Schneier on Security

Clive Robinson • July 22, 2017 2:50 PM

When Pokemon Go does not

A major Pokemon Go event with 20,000 attendees had so many things go wrong everything ground to a halt or crashed…

https://techcrunch.com/2017/07/22/pokemon-go-fest-attendees-to-get-refunds-as-technical-issues-break-the-event

One reason appears that the attendees effectivly did a DoS on the network.

Such “under capacity” failures are not unknow, in the past telephone networks have been crashed when ticket sales start for very popular artists or festivals.

The problem is that often such failures open up all sorts od attack vectors that would not normally occur. In one case of a phone network crashing, it stoped burglar alarms reporting back to control stations, thus alarms were raised on the assumption telephone lines had been cut as part of an attempted burglary.

Clive Robinson • July 22, 2017 3:09 PM

@ Thoth, Figureitout,

You might find this article on making an RFID Fuzzer using an ATtiny85 of interest,

https://z4ziggy.wordpress.com/2017/07/21/zigfrid-a-passive-rfid-fuzzer/

Clive Robinson • July 22, 2017 4:18 PM

When 2 Factors join

Somebody had a thought, what if something you have and something you are become one…

The result is the madness that is Dangerous Things VivoKey, an NFC Implant…

http://vivokey.com/learn-more.html

Why mad? Well aside from turning you into a target, it also means you can not go into NMRI machines and will cause you issues near high power HF transmitters (think RF burns inside you around the implant).

But there are “wish lists” of features people are thinking of to turn it into a “Crypto Implant”…

My advice do not be as daft as some Swedes implanting NFC Travel Cards in their hands… To open doors, pay for shopping and other things we traditional “use plastic” for.

After all think of it this way, how much do you value your right hand? Now how much do you think some brain dead drug addled lowlife values your hand, when all they have to do to get their next fix is steal your hand with an axe, hatchet, machete, or rusty blunt old hacksaw blade they found in a garbage bin?

Clive Robinson • July 23, 2017 6:14 AM

@ Wael,

Light pollution is particularly annoying to me. There is hardly a spot near me where I can find black sky.

Yup, if you look at those photographs taken from the International Space Station of the earth at night and clear skies you can see not just the light polution but urban sprawl.

If you look at the South East of the UK you will see that even though there is supposadly a “Green Belt” around London, it’s hard to find a totaly dark spot for the likes of astronomy and photographing satellites etc. In fact there is a photo somewhere which shows the ISS lit up not by sun or star light, but by reflection of the light from Earth…

There is effectively nowhere within fourty miles of where I live where you can go to set up a telescope and not suffer light polution, either directly by line of sight or by reflection of clouds…

But the ultimate form of polution is further down the EM spectrum. As no machine or process is 100% efficient. The waste energy has to go somewhere and by the process of radiation transport ends up in the IR through microwave down into the lowest RF frequencies.

The problem with South East England is that even down at those low frequencies there is so much “polution” that radio astronomy and tracking satellites is to put it politely more difficult than it should be.

But that as far as mankind is concerned is a minor problem as heat energy is a major issue in “Global Warming”…

Clive Robinson • July 23, 2017 7:59 AM

Microsoft dump clover trail CPUs

Microsoft is dropping Intel CPUs that are considerably less than 5years from their release date, in new versions of Win10.

http://www.eweek.com/enterprise-apps/intel-atom-clover-trail-pcs-ineligible-for-future-windows-10-updates

And there are a lot of these Intel Clover trail 32bit CPUs around with not just consumers but businesses and schools. As they are SoCs moving to other OS’s such as Linux may not be possible and still have full hardware usability.

This may prove problematic with more “XP” type issues arising.

Clive Robinson • July 23, 2017 11:06 AM

@ Rachel,

Kind of in reverse order, have you ever heard the old saying about “throw them under the bus”? It’s kind of a modern day version of “Et u Brute” but at arms length.

As for cholesterol modern science is increasinglyregarding it as kind of harmless on it’s own. It’s when you have certain “nano-virus” or carbs in your diet that it starts to be bad for you by getting stuck to the inside of blood vessels causing strokes, heart attacks and similar when it breaks away and blocks smaller blood vessels.

The funny thing is that it was a doctor to a US President that came up with the idea of filling people full of carbs to excess and cutting out fats. As has been shown even by his own experiments –that he lied about– you can live indefinitely with no carbs in your diet, but no fats will kill you or make you very ill (Vegans suffer from this problem if they are not meticulous about nutrition as most vegetable fats are no where near as usefull to the body as animal fats). Experiments on animals have shown that no carbs improves longevity as does having a calorie restricted diet. It will be interesting to see thr results of a combined diet.

