“As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This certificate allows us to impersonate any website on the Internet, including banking and e-commerce sites secured using the HTTPS protocol.”

I wrote a program to look through the trusted certs that came with Firefox 3.0.4 for any CAs with MD5 signature algorithms.

[snip]

UPDATE: the list was not relevant because of a feature of the attack (thanks Thomas). Apparently “only RapidSSL and FreeSSL are practically vulnerable”

UPDATE 2: VeriSign responds, no longer possible with RapidSSL. And they’ve been phasing MD5 out across the board.

Workshop scope:

Virtualization has proven to be a powerful enabler in the field of distributed computing and has led to the emergence of the cloud computing paradigm and the provisioning of Infrastructure-as-a-Service (IaaS). This new paradigm raises challenges ranging from performance evaluation of IaaS platforms, through new methods of resource management including providing Service Level Agreements (SLAs) and energy- and cost-efficient schedules, to the emergence of supporting technologies such as virtual appliance management.

For the last three years, the VTDC workshop has served as a forum for the exchange of ideas and experiences studying the challenges and opportunities created by IaaS/cloud computing and virtualization technologies. VTDC brings together researchers in academia and industry who are involved in research, development and planning activities involving the use of virtualization in the context of distributed systems, where the opportunities and challenges with respect to the management of such virtualized systems is of interest to the ICAC community at large.

Important dates:

• Submission deadline: February 20th, 2009
• Notification of acceptance: March 23rd, 2009
• Final manuscripts due: April 6, 2009
• Workshop: June 15, 2009

Topics:

Authors are invited to submit original and unpublished work that exposes a new problem, advocates a specific solution, or reports on actual experience. Papers should be submitted as full-length 8 page papers of double column text using single space 10pt size type on an 8.5×11 paper. Papers will be published in the proceedings of the workshop. VTDC 2009 topics of interest include, but are not limited to:

• Infrastructure as a service (IaaS)
• Virtualization in data centers
• Virtualization for resource management and QoS assurance
• Security aspects of using virtualization in a distributed environment
• Virtual networks
• Virtual data, storage as a service
• Fault tolerance in virtualized environments
• Virtualization in P2P systems
• Virtualization-based adaptive/autonomic systems
• The creation and management of environments/appliances
• Virtualization technologies
• Performance modeling (applications and systems)
• Virtualization techniques for energy/thermal management
• Case studies of applications on IaaS platforms
• Deployment studies of virtualization technologies
• Tools relevant to virtualization

Organization:

General Chair:

• Kate Keahey, University of Chicago, Argonne National Laboratory

Program Chair:

• Renato Figueiredo, University of Florida

Steering Committee Chair:

• Jose A. B. Fortes, University of Florida

Program Committee:

• Franck Cappello, INRIA
• Jeff Chase, Duke University
• Peter Dinda, Northwestern University
• Ian Foster, University of Chicago, Argonne National Laboratory
• Sebastien Goasguen, Clemson University
• Sverre Jarp, CERN
• John Lange, Northwestern University
• Matei Ripeanu, University of British Columbia
• Paul Ruth, University of Mississippi
• Kyung Ryu, IBM
• Chris Samuel, Victorian Partnership for Advanced Computing
• Frank Siebenlist, Argonne National Laboratory
• Dilma da Silva, IBM
• Mike Wray, HP
• Dongyan Xu, Purdue University
• Mazin Yousif, Avirtec
• Ming Zhao, Florida International University

Publicity Chair:

• Ming Zhao, Florida International University

For more information:

VTDC-09 Web site: http://grid-appliance.org/vtdc09
ICAC-09 Web site: http://icac2009.acis.ufl.edu

[via Stephen Spector]

The main new features provided in this release are tools facilitating the deployment, configuration and management of clouds. We also updated our implementation to match the current Amazon EC2 deployment. In addition, the release contains new documentation and bug fixes.

You can download the new release from:
http://workspace.globus.org/downloads/index.html

The full changelog can be found here:
http://workspace.globus.org/vm/changelog.html#TP2.1

Windows in the Cloud? Been there, done that!

GoGrid has already almost a year of proven experience providing Windows Server 2003/2008 to end users… we are also a Microsoft Gold Certified Partner.

We are pleased to announce GridShib for Globus Toolkit v0.6.1:

http://gridshib.globus.org/downloads/gridshib-gt-0_6_1-src.tar.gz
http://gridshib.globus.org/downloads/gridshib-gt-0_6_1-src.zip

Please visit the GridShib for GT home page for an introduction and links to software and documentation:

http://gridshib.globus.org/docs/gridshib-gt-0.6.1/

This version of GridShib for GT is primarily a bug fix release. There is one new feature, and that is, a refactoring of the blacklisting framework that now permits the blacklisting of identity attributes (such as e-mail addresses) in addition to IP addresses and SAML name identifiers. See the CHANGES file for a complete list of changes in this version:

http://gridshib.globus.org/docs/gridshib-gt-0.6.1/CHANGES.txt

Along with GridShib SAML Tools v0.5.0, version 0.6.1 of GridShib for GT will be included in a Capability Kit to supplement the Coordinated TeraGrid Software and Services (CTSS) stack. This is the next step in a focused effort to deploy GridShib software at both the science gateways and resource providers throughout the TeraGrid. This work is funded by the NSF TeraGrid Grid Integration Group through a sub-award to NCSA.

