE MA, and tried to connect to the database to read a View I had created. Everything worked as a charm!

FIM 2010 with SAP

I was at a customer that requested a FIM installation that would get data from SAP HR 6.0.

So, after the installations where completed, the first thing I tried was actually connecting to SAP.

To do this, you need the SAP .NET Connector 2.0 from SAP website (http://service.sap.com/connectors) and you need some files from the msi package. More on this here.

Now, what the article does not say is that you additionally need to configure how FIM will communicate with SAP.

If you get an error when trying to connect through the ERP MA Configuration Tool stating that it cannot communicate with SAP, you need to configure the services.

The way to do this is to add in the services file (under Windows\System32\drivers\etc) the following lines:

sapdp##  32##/tcp # SAP Dispatcher.       
sapgw##  33##/tcp # SAP Gateway.          
sapsp##  34##/tcp # 
sapms##  36##/tcp # SAP Message Server.   
sapdp##s 47##/tcp # SAP Secure Dispatcher 
sapgw##s 48##/tcp # SAP Secure Gateway 

where the ## is the system number your client has given their SAP system.

(Find the documentation for the above here). 

There are a couple of things you should try if even this fails:

• Run the ERP MA Configuration tool as Administrator.

• Instead of providing the name of the server in ASHOST, type in the IP.
  (Even though I added the entry in the hosts file, I still needed to give the IP.)

Now, I also had an issue when Discovery started. The progress bar would go all the way to the end, and then I would get a message stating:     

The functions or structures in your configuration do not match those in the discovery cache. Saving will produce an unusable ERP MA.

Click ‘Yes’ to rebuild definitions from discovery cache.

Click ‘No’ to cancel Saving.

When I clicked 'Yes' I would get an application exception stating that there was an error retrieving a referenced BAPI function from Discovery. After spending a couple of hours trying to figure it out, I logged out of the machine and went home. The next day, it worked! No idea why, so just try to log out and then back in.

Another issue I faced, once I had the MA set-up in the Sync Service Manager, after trying to do a full import, I kept getting an error stating a "stopped-extension-dll-exception". Looking in the Eventlog, I found out that a FileNotFoundException was thrown and it was looking for the .xml file in the Extenstions directory. So, I needed to set the MA Name to the .xml file exported by the ERP MA Configuration Tool. Once I did that, everything worked like a charm.

Isolate applications on your PC

A lot of IT professionals and security experts try to lock down their machine against malicious code (especially those who run Windows OS's). When I come along a new free application, I first like to try it out in a virtual machine environment, just to be on the safe side in case their is malicious code running in the application.

But, there are malicious applications that can detect the virtual environment, and do not try to exploit the machine. What can someone do in that case?

There is a very very nice applications, called Sandboxie by Ronen Tzur. This small application basically runs any application (even installers) in isolated space, so any changes made to the filesystem are not reflected in the actual systems' filesystem. This space may be discarded at any time, and with it, any changes made by malicious code.

The newest version (3.34) has the addition of a DropMyRights like feature, which runs the isolated application with the lowest possible level of rights on the machine. In general this is a very nifty application, and one that is very modestly priced. Purchase allows the user a lifetime subscription of updates, and unlimited use of the application on any computer that the end-user owns.

There are limitations though (such as the inability of Sandboxie to be installed on Vista or XP 64 bit versions, due to Windows PatchGuard), but is overall, in my modest opinion, a must have application for the security conscious.

SSL Blacklist - Useful tool for recent MD5 risk

Marton Anka (www.CodeFromThe70s.org) has a pretty nifty tool for detecting pages that use certificate chains with signatures based on the MD5 algorithm which was recently attacked.

The tool is a Firefox extention, that pops-up a window informing the user that the certificate used by the page is potentially compromised and that access to that url may be not be secure. Here is a screenshot:

Following the recent compromise of SSL certificates and the fact that a lot of DNS servers still remain unpatched against the Kamnisky attack, this is a tool that I am using and would recommend to anyone. Keep in mind that this only informs you about a potential risk. It does not know if the certificate is indeed insecure (as there is no way to know this).

Also, after listening to my favorite podcast (Security Now!), certificates can be reissued for free so they are signed using SHA1 instead of MD5. So, when you come accross a site that has an MD5 signed certificate, drop a message to the webmaster to inform them about this.

PS3 cracks security yet again...

Well, after the last blog I wrote (a year ago, embarassing, I know), it seems that SONY's PS3 has delivered yet again on it's pre-release promises of computational power.

In my previous blog spot, I wrote about the PS3's ability to crack MD5 hashes. Of cource, one machine could only (!) do 1000 times better than an Intel based processor, yielding the attack probably too time-consuming to be a real threat. But, as I predicted, a real threat has appeared.

Combining the computational force of 200 of these machines, attackers managed to break one of the MD5 algorithms used by Equifax and forge an invalid certificate from a valid provider. More details can be found here, here and here.

But the problem is not the attack itself, but rather the downplay from a number of parties, including the researches that performed the attack, and Microsoft. They are basing their evaluation of the risk to the fact that in order for black-hat attackers to use the breakthrough they need to have the cryptographic backround. And of course, we know how dumb hackers are when it comes to monetary gain...

A remedy of sort is not using MD5 as a hashing algorithm for SSL. It is well known that SSL uses two (primary) methods for doing hashing, MD5 and SHA1. For those who might be a bit worried, simply trust (for the time being) encrypted pages that use certificates that either use only SHA1 or use both SHA1 and MD5. It also has to be noted that in order for an attack to be succesful, not only does an attacker have to create a forged SSL certificate, but also redirect a victim to a malicius server. And we know that can't happen (remember the Kaminsky attack? 25 per cent of the worlds DNS servers still remain unpatched!)

To keep things short, I said it a year ago, I'll say it again. I may not be a guru in the field, but I know enough to understand that week algorithms should be made obsolete. SHA1 may be a remedy for the time being (as it is more secure than MD5 currently), but remember, it has not been ckacked, but it has been broken. Serious businesses should move to more secure algorithms, as if they wait for the tidal wave of security failure, I'm pretty sure they will go down with their ship.