Oh and this might be of interest, it’s kind of a must read,

http://news.harvard.edu/gazette/story/2017/04/over-nearly-80-years-harvard-study-has-been-showing-how-to-live-a-healthy-and-happy-life/

As for EM radiation and biology, most models used to set safe levels are based on the “heating effect” not any other measure. For two reasons the first is in most cases there are no agreed measurands, the second such studies are likely to be considered unethical currently.

Clive Robinson • July 24, 2017 12:56 AM

@ ,

If one’s PC is super old DSL (Damn Small Linux) has existed for decades and I don’t see how the Pi can do better than that. Also, Puppy Linux is very lightweight and secure as well. Those articles struck me as a marketing gimmick.

It’s not a marketing gimmick as such, but it’s applicable to a small but rapidly expanding group of people.

As I noted yesterday, Microsoft are dropping support for Intel CPUs that are less than 5years old in Win10. These CPUs were still in items sold as new just a year ago, and were due to pricing purchased by parents who are not affluent for use by their children for school work etc.

The aim of making the Raspberry Pi OS available for other platforms is so that children who use the Raspberry Pi at school can have the same look / feel / behaviour on their computer at home, as well as extending the life of the computer the children have at home that their parents can ill aford to replace when the likes of Microsoft or Apple decide to drop support for it.

The reason behind Microsoft’s behaviour is two fold. Firstly there is apparently –from market reports– a global slow down on sales of their OS products. Secondly Microsoft envy the “Walled Garden” approach of some of it’s compettitors and want to have the same market “dictatorship” “lock-in” advantage as can be seen by their behavioir with Windows 10.

History teaches us from the “Big Iron” days that such “lock-in” whilst very profitable for the manufacturer, is very bad for the consumer, who looses “freedom of choice” and rapid forced obsolescence etc, from what is in practice a monopoly market.

Thus whilst the moving of the Raspberry OS to older hardware may not be for “techy types” it will if made a simple install option find favour with parents who see a hard payed for computer become obsolete within an all to short period of time.

Clive Robinson • July 24, 2017 2:15 AM

@ anonymous,

Is this true for titanium implants and osseointegration into bone?

@Tyr’s comment is broadly correct, however as with many complex things there are exceptions under certain circumstances.

Bone’s are the structural heart of the body, and broadly what everything else not just wraps it’s self around but moves around. Thus the fact that things move around the bone makes things a lot simpler. Further bones do not have the proliferation of nerves that other parts of the body have.

Finding materials that you can put in the human body is difficult. If I remember correctly the first material found where the body did not react to it by forming scar tissue around it was during WWII where aircrew had got splinters of plastic from canopies in their eyes. Getting them out was considered a very risky proceadure, thus they were left where they could be. Ophthalmic surgeons were supprised at the fact scar tissie did not form, and this observation gave rise to the idea of what we now call hard contact lenses.

It’s not just titanium by the way, some stainless steels do not produce rejection reactions nor other long term issues when used in bone. However as has been found with “stents” the same is not true in blood vessels, much to the annoyance of numerous cardiac doctors and surgeons.

But the big problem in other places is nerves. Each time you cut into flesh you cut nerves, it’s why scars tend to be quite numb when tested by external stimuli. However cut nerves produce another effect which is known as “Phantom Pain” thus to some people scars can be extraordinarily painful even though they can be shown to be numb to actual stimuli such as pin pricks and localised heating and even electric current.

There is also other problems, all surgery has risks and complications, one such is the weakening of the immune system in the surgery site. Due to an injury I have had surgery involving the implanting of foreign parts inside me, not only have I lost the use of nerves, I get phantom pain and repeated infections at the scar site.

Phantom pain is a very real problem for not just doctors and surgeons but the patients as well especially in amputees. Whilst my phantom pain is to me mostly an anoyance –except when the weather changes– that disturbs both movment and sleep, I can at least live with/around it, which makes me lucky compared to many. I have friends who were injured on active service and their phantom pain is considerably worse to the point it has in effect destroyed their lives as it resulted in divorce, unemployment and the attendant depression etc.

The surgical trend these days is minimal invasion via key hole techniques and the minimisation of the use of implanted foreign objects. It’s also interesting to see the difference it has to the type of health care system you have. In the US with it’s insurance led payment system there was a trend towards implanting the likes of cardiac monitors and pacers, less so in other health care systems.

In the more shadowy world of body augmentation / art people are comming to the realisation that the down sides are more than the upsides even for tiny foreign objects like magnets, which even after they are removed leave scar tissue and loss of feeling.

Thus body augmentation is now looking towards stimulation suits and exoskeletons to avoid the very many implant issues.

Clive Robinson • July 26, 2017 10:51 PM

@ Wael,

Good heavens, man! What are you doing up at this early hour of the morning? It’s pushing 4:00AM! Mistress insomnia in town?

And now it’s nearly 5AM…and I’m that little bit older but still not rested.

