Technology Sectors

Market Sectors

Infrastructure Protection

GSN 2012 Awards announced: White House deputy of homeland security recognized for leadership at annual gala

GSN Awards 2012

Hundreds of the best of the homeland security community’s federal, state and municipal government officials, government contractors, systems integrators, IT vendors and physical security product and solutions providers all came together the night of November 29 in a ballroom of the Washington, D.C. convention center to receive accolades.

The GSN awards dinner, which has become a Washington tradition over the last four years, offered a chance for the excellence and civic-minded spirit of homeland security efforts nationwide to be recognized.

Not only were the best tools and technologies acknowledged , but the people and groups who use them, from local police departments in Florida and Washington state, to the White House, were honored at the event.

During the awards ceremonies, Richard Reed, Deputy Assistant to President Obama for Homeland Security, received the second annual Government Security News/Raytheon Award for Distinguished Leadership and Innovation in Public Safety and Security. Reed was chosen for tireless work in his key role in leading the development of national policy related to resilience, transborder security and community partnerships. He has been described as the president’s eyes and ears during disasters. In crises, such as the Gulf oil spill, H1N1 pandemic, and Haiti earthquake, Reed has sprung into action at the White House, coordinating information and gathering people to cope with these catastrophes.

Reed told Government Security News in an interview after the dinner that gatherings like GSN’s awards ceremony were invaluable in demonstrating that the hard work of creating a resilient, strong response to crises is performed by thousands of individuals, like those in attendance. Gatherings that bring the diverse emergency response and homeland security communities together can broaden perspectives and spur new ideas, he said.

Reed has been a determined, mostly behind-the-scenes, captain of federal emergency response efforts during the Bush and Obama administrations, helping prepare for, and respond to, some of the worst natural disasters the nation has known, from one of the deadliest tornado seasons in history in the Midwest, to historic wild fires in the west, and massive storms in the eastern U.S.

Reed said the key to capable response to such staggering events lies not only in federal hands, but in enabling state, local and even personal responses. Getting resources and training in place before disasters happen goes a long way in an effective response and recovery, he said. “The true first responders are friends, neighbors and co-workers” in the immediate aftermath of a disaster, said Reed. Local police, firefighters and other agencies arrive second, he said. Enabling people with information concerning what resources are available or where they can go for help or supplies empowers them, said Reed.

Government Security News managing partner Adrian Courtenay has made the GSN/Raytheon award an annual tradition. The prize is sponsored by the Raytheon Company, a technology and innovation leader specializing in defense, homeland security and other government markets throughout the world, which is headquartered in Waltham, MA.

Notable 2012 government excellence award winners included the local police departments in Tampa and St. Petersburg, FL, for their ground-breaking work in preparing for the Republican National Convention in Tampa this past summer. The departments put together comprehensive plans to gently defuse potentially volatile political demonstrations at the event. Both departments were also praised for implementing an innovative interoperable communications network during the GOP convention.

The Lawrence Livermore National Laboratory was recognized for its groundbreaking work on a small radiation detector. The Naval Air Systems Command won an award for its work on the Kestrel Wide Area Persistent Surveillance program, which developed an aerostat for long-term surveillance capabilities to protect ground soldiers in Afghanistan.

The complete list of GSN’s 2012 Award winners appears below: 

CATEGORY 1 – VENDORS OF IT SECURITY PRODUCTS AND SOLUTIONS

 

Best Anti-Malware Solution

 

Invincea

 

Best Identity Management Platform

 

Alert Enterprise

 

Best Certificate Management Solution

 

Entrust

 

Best Compliance /Vulnerability Assessment Solution

 

Agiliance

 

Best Data Security/Loss Management Solution

 

WAVE Systems

 

Best Endpoint Security Solution

 

StillSecure

 

Best Forensic Software

 

Silvertail

 

Best Intelligence Data Fusion and Collaborative Analysis Solution

 

Lookingglass Cyber Solutions

 

Best Intrusion Detection/Prevention Solution

 

Intellidyne

Vanguard Integrity Professionals

 

Best Network Security/Enterprise Firewall

 

Black Lotus

 

Best Privileged Access Management Solution

 

Kikusema

Xceedium

 

Best Real-Time Dynamic Network Analysis

 

Fidelis Security

 

Best Continuous Monitoring Solution

 

ForeScout

Redseal

 

Best Security Incident/Event Management Solution (SIEM)

 

NetIQ

 

CATEGORY 2 – VENDORS OF PHYSICAL SECURITY PRODUCTS & SOLUTIONS

 

