Schneier on Security

Clive Robinson • August 4, 2012 6:34 AM

@ Robert, Wael, C,

Ever hear of electromagnets

Yup they are great right up to the point the power fails, then “Open Sesamy”. Unlike mechanical locks they draw power all the time and the reality is they are actualy “never locked” only “held”.

Thus the problem with them is “how big is your security perimeter?” do you realy want to have a gun safe where the door falls open each time you need the wall socket for the vacuum cleaner. Likewise when Joe Fatpack puts his JCB digger through the cable in the street outside or any one of another million “what ifs” all the way back to the oil well or coal or uranium mine, or if green when the sun goes in or the breaze stops?

@ Steve Pordon,

You know it’s odd but I’ve known how to do this before any of these supposed “wonderful new technology security systems” were designed and have said as much on the blog for many years (some would say endlessly ;-).

Maybe I should apply to DefCon as “an all expenses paid” speaker 😉

@ Bruce,

In other words, security is only as strong as the weakest link

Whilst it has a nice ring to it as does,

High tech fails to low tech

The truth is a little more interesting in that the real mode of failure is,

Trying to use intangable information to protect tangible physical objects

It will almost always be a “fail” because their fundemental charecteristics are almost entirely unrelated. Physical objects are comprised of mass/energy and are thus constrained by forces,the speed of light and the resulting laws of physics. Information on the other hand has no physical form other than that we give it to store it and communicate it. Thus we usually encode information onto mass/energy by a process such as modulation.

Traditionaly energy is converted from one form to another by a transducer, thus information that is used to modulate energy can via the use of a transducer be converted to mechanical or other forms of energy (eventually the ultimate form of pollution “heat”). Often transducers are designed to have an “amplifying” effect using feed back processes which again tend to act as modulation systems.

So you end up with a massless energy less information signal being used to control substantial mass or energy. “Amplification” is more usually called “gain” and is usually defined as Gain = Output / Input…

So with the input being effectivly “zero” the amplifcation / gain is likewise effectivly infinite, which makes it very very susceptable to interferance or other external influance.

Thus the weakness in nearly all these systems is the transducer and it is the first place you should look to as either an attacker or defender.

For some reason this fairly obvious issue is either ignored or unknown to most if not all designers of commercialy available security products…

Clive Robinson • August 4, 2012 12:51 PM

@ Bob,

You can invert the process…

Yes you can with the likes of spring loaded bolts, which are withdrawn by the magnet (have a look at the internal design of safe door lockers etc to see best how to do it).

However the design needs a bit of care to avoid being “bumped” or suffering from a series of other “physics attacks”.

The worst of which is down to “wear and tear” resulting in a cable break that then requires the door etc be drilled and parts maniupulated.

This is where train brakes have the advantage in that there is no reason to make the cable hidden and unaccessable, and unlike a safe door failed brakes have “failed safe”.

Usually with safes “failled safe” is considered to be where the door stays locked, except where… people could be trapped in side or their lives in otherwise threatened by the door remaining closed.

Now it can (and has) been argued that a gun safe needs to fail in a mode that still alows the owner to easily access the weapon in an emergancy but not for others to do so at other times. This calls for the safe to be able to differentiate between people on physical differences which is difficult to do even with adults and small children (small children are increadably observant and often smarter than their parents). As a simple rule of thumb the more complex the process the more likely it is to fail…

It is a difficult process and arguably one we still cannot accomplish in anything like a reliable way even when we throw lots of technology at it. You only have to look at the way all bio-metrics fail with both false positives and negatives to realise that we have a very very long way to go.

Oh and the least reliable component in most electronic systems currently is the “battery” for all our recent advances we still cannot store electrical energy in reliable ways for more than a relativly short period (there is currently a race on to develop a lock eenergy system for nuclear waste storage that will provide reliable “unlock” energy for just 100years).

Clive Robinson • August 6, 2012 8:26 AM

@ Salache

Good locks do not use a solenoid that can be bumped. They use a motor + gear that controls the link between the handle and the bolt, making bumping or external magnets useless

Sadly motors and cams are not an effective solution either. I know of atleast two high security locks that used motors that were vulnerable to a magnet. On because the design was such that you could with patience turn the motor end of the gear train with the magnet, the other effectivly used a spring back latch that was lifted by a motor driven spigot. The latch could be lifted with a strong magnet.

It is actually a very very hard problem to get the gain in the transducer to provide the mechanical linkage in a reliable way and still use batteries with a volume of half the size of a traditional lock mechanism. One design we got to work reliably but was to expensive to produce was a “piezo crystal clutch.

My advice to most people (because they are to far down the design chain) is to still use their solenoid but then work out how to add mechanical interlocks that are held open by a large magnetic field. It’s far from perfect but it generaly moves “the weakest link” to some other point in the system. For instance from the attacking perspective replacing the magnet with a “bulk tape eraser” will cause the solenoid to work but not all interlocks. Likewise knowing how to “stroke” the lock with a magnet whilst twisting the handle to get the pawl to hold in the mechanism (just like lock picking) but not the interlock can be done. Another attack works against the “snubber neetwork” on the coil/motor drive circuit, In some simply putting either a large voltage or a sufficiently large reverse voltage on the external “batery replacment” pins will open the lock due to the break down of the driver and snubber semiconductors.

Clive Robinson • August 6, 2012 11:20 AM

@

Tobias, is selling pure unadulterated fear

Actually he’s not.

The first thing you have to remember is HE IS NOT a normal commentator as he is both legaly qualified and further presents himself as such with expertise in this area (this lays a heavy burden on him that most would chose to avoid).

He is required by his status as “an officer of the court” to provide his advice within the context of the law. He is thus not alowed to promote products or services in the normal way, and if saying a product is defective he clearly has to demonstrate why prior to making the claim. That is as a minimum he has to say “after testing product Y in the following way I found it to be deffective in this manner Z”.

Further if you have a look at what an “attractive nuisance” is you will be very surprised by what onus this places on those who are aware of it as the legal culpability is high for what many would consider normal behaviour. Interestingly one parent can sue the other on behalf of the child or any other person may sue the parent on behalf of the child. The parent being sued can adjoin others into the action such as their employers, equipment manufactures etc if they can show they followed correctly the guidence issued by these third parties.

http://en.wikipedia.org/wiki/Attractive_nuisance_doctrine