Schneier on Security

Clive Robinson • April 25, 2021 3:00 PM

@ vas pup, ALL,

Everyday household items like spray cans, hot cooking oil, and lithium-ion batteries can potentially be dangerous.

Yup I’ve made them all go pop one way or another it’s not very difficult if you can spot the safety features and “screw/dial down on them”.

Many many years ago Revlon made a very long hairspray canister, that used a highly flammable liquid/gas as the propellent. We quickly worked out how to turn them into rockets…

As for lithium batteries you only have to look funny at some of the chemistirs and you have a fire that even sand has difficulty putting out. As I’ve mentioned befor back when designing electronic locks for doors in hotels, I saw the effects of one of our competitor’s batteries burning inside the solid hardwood door… It was not a pretty sight, and I feel sorry for any hotell guest that might be locked in on the inside of it.

Mind you few realise which step is the most dangerous in most UK houses (that ate small). It’s actually the bottom step not the top for various reasons I’ve mentioned before. Basically most people look at where their feet are on the top step but not at all on the bottom step as they are looking up to save knocking their heads on the low head hight.

Mind you with regards “rockets” fun piece of info for you… Around 45 years ago the large plastic fizzy drinks bottles from a well known manufacturer –the one with the extra curly cursive writing logo– did not use plastic caps as they dp today but soft aluminium ones.

Now I suspect every one has seen the mentos&coke fountains that go 15-30 feet into the air, well… The thing about those soft aluminium caps as I doscovered purely by accident in a ware house, is that if the bottle falls ten to fifteen feet and lands with the soft aluminium cap hotting the floor almost dirrectly straight up but with the cap striking a flat concrete floor the plastic of the bottle punches through the soft aluminium and the bottle takes of like a “water rocket” with a foaming mentos like exhaust trail. Very very messy but when you are up ontop of the stack the last thing you expect to see is the base of a bottle coming straight back up at you, and it can be quite unnerving.

Clive Robinson • April 25, 2021 11:55 PM

@ Dee, Lurker,

It’s unfortunate Bruce expected us to know what WA means.

There is a flip side to this “convenience” of a “two letter acronym”, there are only 676 available, and many of those will not have a very high probability of use ( QQ, XX, ZZ, XZ, etc). Which means that some of the remainders, are going to be very overloaded.

I guess anything with E,N,S, or W are going to be popular in “new world countries” for obvious reasons.

Clive Robinson • April 27, 2021 3:16 AM

@ Rachel,

Is there any utility, or just simply any good reason, for a non-ham to learn Morse Code?

The glib answer is “yes it expands your experience”

But the reality is rather more complex and the same question can be asked of almost anything it’s considered we have to learn.

Whilst I am passable in my native language (english), I do not realy speak any other languages for a number of reasons,

1, I know how bad I sound and a feedback mechanism makes me trip over my own tongue.

2, I can see the winces of pain in others eyes as I mangle the language to the point of almost incomprehensibility.

3, I did not learn another language when I was young enough to do so, so I’m almost set in my ways.

It’s very much to my loss as learning to speak different languages effects the way we think, both mentally and physiologically. It’s why some think we should teach children latin due to the way the language rules work.

Some languages are said to be impossible for adults to learn, because we loose the ability to differentiate tone in our hearing and thus our ability to make certain sounds. As I know my name is almost impossible to pronounce by those who lack the phonems for “C” and “R” and the converse is true, hence the anglasised versions of many oriental and similar names.

But it goes much deeper, in the West the percentage of the population that is “pitch perfect” is very small, however in many oriental language speaking countries it is above one fifth of the population. It’s been expressed by some that our ability to understand tone differences and accuracy is “learned” before we are two years old.

Supprising to many is that morse code is more similar to reading than it might appear. That is an operator who is above ~15words per minute, does not hear the letters, but hears the words, much as when we read we do not spell the words out in our brain, we simply see them.

Whilst morse letter by letter can be learnt at any age, it’s said that if you are over 18 you never learn to read it naturally by the rhythm.

I’ve seen kids who are between 7-10 years old pick up morse in as little as a “wet weekend” whilst adults in their twenties still struggle after several years. As such this raises the question of “when the best time to learn something” is, and the answer that comes back is almost always “when you are barely old enough to understand it”… If true then we are doing children a diservice by starting their education when they are over five.