PHYSICAL SECURITY ACCESS CONTROL & INDENTIFICATION

 

Best Biometric Identification Solution

 

Fulcrum Biometrics

 

Best Integrated System for HSPD 12/FIPS 201 Compliance

 

Brivo

 

Best Platform for Physical and Logical Access

 

Alert Enterprise

 

COMMUNICATIONS

 

Best Interoperable First Responder Communications

 

Covia Labs

 

Best Mass Notification Systems

 

AtHoc

 

Best Regional or National Public Safety Communications Deployment

 

Desktop Alert

 

DETECTION PRODUCTS

 

Best Explosives Detection Solution

 

AS&E

 

Best Long Range Detection Systems

 

Vidisco

 

Best Nuclear/Radiation Detection

 

Lawrence Livermore National Laboratory

 

VIDEO SURVEILLANCE

 

Best Intelligent Video Surveillance Solution

 

Panasonic

 

Best Thermal/Night Vision/Infrared Cameras

 

HGH Infrared Systems

Vumii

 

Best Network IP Cameras

 

Axis Communications

 

Best Video Storage/Digital Transmission Systems

 

Panasonic

 

OTHER PRODUCTS

 

Best Perimeter Protection Solution

 

Senstar

 

Best Crash Barriers

 

Nasatka

 

Best Physical Security Information Management (PSIM) Solution

 

NICE Systems

 

SERVICES

 

Best Disaster Preparedness or Disaster Recovery & Clean-up Service

 

High-Rise Escape Systems

 

Best Facility Security/Force Protection Service

 

Whitestone Group

 

Best Homeland Security Training/Higher Education Solutions

 

Bellevue University

 

Category 3: Government Security News 2012 Government Excellence Awards

 

Most Notable Airport Security Award

 

Defense Manpower Agency

 

Most Notable Maritime/Port Security Program

 

Ohio Department of Public Safety/Northern Border Initiative

 

Most Notable Railroad/Mass Transit Security Program

 

Denver Regional Transportation Authority

 

Most Notable Critical Infrastructure Program, Project or Initiative

 

U.S. Veterans Administration Hospital, Tucson, AZ

 

Most Notable Cyber Security Program, Project or Initiative

 

U.S. Department of Energy

 

Most Notable Emergency Response Implementation

 

U.S. National Guard

Federal Emergency Management Agency (FEMA)

 

Most Notable Law Enforcement Interdiction, Arrest or Counter-Terrorism Program

 

Orange County Intelligence Assessment Fusion Center

 

Most Notable Municipal/County Programs, Projects or Initiatives

 

Seattle, Washington Police Department

Tampa and St. Petersburg, Florida Police Departments

 

Federal Government

 

Naval Air Systems Command (Kestrel Wide Area Persistent Surveillance)

GSN 2012 Homeland Security Awards program open for entries

The Government Security News 2012 Homeland Security Awards Program officially opened for entries on May 1, once again featuring 45 Awards in three broad Categories:Best Vendors of IT Security Products and Solutions, Best Vendors of Physical Security Products and Solutions and the 2011 Government Excellence Awards.

Returning as corporate Sponsors of the 2012 Program are BRS Laboratories of Houston, TX -- a leading software development company for video behavioral recognition software that deploys easily and rapidly on large scale video networks and provides actionable information without inundating end users with false alarms -- and Entrust, Inc. , of Dallas, TX, which offers physical/logical access, mobile security, certificate management and other identity-based solutions to governments and large enterprises.  Additional sponsors will be announced, and profiles of all 2012 sponsors, will be published in coming weeks. Companies interested in joining the ranks of sponsors of the 2012 Awards Program should contact GSN Publisher and World Business Media President, Edward Tyler, at 212-344-0759, ext. 2001.

The cost to submit an entry in the 2012 program is $295 for vendors of IT security and physical security products and solutions. As in previous years, there is no cost for entries in the 10 categories of awards for federal, state and local government agencies. Vendors of IT and physical security products and solutions may nominate themselves or be nominated by colleagues or government clients, while government agencies or departments may similarly nominate themselves or be nominated by other agencies, colleagues or vendors.

According Adrian Courtenay, managing partner of World Business Media, several new categories created in 2011 to acknowledge successful initiatives of federal, state or local agencies in responding to emergencies, countering terrorism and preventing crime will again be included in 2012. These categories are “Most Notable Emergency Response Implementation – Federal, State or Local”; “Most Notable Law Enforcement Interdiction, Arrest or Counter Terrorism Program – Federal, State or Local”; and “Most Notable Counter Terrorism or Crime Prevention Program”.