Thank you for your continued support of GridShib!

In a followup post to some apparent misinformation being spread (Microsoft executive “rebuts” our research!), I was surprised by this comment:

Interestingly, if Mr. Riley only attended our Xen 0wning Trilogy at Black Hat, then he would notice that we were actually very positive about Hyper-V. Of course, I pointed out that Xen 3.3 certainly has a more secure architecture right now, but I also said that I knew (from talking to some MS engineers from the virtualization group) that Hyper-V is going to implement similar features in the next version(s) and that this is very good. I also prized the fact it has only about 100k LOC (vs. about 300k LOC in Xen 3.3).

Xen 3.3 has grown to 300k lines of code for the hypervisor?

At what point does the “tight security auditability” argument start to exponentially diminish for hypervisors in ring 0?

Quoting from http://gist.github.com/7263

#!/usr/bin/env ruby
# gcalc  / 26aug2008 chneukirchen / public domain
require ‘open-uri’
q = ARGV.join(” “).gsub(/./m) { “%%%02X” % $&[0] }
html = open(”http://www.google.com/search?q=#{q}”).read
puts (html[%r{(.*?)}, 1] || ‘not a calculation’).
gsub(%r{240| }, “”).gsub(”×”, “x”).
gsub(%r{(.*?)}, ‘^\1 ‘) 

(tip via HubbuH)

From http://vcl.ncsu.edu/:

The Virtual Computing Lab (VCL) is a remote access service that allows you to reserve a computer with a desired set of applications for yourself, and remotely access it over the Internet.

You can use all your favorite applications such as Matlab, Maple, SAS, Solidworks, and many others. Linux, Solaris and numerous Windows environments are now available to all NC State students and faculty.

Leasing custom environments to “public-ish” users via PXE or similar technology was happening in other places in 2004, but I never saw anything at this scale.

It is clear that some kind of reconfiguration/resetting happens:

What rights do I have on the VCL machine?

On custom Windows and Linux environments you have adminstrative and root level rights. Since the VCL system reloads each expired reservations with a clean environment, there is no threat of any residual data being left on a machine for the next user.

On Linux and Solaris Lab machine environments, you only have user level rights. The same premissions as you would experience at the console of a walk-in lab.

I wonder when they added the VM support mentioned at http://vcl.ncsu.edu/help/general-information/how-it-works:

The management nodes each control a subset of the VCL resources. These can be blades, virtual machines or lab machines. Currently, a set of individual blades or virtual machines can only be managed by a single management node. Typically there are anywhere from 80-120 physical computer nodes (blades) under one management node. Again the physical computer nodes can either be running a bare metal environment or a Virtual Machine hypervisor.

Here are deployment stats captured on Aug 25, 2008:

• Total blades online: 438
• Total blades offline: 87
• Active Reservations: 49

Cool.

I was jetlagged, so I tried to read a little bit, learning about some of the deeper corners of the fantastic Spring framework:

Here you can see the northern end of this beautiful city.

I’ve been told several times that they “don’t see Americans too much in this part of the city” so I think I’ve landed in a good spot.

From: Stephen Childs
Subject: Survey on use of virtualization in production grids

Hi all,

Apologies for the slightly off-topic post. I am giving presentations soon on the use of virtualization in production grids and was thinking it might be nice to have some data to present!

I have set up a survey on the usage of virtualization in production grids at http://www.surveymonkey.com/s.aspx?sm=Sukm0sCdun6EAtpi7IXtwA_3d_3d

The survey will remain open until Friday August 29th. It shouldn’t take more than a few minutes to complete, and I think the results should be quite interesting for our community. I get the impression virtualization usage has rocketed in the last year, but haven’t seen any figures on uptake to date.

Please feel free to forward this to anyone else who may be interested in responding.

If you have any comments, please feel free to email me.

Stephen
–
Dr. Stephen Childs,
Research Fellow, EGEE Project, phone: +353-1-8961797
Computer Architecture Group, email: Stephen.Childs @ cs.tcd.ie
Trinity College Dublin, Ireland web: http://www.cs.tcd.ie/Stephen.Childs

Quoting from the Nimbus features page:

There are currently two supported remote protocol sets:

• WSRF based: protocol implementation in longstanding use by previous workspace services and clients including the cloud-client.
• EC2 based: clients written for EC2 can be used with Nimbus installations. For more information, see What is the EC2 frontend?

These protocols happen to both be Web Services based and both run in the Apache Axis based GT Java container. But neither thing is a necessity:

• There is nothing specific to web services based remote protocols in the workspace service implementation, the messaging system just needs to be able to speak to Java based libraries.
• Workspace service dependencies have nothing to do with what container it is running in, they are more “straight Java” style dependencies like Spring, ehcache, backport-util-concurrent, and JDBC (currently using the embedded Derby database).

Check out the changelog and the new FAQ.