The truth of this appears to be comming out in “programing” children as young as five, can and do write programs if you encorage them to do so, and they start to show a marked increase in analytic skills than those that learn later.

Which brings us around to the question of mathmatics and when to teach different number bases and systems? The sooner they get to grips with working in different number bases the sooner they get to understand polynomials, which like the abstraction of algebra is a gateway they have to go through to progress in many subjects at higher levels not just mathmatics.

But morse code is interesting for another reaaon, it is a very very sloppy code and unlike most transmission codes it plays more to the weaknesses and strengths of humans than to any machine prior to the late 1970’s.

Human senses are not linear and we realy do not work in absolute measures which is why we developed linear technology. We are in short about logrithmic responses and ratios thus rhythms. Morse Code plays to the latter two of those much as music does. Where as technology is fairly hopeless at working with ratios and rhythms as anyone who has tried to build mechanical integrators or infinitely variable gear ratios will know.

In fact we had to develop both feedback and control theory for “engines of war” before we got technology to be more “human” in response.

One of the reasons for Morse code to persevere is because it puts the hard work on humans, not technology.

I can and have built CW transmitters with only one active device, and receivers with an add on receiver using as little as just a single diode, and using Morse Code been heard more than 500kM away. However to carry voice the same distance needs not just a lot more complex circuitry (audio amp to “plate modulate” for AM) it requires quite a bit more power[1].

Which untill recently this has been used as an argument for “emergancy signaling” in that if all you can get working in a damaged transmitter is the oscillator, then by connecting it to an antenna you can communicate with morse code, even if it’s just to send “SOS” and your position, without needing a reply.

However you don’t even need a RF transmitter to use morse, a flash light or flag or just knocking on brickwork or pipes is sufficient. And morse code is rather more efficient than the old prison “knock code” where letters were sent as two sets of taps from 1-5 to form a 25square in which the letters were placed (see Polybius Square[2]).

Thus the question arises do you need to “learn to be fluent” in a language or code to understand it? No, But to take advantage of it to best effect Yes, and the younger you start the more the benifit.

[1] Morse code is sent by turning a Carrier Wave(CW) signal on and off. In theory it’s bandwidth can be 0.7 of the maximum baud (symbol) rate. You can send Morse in as little as a 50hz bandwidth. Spoken audio requires about a 3khz bandwidth or 60 times as much bandwidth. But to transmit it as Amplitude Modulation(AM) you have 50% of your power in the carrier, 25% of your power in one “side band” and 25% in the other side band. So not just double the bandwidth but around 240 times (~25dB) the power to go the same distance and be inteligable.

[2] The Polybius Square is probably more familiar to people as a way to make a “simple substitution code” by “fractionation”. In essence you write the alphabet in in a pre-agreed random sequence. Whilst it is a very weak code, it is marginally stronger than a Ceaser Cipher. However you can make the knock code more efficient if you first sort the alphabet into it’s usage frequency and write it in from the top left corner in the diagonal so E is in 11 and Z is in 55 thus the more frequent letters use the shorter codes. Morse Code uses a similar principle, allegedly based on the number of letters and position of letters in a printers block.

Clive Robinson • April 27, 2021 4:14 PM

@ ALL,

Apparently You-Tube has upped it’s game against those that do not want to play in their “data violation” games.

Up untill a couple of hours ago it was possible to get access by turning cookies off but leaving javascript on (not a wise choice but one some used).

Well now they accuse you of being a robot, thus throw up one of those highly discredited “spot X in Y photos” that require you to have cookies enabled…

Is this just in UK or are other people seeing it else where?

Clive Robinson • April 28, 2021 11:38 AM

@ lurker, Mr Peed off,

YT works for me with js on, cookies off, but I did load the site before purging and switching cookies off.

That is how it runs for my friend, but yesterday they were getting the “prove you are not a robot” nonsense for a while.

But now everything appears as it was again… But for how long? Which makes me think YT are “testing again”[1].

Anyway thank you both for getting back to me I’ll let you know if it happens again for any of my friends and family again.