In the 2011 contest, the Bastrop Country, TX, Unified Command (including county, state and federal government agencies) was awarded the trophy for “Most Notable Emergency Response Implementation” in battling 2011 Texas wildfires in Bastrop County. The United States Customs and Border Protection, Detroit Sector, was winner in the “Most Notable Law Enforcement Interdiction or Arrest” category for a dramatic arrest on St. Clair River in Detroit, and the Los Angeles Police Department was recognized for having the “Most Notable Law Enforcement Counter Terrorism or Crime Prevention Program.”

Another category that was new in 2011, “Most Notable Cyber Security Program or Technology – Government or Military”, will also be continued, in recognition of the emergence of Cyber Security as a vitally important component of overall security for any nation. The winner of this award in 2011 was the National Oceanic and Atmospheric Administration.

The 2012 Awards Program will once again culminate with a gala awards dinner in the fall, at a venue to be announced shortly. In the 2011 program, the “GSN/Raytheon Award for Distinguished Leadership and Innovation” was introduced and presented to Admiral Thad Allen (US Coast Guard-ret.), who came out of retirement twice in recent years to serve his country, first in heading up the federal response to Hurricanes Katrina and Rita, and later in managing the response to the Deepwater Horizon oil spill in the Gulf of Mexico.

In remarks for the 2011 Awards Dinner audience, Admiral Allen said the continuing work of technology companies and first responders was key in any disaster. He urged everyone to become a “lifelong rapid learner” to better cope with disasters, both man-made and natural. He also said “reconciling opportunity and competency” when disaster strikes is essential to any effective recovery, and being on top of the latest, most effective technology is a product of being a lifelong rapid learner. He also said clear communications is also a key to effective response and amplified his call for a nationwide interoperable first responder radio network. 

Photos of the 2010 awards reception and dinner are available at www.flickr.com/photos/[email protected]/, and video interviews with Admiral Allen, as well as sponsors and winners in the 2011 Awards program, are available at the GSN Video Center at www.gsnmagazine.com/videocenter.

Entry forms and other information about the 2012 Awards Program are available at www.gsnmagazine.com/hsa2012/welcome.

GSN 2011 Awards Program opens for entries on April 26

Government Security News has announced that its 2011 Homeland Security Awards Program  will officially open for business and start accepting entries in the program’s 45 awards categories on Tuesday, April 26.

The 2011 program contains a number of exciting new categories, reflecting the dynamically changing threat environment, in all three of the overall awards groupings: Best Vendors of IT Security Products and Solutions, Best Vendors of Physical Security Products and Solutions, and the 2011 Government Excellence Awards.

The cost for each entry in the 2011 program is $295 for vendors of IT security and physical security products and solutions. As in previous years, there is no cost for entries in the 10 categories of awards for federal, state and local government agencies.

Vendors of IT and physical security products and solutions may nominate themselves or be nominated by colleagues or government clients, while government agencies or departments may similarly nominate themselves or be nominated by other agencies, colleagues or vendors.

Adrian Courtenay, Managing Partner of GSN’s parent company, World Business Media, LLC, cited two intriguing new categories in the government sector that have been selected to acknowledge solid “boots on the ground” achievements of federal, state or local agencies in responding to emergencies, countering terrorism and stopping crime. These categories are “Most Notable Emergency Response Implementation – Federal, State or Local” and “Most Notable Law Enforcement Interdiction, Arrest or Counter Terrorism Program – Federal, State or Local.”

Acknowledging the increasing importance of cyber security and the threat of cyber war among nation-states, Courtenay also pointed out that the government awards in 2010 have been expanded to include a category titled, “Most Notable Cyber Security Program or Technology – Government or Military.”

Returning for its third year as a sponsor of the GSN Awards Program is founding sponsor ArcSight, now a business unit of Hewlett Packard Software and Solutions, whose enterprise threat and risk platform is an integrated product for collecting, analyzing and assessing security and risk information. ArcSight is also a repeat winner in the GSN awards program for its Security Incident Event Management (SIEM) products for collecting, analyzing and assessing security incident event information.

Also returning as event sponsors are General Dynamics C4, located in Phoenix, AZ, a major developer and integrator of secure communications and information systems and technology; and  Mutualink, another GSN award winner, which creates networks of interoperable communities that can instantly share radio, voice, text, video and data files, and telephone communications in a secure environment.

