Schneier on Security

Clive Robinson • December 31, 2009 4:54 PM

@ Canuck, Brandioch Conner, Hjohn,

“… given we cannot state the effectiveness of a measure”

We can (but not in the way you are thinking),

We know from past experiance in both natural and manmade treats, highly specific countermeasures only work against a very narrow class of threat.

Thus we can say without fear that inspecting shoes is only effective against shoe based attacks.

We can also say (with less certainty) for the same reasons that broad measures cover against considerably greater classes of threat (but not all classes of threat).

Thus we can say that scanning for certain chemicals will rule out a large number (but not all) types of explosive hidden in most (but not all) parts of human apparal.

I’m ignoring false positives as these can be dealt with in other ways.

This Broad -v- Specific is what we have with “fire escape drills” they work not just for fires but other types of threat such as bombs and biolocgical and nuke weapons including a number of other threats we have not yet seen or imagined.

“… who is to decide if the measure is really needed to begin with or should be kept?”

The simple answer is the person who can best analyse the cost.

With natural threats you can make rational calculations on where to spend your dollar.

Unfortunatly with human adverseries you cannot make rational calculations simply because they are very rare events that are dynamicaly adaptive against you.

We see from defense spending the only thing you know for certain is when you have not spent enough in the right places (you get attacked).

So my vote would be on broad measures not narrow specific measures.

As for the false positives, they might be anoying for the individual, but, actually they are the one bit of security theartr most people would respect.

We don’t like traffic cops pulling us over to inspect for “road safety” but we like to see the inspections happening to others because it makes us feel that road safety is being addressed as a problem.

The cops also quickly develop an impersonal and matter of fact style and get the job done as quickly as possible for those that help them. Those that hinder slow the process for both them and the cops so in the end it is self defeating.

It’s not and ideal process but importantly seeing people getting pulled over for further more detailed inspection adds one heck of a lot of uncertainty into any terrorist plan.

You could argue (but I’m not going to) that false positives help take the search process from purely determanistic to semi-random and thus adds some of the advantages of random testing.

Clive Robinson • January 2, 2010 1:36 AM

@ Hendrik,

“the more I read about this technology [Puffer Machines], the more I think it would’ve been a very good deterrent for this bomber… … than the millimeter-wave… ”

The problem is that the puffer machines are actualy a technology very much on the road to no where (not that millimeter wave is getting there much faster).

There are the obvious early technology reasons why (size, power consumption, slowness, impracticality of the overall design) that might with time be improved, as such that is not the problem.

There is the less obvious major achilles heal that cannot be resolved which is the fundemental idea behind it’s working is grossely mis-matched to what the proponents hope to achive.

The technology behind the Puffer is a follow on from the Chemical Agent Monitoring (CAM) systems developed for Nuke/Biological/chemical (NBC) warefare. And if used for that purpose the technology is a very good idea. Further it will with time improve once the likes of “quantum resonance spectography” (the way biological noses work) is made practical.

However the reason it is an good fit for NBC is also the reason it is a bad fit for screening people. That is the technology is looking for something to be present (one or more chemicals) Not the physical location or volume or physical mass of the chemicals.

The problem is many if not all the chemical sensors just say something is present not the quantity or where.

The levels these devices can detect are so small that they are now well down in the “noise floor” of naturaly occuring or background level of man made chemicals by a very large degree.

So potentialy the false positive rate is very high when looking for “broad chemical markers” such as nitrates.

Thus it goes for “specific chemicals” to try to change the “signal to noise ratio” and this is the wrong way to go.

That is the problem is made worse by trying to get around the ‘broad’ problem by being overly ‘specific’ (the real essence of Security Thearter).

Which unfortunatly gives rise to the same two problems we see with very much all Security thearter,

1, It is overly specific and can only be used for a very limited subset of the potential threats (ie chemicals available).

2, Because it only indicates prescence not location or volume/mass it is overly subject to DoS attacks.

The first issue is one all “specific” -v- “broad” techniques fail on (which is a problem I would have thought all security system designers should be fully cognicent with by now).

All you have to do is use a threat (explosive) that is not one of the (16 or so it detects) on the threat list.

The thing is that as any research chemist will tell you there are so many options available that testing for each one is an overly time consuming one, thus the numerical advantage is always going to be with the terrorist with ‘specific’ testing. (There are also other significant problems with “spectroscopy” which I’m not going to go into right now.)

The second issue is one that all time constrained que systems suffer from.

As an example all I have to do to get around the system is exploit the known problems of “queing theory” and “human nature”.

First I need a “legitimate supply” of chemicals the machine is known to respond to (the most obvious current contender is TNG medical spray used by those with heart conditions).

If I then find a suitable vantage point I simply spray the chemical into the air over the potential test subjects…

The result the machine makes many many positive findings, the number of persons that need further screening goes up dramaticaly the time constrained que becomes overloaded and human nature comes into effect (remember security thearter only works while the comercial revenue stream is not negativly effected).

In the short term (depending on what information the machine outputs and how subtal the attack you use is) either a fault will be suspected or the system will be seen as “to flakey to trust” and the machine ends up ignored partialy or fully.

This by the way is a “false false positive” attack. That is the machine is correctly detecting the chemical which is a “true positive” but the attacker does it in a way that makes it look like a system failure resulting in “false positive” deduction by the operators.

As an attacker you wait patiently for the point the system becomes so untrusted you can walk through with your payload…

This attack technique of making people think they have entered a “cry wolf” senario is almost as old as the hills sheep graze on and is used by the more astute criminals to get a security system they cannot bypass turned off.

In fact it is so old and so well known it is used not just as a plot line in thrillers but comedies as well (see Pink Panther / how to steal a million and other comedy Heist movies).

But importantly it still works (because of humans being… well human 😉 and is a way to “game the system” in your favour as a criminal.

