Schneier on Security

Hijacking the PC Update Process

There's a new report on security vulnerabilities in the PC initialization/update process, allowing someone to hijack it to install malware:

One of the major things we found was the presence of third-party update tools. Every OEM we looked at included one (or more) with their default configuration. We also noticed that Microsoft Signature Edition systems also often included OEM update tools, potentially making their distribution larger than other OEM software.

Updaters are an obvious target for a network attacker, this is a no-brainer. There have been plenty of attacks published against updaters and package management tools in the past, so we can expect OEM's to learn from this, right?

Spoiler: we broke all of them (some worse than others). Every single vendor had at least one vulnerability that could allow for a man-in-the-middle (MITM) attacker to execute arbitrary code as SYSTEM. We'd like to pat ourselves on the back for all the great bugs we found, but the reality is, it's far too easy.

News article.

Tags: exploits, hacking, malware, patching, Windows

Posted on June 6, 2016 at 6:10 AM • 12 Comments

Friday Squid Blogging: Giant Mechanical Squid

It's beautiful, from the Maker Faire Bay Area 2016.

Tags: squid

Posted on June 3, 2016 at 4:06 PM • 68 Comments

Security and Human Behavior (SHB 2016)

Earlier this week, I was at the ninth Workshop on Security and Human Behavior, hosted at Harvard University.

SHB is a small invitational gathering of people studying various aspects of the human side of security. The fifty or so people in the room include psychologists, economists, computer security researchers, sociologists, political scientists, philosophers, political scientists, neuroscientists, lawyers, anthropologists, business school professors, and a smattering of others. It's not just an interdisciplinary event; most of the people here are individually interdisciplinary.

These are the most intellectually stimulating two days of my year; this year someone called it "Bruce's brain in conference form."

The goal is maximum interaction and discussion. We do that by putting everyone on panels. There are eight six-person panels over the course of the two days. Everyone gets to talk for ten minutes about their work, and then there's half an hour of discussion in the room. Then there are lunches, dinners, and receptions -- all designed so people meet each other and talk.

This page lists the participants and gives links to some of their work. As usual, Ross Anderson liveblogged the talks.

Here are my posts on the first, second, third, fourth, fifth, sixth, seventh, and eighth SHB workshops. Follow those links to find summaries, papers, and audio recordings of the workshops.

Tags: privacy, psychology of security, Schneier news, security conferences, surveillance, terrorism

Posted on June 3, 2016 at 1:36 PM • 9 Comments

Stuxnet-Like Malware Discovered

There's a new piece of malware called Irongate, which is obviously inspired by Stuxnet. We don't know who is responsible for it.

Slashdot thread.

Tags: malware, man-in-the-middle attacks, SCADA, Stuxnet

Posted on June 3, 2016 at 6:33 AM • 19 Comments

Lockpicking Competitions in the 1850s

Interesting history.

Tags: history of security, locks

Posted on June 2, 2016 at 2:20 PM • 9 Comments

Stealth Falcon: New Malware from (Probably) the UAE

Citizen Lab has the details:

This report describes a campaign of targeted spyware attacks carried out by a sophisticated operator, which we call Stealth Falcon. The attacks have been conducted from 2012 until the present, against Emirati journalists, activists, and dissidents. We discovered this campaign when an individual purporting to be from an apparently fictitious organization called "The Right to Fight" contacted Rori Donaghy. Donaghy, a UK-based journalist and founder of the Emirates Center for Human Rights, received a spyware-laden email in November 2015, purporting to offer him a position on a human rights panel. Donaghy has written critically of the United Arab Emirates (UAE) government in the past, and had recently published a series of articles based on leaked emails involving members of the UAE government.

Circumstantial evidence suggests a link between Stealth Falcon and the UAE government. We traced digital artifacts used in this campaign to links sent from an activist's Twitter account in December 2012, a period when it appears to have been under government control. We also identified other bait content employed by this threat actor. We found 31 public tweets sent by Stealth Falcon, 30 of which were directly targeted at one of 27 victims. Of the 27 targets, 24 were obviously linked to the UAE, based on their profile information (e.g., photos, "UAE" in account name, location), and at least six targets appeared to be operated by people who were arrested, sought for arrest, or convicted in absentia by the UAE government, in relation to their Twitter activity.

The attack on Donaghy -- and the Twitter attacks -- involved a malicious URL shortening site. When a user clicks on a URL shortened by Stealth Falcon operators, the site profiles the software on a user's computer, perhaps for future exploitation, before redirecting the user to a benign website containing bait content. We queried the URL shortener with every possible short URL, and identified 402 instances of bait content which we believe were sent by Stealth Falcon, 73% of which obviously referenced UAE issues. Of these URLs, only the one sent to Donaghy definitively contained spyware. However, we were able to trace the spyware Donaghy received to a network of 67 active command and control (C2) servers, suggesting broader use of the spyware, perhaps by the same or other operators.

News story.