The fourth and final sponsor to date in the 2011 Awards Program is Behavioral Recognition Systems, Inc., of Houston, TX, also known as BRS Labs, whose software uses the fascinating, scientifically developed cognitive reasoning and artificial intelligence of behavioral analytics to leverage a stream of intelligence from millions of surveillance cameras worldwide, in order to provide alerts regarding abnormal or suspicious behavior.

Profiles of each of the 2011 sponsors will be posted on the GSN Web site in the coming weeks.

Additional companies or organizations interested in joining the ranks of 2011 sponsors of the GSN 2011 Homeland Security Awards Program should contact GSN Publisher and World Business Media President, Edward Tyler, at 212-344-0759, ext. 2001.

According to Courtenay, the 2011 Awards Program will culminate with the annual awards dinner in early November at a venue to be announced shortly. “It’s going to be hard to top last year’s elegant dinner and spectacular after-dinner keynote presentation by four-star General Barry McCaffrey (USA-Ret.). But we’re going to try!”

In 2010, the GSN awards were presented to a sold-out ballroom at the JW Marriott Hotel in Washington, DC, that included many distinguished government and military officials, academics, law enforcement and public safety professionals from across the country, along with the systems integrators, defense contractors and vendors of products and solutions used in homeland security.

Photos of the 2010 awards reception and dinner are available at:

www.flickr.com/photos/[email protected]/.

Further information and entry forms for the 2011 Awards Program are available at:

www.gsnmagazine.com/hsa2011/welcome.

OzVision

Alan Avidan, President, indicates that OzVision is pushing the forefront of hosted video services for dealers and users. The company’s government market includes military bases, government facilities, and national monuments such as the Washington Monument, the State of Liberty and Ford’s Theater. Avidan calls for dealers and central services to join in the hosted video movement, which he describes as the future of the industry.

VideoIQ

Scott Schnell, CEO, describes Video IQ’s next generation of video surveillance, where each of its high-definition cameras has video analytics plus half a year of storage with the camera itself, thus eliminating the high cost of storage and networking. According to Schnell, VideoIQ’s cameras with high-definition sensors can track up to 24 objects simultaneously and have 3X the field of view of conventional high-definition cameras with analytics.
Place on: Home Page, Aviation/Port Security, Border Security, Infrastructure Protection, Law Enforcement. First Responders, Maritime/Port Security, Perimeter Protection, Video Surveillance

T3 Motion

Gary Joubert, VP of Sales and Marketing, reports that T3 provides electric vehicles for law enforcement that are used in almost every police department in the U.S., as well as in government agencies around the world. Other markets for the made-in-the-USA T3 series include the military, general transport and the private security business. Recent improvements have been well received, and business is great!

Obama seeks three percent hike in discretionary budget at DHS

Despite official murmurings a few months ago that the fiscal year 2011 budget request for DHS might decline slightly, the budget package unveiled on February 1 actually shows a three percent increase in “discretionary spending” by DHS in 2011, versus the prior year, and modest growth, at approximately the predicted rate of inflation, in the outer years.

“The total fiscal year 2011 budget request for DHS, including fee funded and mandatory spending, is $56.3 billion, a two percent increase over the fiscal year 2010 enacted level,” said Peggy Sherry, the acting  chief financial officer at DHS, in a telephone conference call with journalists on February 1. “The department’s fiscal year 2011 net discretionary or appropriated funding request is $43.6 billion, an increase of three percent over the fiscal year 2010 enacted level.”

In releasing his overall budget request, President Obama proposed a freeze in government spending for a portion of the discretionary domestic spending plan for three years, but he specifically exempted homeland security expenditures from that freeze. “It won’t apply to our national security – including benefits for veterans,” said Obama in remarks he made in the White House on February 1.

Some observers speculated that the slight bump up in DHS spending may have resulted from the nationwide trauma caused by the failed Christmas Day underwear bombing attempt, and the urgent call for stronger screening measures at the country’s airports. However, a DHS official who participated on the conference call with journalists, but requested anonymity, would not attribute the budget increase to that terrorist attack.

“As part of the budget process, we examined different scenarios and options,” explained the official. “Those are discussions that are internal to the Administration and what you see in the budget release today is the end product of all those budget deliberations.”

Among the thousands of individual line-items for specific programs and planned procurements are the following highlights:

Advanced imaging systems – The 2011 budget requests an additional $214.1 million to install about 500 extra advance imaging technology machines at airport checkpoints, above and beyond the 500 systems that had already been planned. These funds will place such whole body scanners in 75 percent of the country’s largest airports, said Sherry.

