Schneier on Security

Clive Robinson • February 22, 2010 8:07 AM

What is the betting that within a short while people will say “this can’t happen with Chip-n-Spin”…

The more I think about it the more I like Bruce’s idea of make the card issuers pick up all the bad debit not even the banks or the merchants and most definatly not Jo Consumer.

Then I think you would find that the payment card industry might just start taking things a little more seriously.

Oh by the way this is not the first time EPOS terminals have had trojan hardware in them. If you think back a major UK supermarket got a shipment of EPOS terminals eith built in skiming and cell phone get the data out systems (I think but am not sure that the terminals where manufactured in China).

Clive Robinson • February 22, 2010 5:47 PM

@ HJohn,

“size 2 diapers are too large to fit snuggly enough to keep “number 2″ in, if ya know what i mean. ;)”

Agh I’ve less than fond memories of exploding nappies/diapers.

Especialy fool that I am I insisted we went for the environmentaly friendly reusable option (No don’t ask and more importantly don’t go there)….

Suffice it to say I now know why “men are hunters” and “women are gatheres”, because we men just cannot get our own let alone our off springs 5h1t together at 4 in the morning 😉

It’s always 3-4AM to late to get back to sleep to early to get up.

I should mention before being a father I was a light sleeper and would wake at any out of place noise like a fox sneaking past the window in summer. Now however my son has to literaly jump on me to wake me up at “Oh my god it’s not even morning” much to my other half’s anoyance as he is now trained and goes and wakes her up instead of me 8)

The secret as a parent is never ever and I do mean never ever respond to “daddy I’m feeling thirsty” or any other of those little needs. Once they know that three hours of persistant nagging will wake you up then three hours of nagging is what you will get….

Clive Robinson • February 22, 2010 6:04 PM

@ HJohn,

“I, unfortunately, forsee a future with technology that will migrate to biometrics for almost anything. Some people will think this is good…”

I think Matt Gronig (he of Simpson’s and Futurama) probably agrees with you.

My son is shall we say more than a little keen on Futurama and in one episode (A fishfull of dollars) there is a bit where the anti-hero “Fry” goes into the bank to see if he has any money.

The bank teller say’s “We don’t appear to have your retinal or rectal scans on file, do you remember your PIN” even after watching inadvertantly for maybe the 150th times it still makes me wince…

It begs the question just how personal does the invasion of a persons privacy have to get before they will say “no more”.

Clive Robinson • February 22, 2010 6:41 PM

@ Doug C,

“I have no credit cards — I don’t have a credit rating, it’s completely blank. A life of being prudent and only spending what I made has done me OK, but no one will touch giving even a millionaire and owner of a successful business a credit card with a blank credit rating….go figure.”

The reason I finaly got a credit card was because like you I didn’t have a credit rating either (again by choice of being prudent).

The organisation I (used to) bank with had decided that as part of the move to Chip-n-Spin they would automaticaly upgrade the old accounts to every profitable (for them) service they could.

Having been pushed into it I got a combined credit/debit card (yup I found out most merchants configure their EPOS to be debit not credit by default and remove the customer select option)

I found a place where you could chose (debit or credit) and bought a cheese burger there on credit once a week for three months and paid the minimum balance (ie interest only).

I discovered I had a good credit rating and went and got a CC only card with another organisation and shut the original bank account down (this CC only screws the managers who set Debit default no customer change in their EPOS).

Being prudent the new card I pay in full by direct debit unfortunatly this has hurt my credit rating…

Go figure, buy a cheeseburger a week on credit and pay interest only makes you a good risk, paying off promptly makes you a bad risk (especially if you refuse all other credit and refuse to let your credit limit rise)

I can only assume that credit rating is in reality based on how much profit you make a financial organisation…

Clive Robinson • February 22, 2010 7:03 PM

@ Annmarie D. Hart,

“MagnePrint is the answer. It detects skimmed or sniffed cards. It matters little where the data is harvested. It matters most that we (issuers, merchants, acquirers, brands, etc) can determine that the payment instrument or the data on it have been compromised.”

I think you will find when the technology you are marketing was discussed on this blog it was found to have major short commings.

