Tatu Ylonen

Cybersecurity expert. Inventor of SSH - Secure Shell. Artificial intelligence, machine learning, linguistics, knowledge representation. 30+ US patents.

[Tatu Ylonen @tjssh]

.@tjssh SSH access to from DEV/TEST to PROD in a real mid-sized bank, violates segregation of duties (anonymized). https://t.co/BnUEYNHKXq

[Tatu Ylonen @tjssh]

I'm leaving this New Twitter. It was once a useful platform.

[Tatu Ylonen @tjssh]

I'll be talking with Sam Curry tomorrow in the webinar on the Future of Security. You are welcome to join! Please register at: https://t.co/toR7R0Zoio

[Tatu Ylonen @tjssh]

@antti_antinoja Even Linux sort is using 74GB to sort a trivial 78GB text file.

[Tatu Ylonen @tjssh]

When did it start to feel normal to run 50-150GB processes every few minutes?

[Tatu Ylonen @tjssh]

@Icelandair I am unhappy with your recent obfuscation of pricing and reduction of economy baggage allowance. Your wifi usually does not work. And if you think I'll pay $5-9k for your premium economy style Saga class seats, you must be out of your minds. I'm a Saga gold member.

[Tatu Ylonen @tjssh]

@TorstenBlum @bsdunix4ever @dersharky Sorry I've been away from twitter so very late answer... I think I tried to use same flags as used by rcp on systems I used... might be BSD at that time, not sure.

[CRN @CRN]

#Intel pledges more fixes against #Spectre And #Meltdown. Here's what you need to know about the latest updates:

[CRN @CRN]

Is it time to regulate #IoT devices? We talk to #cybersecurity experts @samjcurry and @tjssh about the rising threats of smart devices.

[SSH - Defensive Cybersecurity @SSH]

Want to see how future of Cloud Access for #DevOps? Visit @SSH booth in @CloudExpoEurope Stand: S2248 #CSE18 #security

[Tatu Ylonen @tjssh]

https://t.co/wPYpnyY5Oi & ISACA: SSH (Secure Shell) Practitioner guidelines. https://t.co/yyCZ6N8DCo #grc #infosec #isaca

[Tatu Ylonen @tjssh]

ISACA: SSH Practitioner guidelines. https://t.co/yyCZ6N8DCo #grc #infosec #isaca

[Tatu Ylonen @tjssh]

@io_r_us My current understanding is that the Meltdown attack is due to speculative execution affecting caches even when access is not permitted. HW flaw. Spectre is trickier, speculative execution affecting caches on branch prediction miss. I'm not yet sure how to universally solve it.

[Tatu Ylonen @tjssh]

@io_r_us It's been 15-20 years since I last wrote DMA device drivers, but my understanding is that the OS will usually map the (user/kernel) buffer to physical addresses before passing them to the DMA controller. (I'm not up to date on this)

[Tatu Ylonen @tjssh]

@io_r_us My understanding is that DMA usually works with real addresses (not virtual addresses) and can access all memory anyway. There are well-known attacks via PCI bus, firewire etc that utilize DMA. They can read & write kernel data&code, unlock screen saver, and take full control.

[Tatu Ylonen @tjssh]

It looks like the Intel attacks seriously affect end user systems as well and are remotely exploitable (Javascript, flash/client-side Java?). Can be injected to any unencrypted HTTP connection on the network or by corrupt server. Browser dependent. Email? https://t.co/TQD6SrxLFs

[Tatu Ylonen @tjssh]

@MalinaKirn Looks like you are right. This will be bad. Apparently the Javascript exploit might be used to read memory of the entire process. This could potentially be used to read passwords, secret keys, cookies, and other sensitive data for other sites (if all tabs in same process).

[Tatu Ylonen @tjssh]

@philchungny I'm not quite sure what you mean by bare metal cloud server without hypervisor. Presumably there is a provisioning system that accepts connections and commands (e.g., migrate, shutdown, configure). It authenticates the connection. Usually there is a credential or key to read.

[Tatu Ylonen @tjssh]

@CyberPlayGround If the attack works as I (and some other people) speculate, I think it is difficult to exploit from Java (or Javascript) VMs. I could be wrong. In any case, client-side Java (or flash) in browsers is getting rare/deprecated. Javascript exploit would be unpleasant.

[Tatu Ylonen @tjssh]

@io_r_us I hope the Russian specialist is right and its not affecting cloud hypervisors... I'm rather concerned it might be used to, e.g., read SSH keys from kernel I/O buffers from VMs, and therefore gain access to other VMs and possibly even the hypervisor. But details are scarce.

[Tatu Ylonen @tjssh]

The Intel speculative execution flaw appears serious and multiuser systems (especially public cloud hypervisors) MUST be patched quickly. End user systems and appliances appear largely unaffected (single user). Not remotely exploitable. Performance penalty from fix 5-30% or so.