Explosive detection – Beyond body scanners, DHS will seek an additional $85 million to bolster international flight coverage by federal air marshals, an increase in $60 million for an additional 800 explosive trace detection machines and a $71 million bump up to pay for an additional 275 K-9 teams at airport check points.

Border Patrol – The new budget envisions a decrease of 180 personnel in the ranks of the Border Patrol, which will be achieved largely through attrition. A DHS official suggested that the overall operating effectiveness of the Border Patrol will not be affected by this decline in personnel slots because the Border Patrol has almost doubled in size during the past five years. “A lot of the agent workforce, the substantial portion of it, has only a couple of years experience,” said this DHS official. “As they become more seasoned and more mature in their jobs, their effectiveness will increase, and because we are not doing the extensive hiring of 2,000 to 3,000 new agents a year, we can afford to put less into training improvement.”

Cyber-security – By contrast, DHS is planning a substantial beef-up in its cyber-security efforts. The new budget seeks $379 million to develop the National Cyber Security Division, which will attempt to safeguard the dot.gov and dot.com domains, and limit the nation’s vulnerability to computer attacks. DHS wants to add another $5 million to the $5 million that was in last year’s budget for the National Cyber Security Center, which one DHS official characterized as “still in its infancy.” The budget envisions an increase in the Center’s staffing to 40 people and the enhancement of its expertise, so it can integrate with other cyber-centers throughout the federal government.

Terror trials – Contrary to media reports that a terror trial in Manhattan might require a billion dollars in security measures, the 2011 budget request for DHS includes only $200 million for such security measures, which would be available through the traditional urban area grant programs. “The department took a look at it and we think $200 million is really our best estimate of the costs,” said the DHS official.

Federal contracting – In what it calls “re-balancing the workforce,” DHS is planning to rely less on outside vendors and more on internally recruited and trained personnel, particularly in the areas of cyber-security --  where DHS is authorized to hire as many as 1,000 new cyber-specialists – and the intelligence work often referred to as “connecting the dots.” “In our analysis and operations activity, we have a major increase in the number of feds doing intelligence type work,” said Sherry.

Coast Guard – A DHS fact sheet issued by the Office of Management and Budget points out that the budget request includes $538 million for a fifth National Security Cutter and $240 million to produce four new Fast Response Cutters. Even so, the new budget seeks funds for 1,100 fewer active duty Coast Guard personnel. “We are looking to reorganize and restructure certain elements of the Coast Guard to create greater efficiency,” explained a DHS official, “and there are obviously tradeoffs made as part of that to ensure we could continue to recapitalize the Coast Guard.”

President Obama’s budget request was delivered to Capitol Hill and will now undergo months of scrutiny by lawmakers. Fiscal year 2011 begins officially on October 1, 2010.

Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

On January 5, 2017, the U.S. Department of Commerce and the U.S. Department of Homeland Security released a draft report to President Trump in response to the Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure issued on May 11, 2017.

The report, which was created with broad input from stakeholders and experts, summarizes the opportunities and challenges in reducing the botnet threat, and offers supporting actions to be taken by both the government and private sector in order to reduce the threat of automated cyber-attacks.

Alert (TA18-004A) Meltdown and Spectre Side-Channel Vulnerability Guidance

Systems Affected

CPU hardware implementations

Overview

On January 3, 2018, the National Cybersecurity and Communications Integration Center (NCCIC) became aware of a set of security vulnerabilities—known as Meltdown(link is external) and Spectre(link is external)— that affect modern computer processors. Exploitation of these vulnerabilities could allow an attacker to obtain access to sensitive information.

Description

CPU hardware implementations are vulnerable to side-channel attacks referred to as Meltdown and Spectre. Meltdown is a bug that "melts" the security boundaries normally enforced by the hardware. Meltdown affects desktops, laptops, and cloud computers.  Spectre is a flaw that an attacker can exploit to force a program to reveal its data. The name derives from speculative execution—an optimization method a computer system performs to check whether it will work to prevent a delay when actually executed. Spectre affects almost all devices including desktops, laptops, cloud servers, and smartphones. Many of these security issues are remediated through the Kernel Address Isolation to have Side-channels Efficiently Removed (KAISER) patch described in detail in an academic paper named “KASLR is Dead: Long Live KASLR.” While this paper identifies a fix for Linux operating systems, the exploit concepts in the article can apply to other operating systems.