Check out some screenshots here of Nimbus resources invovled in supporting this experiment. It’s a small part of things as you can see from the scope of the grid but exciting nonetheless. The AliEn based virtual cluster is now “one-click” and can be launched anywhere running a workspace cloud setup.

If you know anyone that may be interested in the job, please pass this announcement along. It seems like people reading here would have a good probability of knowing someone that may be interested and who also has the experience they are looking for.

Thanks

From http://www.csamuel.org/2008/07/28/vpac-job-grid-systems-administator-programmer

VPAC is looking for someone to join the systems team here to work on grid computing, including things like Shibboleth, SSL certificates, Globus and the like.

The Victorian Partnership for Advanced Computing Limited (VPAC) has a unique opportunity for a person to assist with the operation of a National Distributed Computing and Data Project. VPAC operates a range of large Linux HPC Systems primarily used for scientific research and is part of ARCS, the Australian Research Collaboration Service, building research infrastructure across Australia.

Reporting to the VPAC Operations Manager, you will be working primarily on Linux systems in a distributed computing environment. Specifically, you will be involved in a National Project to provide authentication and authorisation services, and separately, data services across Australia and be a part of the international grid effort. The ability to work with and support our end users (typically scientific researchers and software developers) is very important in this role. Some national and international travel may be involved.

You will gain experience in a range of cutting edge distributed computing technologies.

To be successful in this role you will need Linux (or Unix) experience. A degree in Computer Science or a closely related field would be highly advantageous but hands on Linux experience is essential. Experience in authentication, authorisation and distributed data is highly desirable.

Key Selection Criteria

- A good knowledge of UNIX or LINUX at a systems level.

- Some skills in programming or scripting Python, Perl, Java or similar.

- Good communication skills and an ability to deliver quality services to end users.

Gain bonus points with:

- Experience with authentication, authorisation, Shibboleth and/or distributed data.

- Experience with grid or distributed computing, Globus.

- Experience in building and packaging custom Linux systems.

- Experience in XEN, OpenSSL, X509 certificates, Web Services or similar.

Applicants with specific skills related to the above are strongly advised to mention their experience level with each (e.g, experienced, competent, interested beginner) in their application.

VPAC is an equal opportunity employer and offers an exciting opportunity in a modern work environment with excellent employment conditions and career progression opportunities.

Please send resumes, along with a cover letter and academic transcripts to recruitment@vpac.org. Applications close COB 11th AUGUST 2008.

“Though we’re proud of our operational performance in operating Amazon S3 for almost 2.5 years, we know that any downtime is unacceptable and we won’t be satisfied until performance is statistically indistinguishable from perfect.”

• http://workspace.globus.org/rss.xml

The cluster technology lets you bootstrap generic images into new network and security contexts on the fly. We built a sample cluster on top of the technology that lets you create the cluster and be immediately ready to submit jobs to a Torque cluster fronted by GRAM and GridFTP that use a newly created self-signed certificate:

1. cloud-client.sh –run –hours 12 –cluster base-cluster.xml

2. Wait a few minutes, once launched note the head-node hostname

3. scp -r root@HOSTNAME:certs/*  lib/certs/

   (SSH was bootstrapped end to end already)

4. Make sure your grid tools trust this certificate and then submit work

This can be done with nearly anything that can run on a non-virtual cluster. Check out these links for more information:

• http://workspace.globus.org/clouds/clusters.html
• http://workspace.globus.org/vm/TP1.3.3/index.html

On behalf of the Globus Toolkit development team I am pleased to announce that a new stable release of the Globus Toolkit is now available. GT4.2.0 contains an upgrade to the web services specifications used by the toolkit as well as new features in all services. New users are encouraged to use the 4.2.0 release. Existing users may wish to evaluate the new software while maintaining their existing installations; due to the specification upgrade, the webservices are incompatible with the 4.0.x series. Details on the spec upgrade are available in the release notes.

Relevant 4.2.0 links:

• Release notes: http://www.globus.org/toolkit/docs/4.2/4.2.0/rn/release_notes.html
• Software: http://www.globus.org/toolkit/downloads/4.2.0/
• Documentation: http://www.globus.org/toolkit/docs/4.2/4.2.0/

Thanks for your support of Globus software!

Charles

New Features!

• Persistent HTTP/S connection support in Java WS Core
• Dynamic deployment support in Java WS Core
• JBOSS 4.0.x support in Java WS Core
• An implementation of WS-ServiceGroup added to C WS Core
• C command-line tools for WSRF operations
• Support for GetResourceProperties and QueryResourceProperties in the

Delegation Service

• Added support for the OGSA-AuthZ Authorization Service to CAS
• Server-side attribute-based authorization framework enhancements
• Support for a pluggable Policy Decision Point (PDP) designed to minimize

common authorization errors

• Enhanced security descriptor framework
• A Web service interface for the Replica Location Service (RLS)
• Improved support for multiple TriggerRules in the Trigger Service
• Improved configuration interface for the Trigger Service
• Java API to assist in creating resource properties from external

information sources

• A new resource manager (RM) adapter API in GRAM4