As I mentioned earlier there are other problems with spectroscopy that allow such a system to be gamed even more effectively but I’ll let you put yourself in the “Hinky frame of mind” and do your own research on that one.

Just remember one very very important fact in life,

‘Where humans and money are involved a criminal has an opening’

That is ALL and I do mean all security systems with human involvment are gameable to an attackers advantage. No “ifs buts or maybes” on this I realy do mean ALL, every time we hear about the “latest big heist” you can make an almost certain bet it worked due to “human failings”.

It is why “security through obscurity” is still desirable in tanagable “physical world” systems (but fails miserably in the intangable non physical worlds of information etc).

There are only two solutions to the “human” problem that are known to work,

1, “remove the humans” from the control system.
2, “remove the humans” from the system being controled.

Hmm they are not likley to happen 😉

The other more uncertain (risky) solutions involve,

3, “remove the ‘specific’ system” and take the risk.
4, “remove the ‘specific’ system” from the overal system because you have removed the need for it.

And with ‘specific’ as oposed to ‘broad’ systems the latter route (4) is the only cost effective one that is generaly acceptable although the former (3) might actually be the best for a whole load of reasons.

The solution to the Puffer problem is actually “don’t bother” it’s an evolutionary dead end for this application.

The real solution is to combine ‘broad’ not ‘specific’ sensors from different areas and examine the overlap efficiently. That is use broad chemical marker (nitrate etc) technology and accept it is going to produce a very high “false false positive” as not just an attack but as a normal course of event. Then combine it with another ‘broad’ but unrelated technology such as volmetric/cavity detection or surface detection system (millimetric and other back scatter technology).

If each technology has a 2.5% trigger rate due 99.99% of the time to “background noise”, stand alone it would be unaceptable. However if. two such orthagonal systems are combined then it would only trigger on the overlap of the two triggering and this might be a thousand times less (.0025%) which would be more acceptable. Three or more orthagonal but ‘broad’ systems is the way to go to deal with the problem NOT developing ‘specific’ systems.

Oh and an important thing to remember as criminals go “terrorists” are generay not very inventive…

They tend to follow a well beaten tack used by others previously to obtain more immedite influance (ie money not political).

Likewise the more inventive criminal gets their ideas from fiction writers (a point brought out in flight of the condor).

What makes 9/11 stand out is they jumped over the beating of the path stage, and went from fiction (Clancey et al) to fact…

Thus to a limited extent the future direction of “common or garden” terrorists is actualy predictable.

Which might be a reason that people are starting to talk about “Cyber terrorism” as opposed to “Cyber crime”.

Conventional warfare however since the begining of the last century (WWI etc) has been the “testing ground” for “the appliance of science” that is new and often inovetive ideas to break old or developing stalemates (trench warefare etc).

Hopefully I will be dead before “terrorists” do another 9/11 by using the comercial exploitation of space to start strapping rocket packs and guidence systems on asteroids…

Clive Robinson • January 2, 2010 4:11 AM

For all those asking,

“But hat can I do”

Actually quite a lot.

Because of all the “nobby no nuts” jokes about the “pants performance” of this particular attack the tide has turned. The most dangerous political weapon ever has started to come into play.

“Laughter”

It is the one thing that cannot be controled by authoritarian entities it is why we even have jokes about political jokes…

As a tactic, refuse to be full body scaned.

When the authoratarian person gives you the “what have you got to hide” threat response just smile politly and in an approprite voice say “Nothing, I much prefere the personal touch, don’t you?”

Make it sound “camp” or slightly “vampish”. I assure you it will cause them a significant problem, especially if others around start to look amused or laugh.

All they can do is get more authoratarian and that just makes them look stupid.

The more people who do it the worse the situation is for the front line staff, their behaviour will become more erattic as they actually start to “feel dirty” about themselves policy will not hold over the way they see themselves.

Legitimat authority is only obtained by respect, illegitimate authority by fear. Neither repect of fear survive laughter for long.

Provided you do not do a joke about a bomb or other kind of weapon (and thus alowing them to do a “Boston”). The “authority” can not win they can only draw by laughing with you and it has to be naturaly otherwise it’s even more of a laugh for the bystanders, and the story is sure to spread.

By “digging out” the foundations of the organisation (the front line staff) the ediffice of authority tries first to buttress up it’s walls and then when they are undermined to rebuild them but with out foundations they are scrabbling in the sand, and the waves of laughter will wash them away.

Clive Robinson • January 3, 2010 5:04 PM

@ bob,

“Halon is used in fire suppression systems precisely because it extinguishes flame without asphyxiating people.”

Err no it’s used because it is “mainly” non toxic and is considerably more effective than other (usually very toxic) fire suppresent gases.

If you get your lungs full of Halon then you will suffer considerable effects as it displaces the oxygen in them (first effects are the same as you expect from altitude sickness effectivly like drunken silliness followed by unconciousness and eventually death).

The Wiki page you pointed to actually mentions this problem immediatly after a Halon dump with,

“During this time the enclosure may be entered by persons wearing SCBA . (There exists a common myth that this is because halon is highly toxic; in fact it is because it can cause giddiness and mildly impaired perception…”

If you do not know SCBA is “self contained breathing aparatus” it usually consists of a compressd air cyclinder presure reduction valve and hood or mask.

It is very similar to Scuba (Self contained under water breating aparatus) gear and serves the same purpose in that ensures a breathable supply of air is made available at slightly above the ambiant pressure so that you don’t get asphixiated by your surounding environment.

Asphixiation by Halon is adout as common (after normalisation) as accidental drowning due to rainwater during/after downpours.

Like rain water Halon collects in depressions if you are insensible face down in a depression you had better hope somebody pulls you out before you “drown” in it…