More details of these attacks are described in detail by

Impact

An attacker can gain access to the system by establishing command and control presence on a machine via malicious Javascript, malvertising, or phishing. Once successful, the attacker’s next attempt will be to escalate privileges to run code on the machine. Running code will allow the attacker to exploit the Meltdown and Spectre vulnerabilities. Sensitive information could be revealed from a computer’s kernel memory, which could contain keystrokes, passwords, encryption keys, and other valuable information.

Solution

NCCIC encourages users and administrators to refer to their hardware and software vendors for the most recent information. In the case of Spectre, the vulnerability exists in CPU architecture rather than in software, and is not easily patched; however, this vulnerability is more difficult to exploit. 

MICROSOFT

Microsoft has temporarily halted updates for AMD machines. More information can be found here: https://support.microsoft.com/en-us/help/4073707/windows-os-security-update-block-for-some-amd-based-devices(link is external)

For machines running Windows Server, a number of registry changes must be completed in addition to installation of the patches.  A list of registry changes can be found here: https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution(link is external)

ANTIVIRUS

Microsoft has recommended that third-party antivirus vendors add a change to the registry key of the machine that runs the antivirus software. Without it, that machine will not receive any of the following fixes from Microsoft:

  • Windows Update
  • Windows Server Update Services
  • System Center Configuration Manager 

More information can be found here: https://support.microsoft.com/en-us/help/4072699/january-3-2018-windows-security-updates-and-antivirus-software(link is external).

MITIGATION

Mitre has published Common Vulnerability and Exposure (CVE) notes for Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753 and CVE-2017-5715).

NCCIC recommends administrators review CISCO TALOS Snort SIDs: 45357 – 45368  and apply the necessary updates. These twelve rules were released as an emergency update on January 4, 2018, to cover the detection of Meltdown and Spectre side-channel vulnerabilities, and relate to CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754. These signatures cover the specific proofs of concept and sample code outlined in the Spectre and Meltdown whitepapers. While these signatures have the potential to detect variants, they may not work for all cases.

The table provided below lists available advisories and patches. As patches and firmware updates continue to be released, it is important to check with your hardware and software vendors to verify that their corresponding patches can be applied, as some updates may result in unintended consequences. Note:Download any patches or microcode directly from your vendor’s website.

NCCIC recommends using a test environment to verify each patch before implementing.

After patching, performance impacts may vary, depending on use cases. Administrators should ensure that performance is monitored for critical applications and services, and work with their vendor(s) and service provider(s) to mitigate the effect, if possible.

Additionally, users and administrators who rely on cloud infrastructure should work with their CSP to mitigate and resolve any impacts resulting from host OS patching and mandatory rebooting.

 

Vulnerability Note VU#584653

__________________________________________

CPU hardware vulnerable to side-channel attacks

__________________________________________

 

 

 

 

Overview

CPU hardware implementations are vulnerable to cache side-channel attacks. These vulnerabilities are referred to as Meltdown and Spectre.

Description

Note: This Vulnerability Note is the product of ongoing analysis and represents our best knowledge as of the most recent revision. As a result, the content may change as our understanding of the issues develops.

CPU hardware implementations are vulnerable to side-channel attacks referred to as Meltdown and Spectre. Both Spectre and Meltdown take advantage of the ability to extract information from instructions that have executed on a CPU using the CPU cache as a side-channel. These attacks are described in detail by Google Project Zero, the Institute of Applied Information Processing and Communications (IAIK) at Graz University of Technology (TU Graz) and Anders Fogh. The issues are organized into three variants:

  • Variant 1 (CVE-2017-5753, Spectre): Bounds check bypass
  • Variant 2 (CVE-2017-5715, also Spectre): Branch target injection
  • Variant 3 (CVE-2017-5754, Meltdown): Rogue data cache load, memory access permission check performed after kernel memory read

Spectre

Spectre attacks take advantage of a CPU's branch prediction capabilities. Modern CPUs include a feature called branch prediction, which speculatively executes instructions at a location that the CPU believes it will branch to. Such speculative execution helps to more fully utilize the parts of the CPU, minimizing the time waiting, and therefore improving performance. When a branch is successfully predicted, instructions will retire, which means the outcomes of the instructions such as register and memory writes will be committed. If a branch is mispredicted, the speculatively-executed instructions will be discarded, and the direct side-effects of the instructions are undone. What is not undone are the indirect side-effects, such as CPU cache changes. By measuring latency of memory access operations, the cache can be used to extract values from speculatively-executed instructions.