Not least of all the worthless upgrade cost to the required proprietary equipment.

What the CC industry needs is “cleaning up it’s act” not another pointless “techno arms race” that MagnePrint is almost certainly going to start.

Clive Robinson • February 23, 2010 5:26 AM

@ Nick P,

“There’s one other problem with magprint: it could be the next skype.”

What was the old joke about the CIA logo which has the words “In God We Trust” around it with the unwritten subtext “All others we check”.

MagnePrint’s main claim to fame is it takes a “signiture” of the magnetic partical size on the back of the CC etc.

As I pointed out to them although an interesting rework of an old idea (Simmons et al) it is based on a flawed assumption. In the case of magnetic particles on the back of CC’s they are very large and thus make a lot of low frequency noise (this is not an issue with data but sure is with analog signals like audio or video).

With analog systems they try to remove the problem by using much finer grained magnetic particles thus taking the nois spectrum up several orders of magnitude. But importantly also taking the analog bandwidth up by the same amount.

The problem MagnePrint has is that for their system to work they have to band limit the signals they are looking at to a particular range.

Thus if you can find analog tape that has a bandwidth of atleast three (preferably five or more) times this upper bandwidth then you can record and reproduce the noise signal they are using without any real issue.

Thus an attacker could simply make a “HiFi” recording of the CC signal from the reader head and lay this down on the back of a card they had superglued a piece of appropriate analog video tape or high density data tape too.

Although this can be detected I can not see MagnePrint doing it as the cost would be disproportiantly high. Thus when forced to do so it would be a retro fit which the consumer would be paying for in two ways.

Firstly as with all such holes in financial systems where the risk has been externalised. The card issuers and banks will go to court and put in some paid for mouth piece to say “Our magic pixie dust technology we cannot talk about shows it must have been the card”. Even though the card issuers and banks know the system is broken beyond redemption, they don’t tell the paid for mouth piece, thus the paid for mouth piece is not committing purjury.

As even getting to that stage takes years MagnePrint and the Banks keep up the pretence and Jo Customer who has been skimmed through no fault of their own gets to swallow the loss (hence banks and merchants forcing Debit Cards down peoples gullets). It is a Standard Operating Procedure for Banks and card issuers which they demonstrate over and over again and get away with because judges let them, thus they are very like the tabbaco industry, however unlike smoking where there is some semblance of free will for Jo Average, there realy is no choice for the majority they are forced to use banks.

Secondly even after it becomes publicaly clear that the finger print system does not do as advertised it will carry on being used. There will be some upgrade or new DNA varient and so the cycle will repeate. All of which gets paid for by Jo Custommer.

The honest thing to do would be to admit the plastic card mag stripe system is broken beyond recovery.

But the card industry and the banks won’t do that as long as they can externalise the risk.

And as there will always be the likes of MagnePrint comming along with more “magic pixie dust” to sprinkle on top the cycle will continue.

And don’t think MagnePrint don’t know this they do, their entire idea rests on this “magic pixie dust” mentality.

Thus it passes the tests required to make it “Snake Oil” or “Emperor’s new Clothes”.

Then of course there is a third aspect “end runs” around security with “legacy systems”.

When Chip-n-Spin came in the card skimmers simply moved their point of attack away from Chip-n-Spin terminals in the UK to countries that still had mag stripe terminals. By the time other countries started puting in Chip-n-Spin the skimmers had discovered holes in Chip-n-Spin thus we started on a new cycle.

What we need is an Ageian Stables solution to the problem, not sprinkle a little more clean scented straw on the old pile of 5h1t.

This “slap a band aid on a broken bone” mentality is rife in a “faux free market” where one player has overwhelming resources against those that actualy take on the risk.

Any way speaking of medicine, I’ve just had a phone call thi morning to say I’m going back into hospital for surgery to try and fix the problem from the last lot of surgery…

So my responses may not be up to their usual standards 😉

Clive Robinson • February 25, 2010 12:28 AM

@ Robert,

I’m only vaguly aware of PUF’s.

If I remember correctly it came from an an idea that was originaly touted last century to get around the issue of putting a unique serial number on a CPU or other chip.