Tags: Citizen Lab, malware, spyware

Posted on June 2, 2016 at 7:49 AM • 35 Comments

The Fallibility of DNA Evidence

This is a good summary article on the fallibility of DNA evidence. Most interesting to me are the parts on the proprietary algorithms used in DNA matching:

William Thompson points out that Perlin has declined to make public the algorithm that drives the program. "You do have a black-box situation happening here," Thompson told me. "The data go in, and out comes the solution, and we're not fully informed of what happened in between."

Last year, at a murder trial in Pennsylvania where TrueAllele evidence had been introduced, defense attorneys demanded that Perlin turn over the source code for his software, noting that "without it, [the defendant] will be unable to determine if TrueAllele does what Dr. Perlin claims it does." The judge denied the request.

[...]

When I interviewed Perlin at Cybergenetics headquarters, I raised the matter of transparency. He was visibly annoyed. He noted that he'd published detailed papers on the theory behind TrueAllele, and filed patent applications, too: "We have disclosed not the trade secrets of the source code or the engineering details, but the basic math."

It's the same problem as any biometric: we need to know the rates of both false positives and false negatives. And if these algorithms are being used to determine guilt, we have a right to examine them.

Tags: algorithms, biometrics, DNA, false negatives, false positives, identification, transparency

Posted on May 31, 2016 at 1:04 PM • 42 Comments

Arresting People for Walking Away from Airport Security

A proposed law in Albany, NY, would make it a crime to walk away from airport screening.

Aside from wondering why county lawmakers are getting involved with what should be national policy, you have to ask: what are these people thinking?

They're thinking in stories, of course. They have a movie plot in their heads, and they are imaging how this measure solves it.

The law is intended to cover what Apple described as a soft spot in the current system that allows passengers to walk away without boarding their flights if security staff flags them for additional scrutiny.

That could include would-be terrorists probing for weaknesses, Apple said, adding that his deputies currently have no legal grounds to question such a person.

Does anyone have any idea what stories these people have in their heads? What sorts of security weaknesses are exposed by walking up to airport security and then walking away?

Tags: air travel, laws, movie-plot threats, national security policy, TSA

Posted on May 31, 2016 at 6:35 AM • 82 Comments

Identifying People from their Driving Patterns

People can be identified from their "driver fingerprint":

...a group of researchers from the University of Washington and the University of California at San Diego found that they could "fingerprint" drivers based only on data they collected from internal computer network of the vehicle their test subjects were driving, what's known as a car's CAN bus. In fact, they found that the data collected from a car's brake pedal alone could let them correctly distinguish the correct driver out of 15 individuals about nine times out of ten, after just 15 minutes of driving. With 90 minutes driving data or monitoring more car components, they could pick out the correct driver fully 100 percent of the time.

The paper: "Automobile Driver Fingerprinting," by Miro Enev, Alex Takahuwa, Karl Koscher, and Tadayoshi Kohno.

Abstract: Today's automobiles leverage powerful sensors and embedded computers to optimize efficiency, safety, and driver engagement. However the complexity of possible inferences using in-car sensor data is not well understood. While we do not know of attempts by automotive manufacturers or makers of after-market components (like insurance dongles) to violate privacy, a key question we ask is: could they (or their collection and later accidental leaks of data) violate a driver's privacy? In the present study, we experimentally investigate the potential to identify individuals using sensor data snippets of their natural driving behavior. More specifically we record the in-vehicle sensor data on the controller area-network (CAN) of a typical modern vehicle (popular 2009 sedan) as each of 15 participants (a) performed a series of maneuvers in an isolated parking lot, and (b) drove the vehicle in traffic along a defined ~50 mile loop through the Seattle metropolitan area. We then split the data into training and testing sets, train an ensemble of classifiers, and evaluate identification accuracy of test data queries by looking at the highest voted candidate when considering all possible one-vs-one comparisons. Our results indicate that, at least among small sets, drivers are indeed distinguishable using only in car sensors. In particular, we find that it is possible to differentiate our 15 drivers with 100% accuracy when training with all of the available sensors using 90% of driving data from each person. Furthermore, it is possible to reach high identification rates using less than 8 minutes of training data. When more training data is available it is possible to reach very high identification using only a single sensor (e.g., the brake pedal). As an extension, we also demonstrate the feasibility of performing driver identification across multiple days of data collection.

Tags: academic papers, biometrics, cars, identification

Posted on May 30, 2016 at 10:10 AM • 31 Comments

Friday Squid Blogging: More Squids

This research paper shows that the number of squids, and the number of cephalopods in general, has been steadily increasing over the past 60 years:

Our analyses revealed that cephalopod abundance has increased over the last six decades, a result consistently replicated across three distinct life history groups: demersal, benthopelagic, and pelagic... This is remarkable given the enormous life-history diversity exhibited across these groups, which were represented in this study by 35 species/genera and six families. Demersal species, for instance, have low dispersal capacity (tens of km) and occupy shelf waters. Benthopelagic species also occupy shelf waters, but have moderate dispersal capacity (hundreds of km) largely facilitated by a paralarval phase. Pelagic species inhabit open oceanic waters and have high dispersal capacity (thousands of km) facilitated by both a paralarval phase and a mobile adult phase.

News articles.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Tags: academic papers, squid

Posted on May 27, 2016 at 4:28 PM • 159 Comments