With Spectre variant 1 (CVE-2017-5753), the instructions after a conditional branch are speculatively executed as the result of a misprediction. With Spectre variant 2 (CVE-2017-5715), the CPU executes instructions at a location determined by a mispredicted branch target.

With both variants of the Spectre attack, the impact is that a process may leak sensitive data to other processes on a system. Spectre may also allow one part of an application to access other parts of the same process memory space that would otherwise not be permitted.

While the Spectre attack itself does not cross a user/kernel memory privilege boundary, depending on the configuration of the target platform, the Spectre attack may indirectly allow a user-space application to access kernel memory. For example, the Project Zero blog post describes a scenario that uses eBPF to exfiltrate kernel memory contents into user-space code. This is made possible because eBPF JIT allows for userspace applications to inject code that is executed in kernel space. While this code is verified by the kernel, eBPF-compliant code will be allowed to execute with kernel permissions. The exploit described by Project Zero leverages eBPF to execute the Spectre attack in kernel space, while exfiltrating the data to user space. It is possible that other technologies that allow in-kernel code execution may also possibly be leveraged to leak kernel memory using Spectre.

Meltdown

Meltdown is related to the Spectre attack in that it also uses a cache side channel to access data that otherwise wouldn't be available. The main difference is that it leverages out-of-order execution capabilities in modern CPUs. Like speculative execution due to branch prediction, as used by Spectre, out-of-order execution on a CPU is a technique for ensuring fullest utilization of the CPU's parts. Although instructions may appear sequentially in the machine language, a CPU that supports out-of-order execution may execute instructions in a non-sequential manner, which can minimize the time that a CPU spends idle.

Meltdown leverages insecure behavior that has been demonstrated in Intel CPUs and may affect CPUs from other vendors. Vulnerable CPUs allow memory reads in out-of-order instruction execution, and also contain a race condition between the raising of exceptions and the out-of-order instruction execution. The Meltdown attack reads a kernel memory value, which raises an exception because code running with user-space privileges are not permitted to directly read kernel memory. However, due to the race condition, out-of-order instructions following the faulting instruction may also execute. Even though instructions appear after the faulting instruction, out-of-order execution allows them to execute, using data retrieved from the instruction that raises the exception. By the time the exception is raised, some number of out-of-order instructions have executed. Although the raised exception causes the CPU to roll back the out-of-order instructions, the cache state is not reverted. This allows data from out-of-order instructions to persist beyond the point when the exception has been raised.

The impact of Meltdown is that a process running in user space is able to view the contents of kernel memory. Meltdown may also allow Spectre-like memory content leaking that does not cross the user/kernel privilege boundary.

The Linux kernel mitigations for Meltdown are referred to as KAISER, and subsequently KPTI, which aim to improve separation of kernel and user memory pages. Because the Spectre attacks do not cross user/kernel boundaries, the protections introduced with KAISER/KPTI do not add any protection against them.

 

 

Impact

An attacker able to execute code with user privileges can achieve various impacts. The Meltdown attack allows reading of kernel memory from userspace. This can result in privilege escalation, disclosure of sensitive information, or it can weaken kernel-level protections, such as KASLR. The Spectre attack can allow inter-process or intra-process data leaks.

To execute code locally, an attacker would require a valid account or independent compromise of the target. Attacks using JavaScript in web browsers are possible. Multi-user and multi-tenant systems (including virtualized and cloud environments) likely face the greatest risk. Systems used to browse arbitrary web sites are also at risk. Single-user systems that do not readily provide a way for attackers to execute code locally face significantly lower risk.

 

 

 

Solution

Apply updates

Operating system, CPU microcode updates, and some application updates mitigate these attacks. Note that in many cases, the software fixes for these vulnerabilities will have a negative affect on system performance. Also note that Microsoft Windows systems will no longer receive security updates via Windows Update if they are not running compliant anti-virus software. As with deploying any software updates, be sure to prioritize and test updates as necessary.

Consider CPU Options

Initial reports from the field indicate that overall system performance is impacted by many of the available patches for these vulnerabilities. Depending on the software workflow and the CPU capabilities present, the performance impact of software mitigations may be non-trivial and therefore may become an ongoing operational concern for some organizations. While we recognize that replacing existing CPUs in already deployed systems is not practical, organizations acquiring new systems should evaluate their CPU selection in light of the expected longevity of this vulnerability in available hardware as well as the performance impacts resulting from the various platform-specific software patches. Deployment contexts and performance requirements vary widely, and must be balanced by informed evaluation of the associated security risks. Contact your system vendor to determine if the CPU and operating system combination will experience a performance penalty due to software mitigations for these vulnerabilities.

