Schneier on Security

Clive Robinson • August 27, 2011 6:08 PM

@ Nick P,

"And people wonder why I don't have a picture on Facebook.."

I always assumed it was because you were of a kindly nature and did not wish to cause upset to children or those of a nervous disposition...

Hope you are well and your sense of humor is intact, and thus you have not gone red around the gills, it's such an unflattering look 8)

And now you know why I don't have a website etc to be revenge attacked 8)

Clive Robinson • August 28, 2011 3:28 PM

Follow Up:

With regards the wirless hacking of the insulin pump at Blackhat.

It appears the manufacturer of the four pumps the researcher found susceptible to the attack has tried the "old school" method of dealing with the problem of denials an lies.

Thus the researcher has further disclosed,

http://www.informationweek.com/80256/show/...

Clive Robinson • August 29, 2011 8:09 AM

OFF Topic:

@ Bruce,

A bit of interesting research from MIT to help detere Man In The Middle attacks on wireless networks.

http://web.mit.edu/newsoffice/2011/...

It does however have some limitations such but it is interesting nether the less.

Clive Robinson • August 30, 2011 5:23 AM

OFF Topic:

Further Evidence the Root CA System is Broken.

It appears that Dutch CA DigiNotar (A Vasco company) issued a blanket (8.google.com) SSL certificate for google on July 10th. Which they finaly revoked on the 29th at just before 5PM GMT.

However there is a further issue in that although the certifficate has been revoked by DigiNotar, few browser users have the revocation list checking feature enabled in their browser.

This false certificate was discovered by an Iranian using google via https and getting a certificate warning in their chrome browser and posting a warning to the Gmail support forum ( http://www.google.com/support/forum/p/gmail/... ).

One or two other Iranian users on different ISP's noticed the same thing, which some people have jumped on and assumed it is a Man In The Middle Attack on Google by Iran.

It appeares that because DigiNotar have not given reason why the certificate was issued or to whom both Mozilla and Google have decided to remove the DigiNotar root CA in their lists ( http://blog.mozilla.com/security/2011/08/29/... , http://codereview.chromium.org/7795014 ).

Now in Mozilla's case they are talking about a compleate re-release of the software...

But for existing users the manual method is,

http://support.mozilla.com/en-US/kb/...

I guess DigiNotar will get around to making a formal "what went wrong" at some point very soon. But sofar there is nothing on their announcments page ( http://www.diginotar.com/Announcements/News/... )

Clive Robinson • August 30, 2011 3:50 PM

@ M.V.,

"Press Release from VASCO about the DigiNota fail"

It makes very interesting reading,

1, We detect intrusion in july.
2, We revoke those certs we beleive are false.
3, We get external consultants who tell us we've been successfull.
4, We discover a month down the line that our external conssultants were wrong.

So what do we do we get more external consultants in...

That aside the real issue is not DigiNotar or the other CA's prior to them that got cracked, it's the fact that it is possible to crack them and no doubt a significant percentage of the other 600 odd issuing CA's.

Put simply inorder to make any profit a CA has to streamline and automate the process as much as possible. The result is there is either no security break in the system or there is no sanity checking in the process.

Either or both combined will ensure that this won't be the last time this happens.

However getting back to Vasco, what they say about DigiNotar and their products might be true, but how do we know that in the attempt to be profitable in a very competative market Vasco have not made similar mistakes to DigiNotar or RSA or...

The simple fact is it's the "weakest link" when identified that is going to break all of these security company products and the "purchase process" appears currently to be the weak link.

And as it's close to the top of the pyramid of the CA model it's effects good or bad flow down the rest of the process.

As Bruce and others have noted in the past it's not the individual algorithms that need to be strong it's the whole system, and in a business that includes the "purchase forfilment", "technical support" and a whole host of other areas (including cleaning staff) and as we know such security does not come in cheap.

So as it's a "free market" the inevitable "race for the bottom" happens.

Clive Robinson • August 30, 2011 4:06 PM

OFF Topic:

Over on Dark Reading they have a post that indicates "One third of security people do not practice what the preach",

http://www.darkreading.com/9288/show/...

It's a bit more general than the title suggests but basicaly shows there is a lot of complacency with security staff reporting potential new problems "in the wild" upwards but then failing to take any mitigation action.

As I note which appears apropo to my post above to M.V.

Clive Robinson • August 31, 2011 3:00 AM

OFF Topic,

Tony Sale, rescuer of Bletchly Park, founder of "The National Museum of Computing" and rebuilder of the Colosus has died aged 80 after a long career in electronics.

He will be missed by many.

http://www.bbc.co.uk/news/technology-14720180

Clive Robinson • August 31, 2011 9:43 AM

OFF Topic:

Two BBC News items involving FaceBook,

The first is about FaceBook paying a bounty on bugs found by people,

http://www.bbc.co.uk/news/technology-14715442

The second is about research from Carnegie Mellon about how commercialy available facial recognition software and access to Facebook enabled researchers to identify people and their SSN's etc from just a photo,

http://www.bbc.co.uk/news/technology-14386514