If you think about it puting a perposfully unique structure on a chip that cannot be altered is a very expensive process which ever way you do it (laser / fusable links / quantum structures).

Thus the idea was to make measurments of the physical uncertainty caused by the manufacturing process. That is to look for suficiently unique “tool marks”. A process often called “fingerprinting”.

The problem with all these “fingerprint” processes is “measurment” uncertainty which you have to get over for repeatability of reading.

That is if you can measure something reliably then you can duplicate the measurment or the measurand and have the same result.

If you think about what you are doing you have,

1, Physical object.
2, Physical sensor
3, Information evaluator.

The process of evaluation is not physical it is informational. The physical property is converted to information by the sensor. Thus you can attack the system at any of the interfaces by,

A, Duplicating the object.
B, Exploit weaknesses of the sensor.
C, Inject information into the evaluation input.
D, Inject information after the evaluation process.

The argument that an object that can have one physical atribute that is reliably measurable but cannot be duplicated is in reality a nonsense due to the limitations of the sensing process.

That is I can cut you two steel bars that will measure to the same length under the same conditions. This is simply because of the uncertainties in measurment under all conditions means you have to alow for quite a large granularity of measurment to get a consistantly reliable result. Generaly you can work an object down to the noise floor and below.

It is the flip side of True Random Number Generation.

It is only possible to have True Random Number Generation due to uncertainty. That is no measurmant is certain or repeatable beyond a certain point and we can use this uncertainty to generate bits of information we have no way of predicting in advance. This property holds true for the measurment of all physical properties.

We lump all these uncertainties and other issues together under the general term of “noise”.

A signal only starts to become reliable when it is at a minimum two orders of magnitude above the peak magnitude of the system noise floor. It usually needs to be at least a magnitude above that again for non coherant measurment.

I could go on and describe how all the interfaces suffer from exactly the same problems when it comes down to it.

But I don’t think it is realy required to show more than one way by which a system is flawed.

Clive Robinson • February 25, 2010 8:34 AM

@ Robert,

Sorry my earlier post reads a little bit oddly earlier. It was 5AM in the UK when I read your second post (to Nick P) and I’d been awake all night.

As I said you could attack any of the interfaces.

A, Duplicating the object.
B, Exploit weaknesses of the sensor.
C, Inject information into the evaluation input.
D, Inject information after the evaluation process.

My personal choice would be investigate one or both of the information interfaces first (ie C,after sensor or D, after evaluation).

If you can get the “after evaluation” (D) interface then you’ve got the system dead in the water as in most cases it is effectivly a binary response (good
/bad) and the same across all the chips made from that particular stepping mask.

Attacking the eveluation input would be harder but…

It depends on how they go about the evaluation process. Worse case they could do a serial bit by bit test and compare with an XOR gate. In which case you don’t need to know anything about the individual chip as all you are doing is setting both inputs to the same value to set the XOR output to zero show both bits are the same. Thus this evaluation input attack would be as devestating as the the evaluation output attack.

Most other evaluation input attacks (C) and earlier (AB) in the chain are “replay” attacks which at first sight would require knowing something about the individual chip unique property.

But…

Actually not in all cases if you think the process through,

When the chip is manufactured it has no knowledge of what the resulting unique number would be, the earliest it would know this would be after first powerup.

The question is then what does it do with this number and how.

The first thought is, is it ever sent “off chip” or only ever used “on chip”.

If the number is “read out” of the chip some how then this enables it to be read again which means that yes you could determin it’s value.

If it’s used “off chip” (ie not read out of the chip in any way) then this opens up another interesting thought line,

What is done with the unique number and when and how.

This is getting down to being application specific but you could still find broad clases of attack.

One of which is “if the unique value stays on chip at all times in what way is it being used with regards to power cycling the chip.

If it is not somehow being preserved across power cycles in some functionaly dependent way (say used as a key to encrypt/decrypt program code held internaly) then it is vulnerable to a forced reset attack.

That is you reset the chip and force the early steps in the chain to produce a fixed result (say all zeros or all ones). Thus you are effectivly overwriting the first reading of the unique value to a value known to you that you can then exploit.