New Crystal Group RACE™ accelerates autonomous vehicle development

HIAWATHA, Iowa, Jan. 17, 2018 -- Crystal Group Inc., a leading designer/manufacturer of rugged computer hardware for industry and defense, is introducing the first product in the new Crystal Group RACE™ (Rugged Autonomous Computer Equipment) line, engineered to accelerate autonomous vehicle (AV), automated driving system (ADS), and unmanned (UAV) projects. The Crystal Group RACE0161 high-performance, rugged computer is specifically designed to help engineers shorten development time, bringing autonomous vehicle innovations to market ahead of their competitors. The fast-paced autonomous industry is estimated to be worth trillions of dollars.

Autonomous driving technology is quickly ushering in a new economy predicted to achieve unprecedented growth and reach $7 trillion by 2050, according to a new study by Intel Corporation and Strategy Analytics. Crystal Group and Intel have partnered together to provide autonomous solutions for several leading OEM's to date. The partnership will continue to tap the booming autonomous market with leading edge technology of Crystal Group's new RACE offerings.

Crystal Group's latest autonomous vehicle computer provides the horsepower AV and ADS projects need, combining robust I/O, multiple GPU capacity, dual Intel® Xeon® Scalable Processors, sophisticated thermal management, and other high-quality components stabilized in a rugged, aluminum enclosure measuring just 6.5 x 14.1 x 15.6 inches and weighing 30 to 40 pounds. Processing real-time data of LIDAR, RADAR, image, and sensor fusion, the Crystal Group RACE0161 combines impressive compute power, data-handling capabilities, and storage capacity in a compact, rugged solution capable of withstanding harsh environmental conditions, including potholes, collisions, and extreme temperatures that are likely to cause traditional systems to fail.
"The new RACE0161 and the entire line of Crystal Group RACE™ products ease AV and ADS development and give our customers the advantage of quick time-to-market with a safe, reliable, high quality AV solution," Crystal Group Executive Vice President of engineering, Jim Shaw says. "Our RACE solutions leverage decades of experience engineering rugged, reliable compute solutions for US and international military programs, as well as some of the world's largest car manufacturers," adds Shaw.

Crystal Group RACE systems are built for safety and reliability, tapping 30 years of experience tailoring high-performance, fail-safe rugged hardware for hundreds of military and aerospace missions, as well as challenging industrial, critical infrastructure, and commercial programs, including some of the hottest OEM autonomous vehicles. Crystal Group also offers its award-winning RS363S15F 3U Rugged Server, designed and developed in collaboration with Intel®, for use in autonomous vehicles.

About Crystal Group Inc.
Crystal Group Inc., a technology leader in rugged computer hardware, specializes in the design and manufacture of custom and commercial off-the-shelf (COTS) rugged servers, embedded computing, networking devices, displays, power supplies, and data storage for high reliability in harsh environments. An employee-owned small business founded in 1987, Crystal Group provides the defense, government and industrial markets with in-house customization, engineering, integration, configuration management, product lifecycle planning, warranty, and support services.

Crystal Group products meet or exceed IEEE, IEC, and military standards (MIL-STD-810, 167-1, 461, MIL-S-901); are backed by warranty (5+ year) with in-house support; and are manufactured in the company's Hiawatha, Iowa, USA, facility certified to AS9100C:2009 and ISO 9001:2008 quality management standards.
© 2018 Crystal Group Inc.  All rights reserved. All marks are property of their respective owners. Design and specifications are subject to change.
SOURCE Crystal Group Inc.

Pages

 

Recent Videos

HID Global is opening the door to a new era of security and convenience.  Powered by Seos technology, the HID Mobile Access solution delivers a more secure and convenient way to open doors and gates, access networks and services, and make cashless payments using phones and other mobile devices. ...
Mobile device forensics can make a difference in many investigations, but you need training that teaches you how to get the most out of your mobile forensics hardware and software, and certifies you to testify in court. Read this white paper to learn how to evaluate mobile forensics training...
PureTech Systems is a software company that develops and markets PureActiv, its geospatial analytics solution designed to protect critical perimeters and infrastructure.  Its patented video analytics leverage thermal cameras, radars and other perimeter sensors to detect, geo-locate, classify, and...
PureTech Systems is a technology leader in the use of geospatial video, focusing on perimeter security.  When combining geospatial capabilities with video analytics and PTZ camera control, managers of critical facilities can benefit by allowing the video management system to aid them in the process...