The problem, was not getting much sleep last night, thus being unable to stay awake in the afternoon and taking a short nap… So now even though I want to sleep, I find my mind wizzing around like a whirling dervish simultaneously giving me the equivalent of a “ten double espresso headache” and driving sleep.away 🙁

This lack of sleep would not have caused problems as little as ten years ago, I would have “Manned it out” and just slept well over night. Now however age has wimpified me for the worse…

Clive Robinson • July 27, 2017 11:00 PM

@ Thoth, and other mobile devs,

You might find this of interest,

https://blog.lessonslearned.org/building-a-more-secure-development-chromebook/

Put simply it’s a low cost solution that is sufficiently secure for devs that are mobile, or use “coffee shop Offices”. Likewise it’s a cheap way to cross borders cleanly in most places outside of the Five-Eyes paranoia zone.

Clive Robinson • July 28, 2017 10:47 AM

@ JG4,

… there simply is not enough cobalt or platinum on your planet to make a difference, but I thought that iron nanophosphate cathodes avoided the cobalt issue altogether.

Nor a whole host of other metals more conductive than iron. It’s a point I’ve been making since the mid 90’s to various “Green Energy” people. The only way around the solar and wind peaks and troughs issue currently is by energy storage and it’s something we realy realy suck at. The other is due to non locality of generation and IR losses at or above a quater of the power generated.

It’s great to be able to generate 30MWhours in an off shore wind farm but if you don’t use it you lose it without storage. The loss due to transmission and storage is up around 50%, and with only 25% of the day generation suddenly that 30MWhours is not looking so good. Worse with the variation you are probably only good for a couple of MWhours over the entire day…

It’s why we need to look at what are mechanical gravemetric storage systems for fast generation of power and weird sound things like molten salt thermal storage where we have sufficient of the raw resources to make them viable.

Clive Robinson • July 28, 2017 10:00 PM

@ Gerard van Vooren,

What I am saying is that you can probably make OpenBSD memory safe but memory safety isn’t everything, it’s also about having logical and easy to understand and manipulate access control. It’s also about secure by default networking, and you name it.

In essence the issue you are describing is “backwards compatability” caused by unstructured “organic” growth which is possibly the worst type of technical debt.

Plan 9 was a sensible move to ditch most of the backwards compatability and organic growth of Unix. They had learned much of what was bad in the add ons to Unix and removed them, whilst adding new core features in a structured and logical way.

Unfortunately the market did not want Unix fixed due to the technical debt that would have to be payed back in porting existing code from Unix to Plan 9.

Thus we have “The Linux Way” which is to bolt on new stuff whilst not killing off that technical debt, just patching over the increasing cracks. It’s kind of what Victorian steam engine artisans did, they kept bolting on bits and eventually they were wasting so much efficiency they had to make bigger boilers, that just kept blowing up in their faces… It actually took an Act of Parliament to stop the downward spiral, and in the process artisan craftsmen got pensioned off and both science and engineering were born as professions to replace the artisanal aproach with facts, tests, mathmatics and logic replacing the guesswork and “bodge it and bash it into submission” mentality.

As I am known to say on the odd occasion, it’s well past time where actual computer science and engineering replaced the current artisanal approch of the majority of code cutters. But to be honest I suspect all of us will be long dead by the time that happens, if it ever does.

The reason is there is way to many vested corporate interests in not cleaning up the software industry. Some have realised that forcing technical debt on people is almost as good as a walled garden for tying customers in. Thus once captive exploit the customers dependence to vastly inflate their profit.

What is worse is we know they are doing it. We had a prime example of what happens with even simple technical debt when Y2K came along. Those that had over the preceding years had taken the time to weed out two digit years from their code saw little or no impact from Y2K other than verifying previous tests for their nervous customers and end users. Those who had not and were still dependent on 1960’s two digit code at the core got mauled financialy and effectively had to stop normal business to clean their Augean stables (but unlike Hercules they had more than a day to do it).

The thing is we know there are other epoch rollovers heading our way, such as the 32bit signed int Unix rollover in 2038[1], will we fare any better?

[1] A lot of people don’t get why dates that are in effect allways positive need to use signed ints not unsigned. The reason is you have to do comparisons with dates and the way most compares work is by simple subtraction in the CPU hardware. Thus -n is less than (sign bit set), zero is a match (zero flag set) and +n is greater than (both sign and zero bits clear). As the sign bit in two’s complement arithmetic is the most significant bit you end up with 2^31 bits of positive numbers which if using seconds as the basic number gives you a little over 68 years from the Unix epoch of 1970. Back then the largest register size in the more common computers was 32 bits. IBM and others had different register sizes such as 36bits which gave full 3bit octal numbers as well as full 4bit hexadecimal numbers or nibbles (so called because “half a bite is a nibble” which says a lot about early CompSci’s sense of humour). Of historical interest the original Intel 8086 machine code was based on Octal as can be seen from looking at the bit codings of the instruction set,

http://www.dabo.de/ccc99/www.camp.ccc.de/radio/help.txt