As for sending the value “off chip” this presents significant opportunity to find protocol failures in not just the communications but also the state design of the chip. Once you find on thet you can “work”, and there almost certainly will be based on the current state of the industry, then you can find the unique value to enable you to attack the chip further down the chain if actually required (Remember even the NSA fell foul of protocol failure problems with the Capstone key escro system back in the Clinton era, thus the lesson NOBODY AND NO SYSTEM IS PERFECT!!!).

All of the above attacks have not involved physicaly attacking the chip so would get around anti-tamper etc protection.

The only question is how to “induce” the attack on the chain. Well the simplest way is with a “fault injection attack” in the early part of the chain.

My personal choice would be with EM radiation injected either directly onto a pin or coupled in via a “micro probe” inductor, neither of which require the chip to be attacked physicaly.

It is this “no physical” attack aproach that made me look into it back in the 1980’s and I found quite easily just how devestating this general class of attack is. However I appear to have been a “lone public voice” on this untill very recently when two bods over at the UK Cambridge Labs performed the simplest of the EM fault injection attacks on a TRNG and took it’s output from 32bits of entropy down to 8bits of entropy.

The nice thing about some EM attacks is you don’t have to have physical contact with the chip, some even work well outside of the equipment housing the system that contains the chip is mounted in…

So to give it a 1950’s comic book view it’s a “Death Ray for Electronic Security” 😉

The simplest way to inject an EM signal is via the “micro probe” however it is very orientation sensitive. Also it can be a little difficult to focus down. This can require you to develop your own micro probs using differential signaling axialy between two or more probes etc. Which at microwave frequencies can be quite difficult to do as you require long transmission lines with respect to the wavelength in use thus may require electronic phase shifters etc. Not exactly difficult but you need to know what you are doing. Most EMC labs will have the bits you need and a good EMC engineer who can also think “hinky” will be able to do this as will any competent EmSec technician (so we are not talking “Mad Genius” grade abilities for the “Death Ray” 😉

The next method of connection is at the chip pins. And this is where you can get up to all sorts of tricks that realy are quite devestating. There are a lot of variables involved but you can walk a “fault signiture” back throught the chip buffers and drivers to the heart of the control logic, you can change logic state and thus compleatly own a chip that you have direct access to. Again without having to de-package it or in any other way physicaly harm it.

It is harder to do than a micro probe attack but much more repetable.

Which brings me onto “fault signitures”.

The attack that the bods over at Camb Labs did simply used an unmodulated RF carrier that was neither modulated nor synced to the device under attack.

That is it was like doing brain surgury with a 14lb lump hammer and a lump of flint. Thus primative but unexpectedly and strangely effective.

If you think back to the days of the Differental Power Analysis of the turn of the century it had been preceded by a few years of claim counter claim and crude preventative engineering tricks such as in circuit noise generators on smart cards.

The problem was simple functioning electronic logic draws power to switch states and in the process this produces electrical noise on the power supply lines. These powerlines come from every part of the internal circuit and have no bandwidth limitations of any meaning (just pad capacitance and lead bonding wire inductance). Adding a small amount of resistance (say 0.1-1R) between the chip pin and the external powersupply decoupling made this rich signal of multiple signitures available to be analysed.

It quickly became clear that with simple microprocessors you could tell at exactly what point in the internal program it was at and how it branched based on internal and potentialy secret values. [As a historical note this should have been absolutly no surprise to anyone, it had been known since the early days of computing that the unwanted emmision carried sufficient intelegance for a human to understand sufficiently on a near by AM radio to say a program was not functioning correctly].

The smart card industry response was to say the least pathetic and showed they had no less understanding of the issues involved than an averagely smart home hobby electronics/radio enthusiast.

After the first denials came the proof that a secret (DES) key could be detected. The solution from the smart card industry bolt a PRNG noise maker into the circuit. The attack solution use spread spectrum signal detection techniques to remove it’s effect. It was turning into the old EW ECM/ECCM/ECCCM game.

At this time Ross Anderson at Cambridge Labs was looking at self clocking logic to get around the synchronising issues, and I sent him an EMail warning him that his circuits where going to be very suseptable to be externaly locked to an RF signal by the process of “lose locking”.

[Historical note lose locking is a very old issue and is why two pendulums will fall into sync if there is any kind of coupling between them including just being adjacent to each other it requires only fractionaly tiny amounts of energy in comparison to that in the pedulums. It applies even more so in electronics which was very well known at the time in Satalite recevier front ends for threshold extention and as in improvment over PLL techniques, and is the way the colour chromanance signal is synced up in PAL television (via the “colour burst” signal and how some FM Stereo receivers decode the channel difference signal) was also known to have been used for the original van Eck system.]

I had also sent an Email to the two DPA authors outlining how the use of RF carriers could be used to extend their attack.

Put simply and as described in any EMC book, if your circuit can eminate (radiate) a signal it is suseptable to a similar signal. What is not in there usually is TEMPESTS dirty little secret that you can “enumerate” a piece of equipment by both that emination and suseptability.

However the industry should be aware of this I have been saying that RFID chips in passports can be enumerated by their startup charecteristics from the early days. Various industry mouth pieces (who should have known better) went into denial mode and as we have seen more recently they as ususal where wrong in their pronouncments, but have conveniently chosen to forget that fact…

But it goes further than just enumerating the chip
by it’s responses and suseptability to stray signals (it works the same way that “red eye” does in photography).

Just like the rabit in the head lights you can control it.

So you can extend DPA by injecting a signal to cause the internal state machine to go to the wrong state. This has the same effect as unchecked overflow/underflow bugs in software that allow knowledgable crackers to break the stack etc etc.

What surprises me is people don’t put 2 and 2 together and realise this and start exploiting it?

The trick (if you can call it that) is to work out what is going on with an “emmision signiture” and use this to sync your injection attack. You repeatedly go around the loop on a piece of test kit untill you have the system sufficiently enumerated for your attack to work.

You then go and find a piece of live kit and “own it” without “it” or it’s “legitimate owners” being aware it is happening…

I was doing this back in the 1980’s with simple microprocessors. One of which was in a prototype hand betting device. I showed it’s incredulous backers that for all the protesttions of it’s developers that all their carefully designed security worked it was all for naught (needless to say it never went into production). I also showed it was an issue with an electronic purse.

Yes it is going to be harder with more current technology but the fault still remains to be richly exploited.

So huff to PUF, it can be got at unless great care in it’s design is employed. And I know from much experiance that care in design and time to market make uneasy bed fellows. And thus I will make a prediction,

PUF like PA/DPA on smart cards and enumerating RFID chips in passports will have it’s “inglorious failures” and go into first denial and then the EW ECM/ECCM/ECCM cycle, before it ever becomes trust worthy, if it ever can (which I doubt).

Clive Robinson • March 1, 2010 6:26 PM

@ Robert,

“Most PUF’s are only in a “metastable” condition for somewhere between 10ps and 1nsec, so the appropriate interference must happen during this narrow window.”

Hmm you appear to know more about PUFFs than is currently “openly” available. Care to share where you got the info?

As I said originaly my knowledge of them is a little vague simply because I’ve seen little or no info on them other than “venture capital” blurb.

Supposadly some bod at MIT came up with the idea.

However the same blurb comes up with obvious “BS alert” type nonsense with statments like “64 bit random number that is unique…” (birthday paradox dumps that on its head after 4billion or so devices 😉

The attacks I was describing are “general purpose” in nature and are areas you would start with if you did not want to strip the lid off and had little or know information about the internals of the system or the protocols in use.

Basicaly you get hold of one or two and “black box probe” them to look for where things work differently than when not probing and tailor your probing to enumerate the target.

Untill either more details are available or you can get a few on the RF test bench all potential attack vectors are going to be “in theory” tempered by experiance.

From what you say,

“”Most PUF’s are only in a “metastable” condition for somewhere between 10ps and 1nsec”

This would suggest that the method chosen is rise/fall times on logic circuits.

Clive Robinson • March 1, 2010 11:21 PM

@ Robert,

Out of curiosity does

Class D Mstar.

Ring a bell?