[1] Unfortunately after Brexit the UK is apparently a safe place to try extream surveillance tech out on people without their consent. Which is why their ultra invasive user type binning technology in Chrome is being trialled in the UK…

Clive Robinson • April 28, 2021 2:24 PM

@ Mr. Peed Off,

As usual The Register makes “snarky Linux comments”,

“IBM tentacle Red Hat”

Which spoils the actual message.

Linux along with the BSD’s have both been slimed down to be put in $1 microcontrolers to do “automation” work, something that kind of gets lost behind the Raspberry Pi and BeagleBone SBC fan fare in the Maker and similar community.

However… *nix is not realy a good idea for use as a Real Time Operating System(RTOS). Because of the fundemental way it does “multi-tasking” means you can have a very slow response time to real world events, something you do not want in your vehicles breaks etc. Also in general *nix has appaling behaviour as it moves into base resource contention such as core memory.

There are “Real Time patches” for both Linux and BSD, it’s been a few years since I played with them on embedded Linux and I’ve only read up on the BSD ones.

The Linux “Real Time”(RT( did not exactly impress me at the time which is why I’ve not looked at them in over a decade.

The problem with non RT systems is developers tend to forget the difference between “peak load” and “average load” and most importantly peak load is very very difficult to test for. Thus you could be “thrash testing” for over a year before you get close to peak load and the house comes tumbling down. The result is almost always the underlying non RT or halfway-house RT systems get grossly underspecified, thus when they “let go”, they realy go big style. Often not just bringing down lots of front end apps but the important hardware control systems indiscriminately… Which means fail safe is not possible in all cases, just some of the average ones.

Communications engineers tend to be aware of “N^2 peak capacity” that is for N independent but equal level signals the linear power in an amplifier is N^2 x SigPwr. So for ten one watt signals you need an amplifer not with ten watts linear output capability but a hundred watts linear capability…

Similar applies in resource planning for RT systems.

Clive Robinson • April 29, 2021 2:47 AM

@ Mr. Peed Off,

With regards the Linux backdoor

“The backdoor, dubbed RotaJakiro by researchers at Qihoo 360’s Network Security Research Lab (360 Netlab), remains undetected by VirusTotal’s anti-malware engines, although a sample was first uploaded in 2018.”

The article is short of information such as how it gets a toe hold and what the differences are if the user is root or not (and importantly how).

But with C&C / C2 controlers having been around for some time,

“Command-and-control servers historically used by the malware have domains registered six years ago, in December 2015, all of them “

With either very low use or detection in the past 2-3 years,

“Since 2018 when the first RotaJakiro sample landed on VirusTotal, 360 Netlab found four different samples uploaded between May 2018 and January 2021, all of them with an impressive total of zero detections.”

Along with related malware,

‘RotaJakiro and Torii also share multiple functional similarities, including “the use of encryption algorithms to hide sensitive resources, the implementation of a rather old-school style of persistence, structured network traffic.”‘

Suggests the two so far known are,

1, Developed by a team.
2, That has existed atlest a decade.
3, That uses a cautious thus stealthy approach.

Which suggests a “Level III” well resourced probably State level funded organisation.

The fact it is aimed at Linux rather than MS OS’s or Apple is suggestive as to who/what it is aimed at.

The simple fact is the number of Linux Desktop users out there is still small on PC hardware and as a rough rule of thumb used by more advanced users who know about ICT or work in it rather than other more traditional office users where MS Office or Web Browsers are the apps they tend to use.

That is the main use for Linux on 64bit hardware in organisations is for “back-end” functionality such as servers rather than users.

The place the Linux desktop has made inroads though is in Smart Devices, and similarly Linux in CLI or Headless use in embedded systems used in networking and IoT devices.

Not much more can be concluded without further info, which appears publically lacking currently.

Having looked into covert malware befor it got the APT acronym, and realised what I could do with it if I wanted to, was one of the reasons[1] I decided to disconnect my personal systems from not just “intentional communications networks” but “unintentional communications” as well.

As I’ve mentioned before one of the first questions I ask is,

“What is the business case for this system being Internet connected?”

And you would be surprised at how many can not give anything other than “MBA Mantra” style replies (some have even included words like “synergy”… I kid you not).

Most organisations spend more on physical security than they do on ICT security, and they wonder why they have malware etc issues. Realistically though, most people can see or understand “physical security” but not “information security” and that is a major problem in of it’s self…

[1] There are other reasons for my “hard segregation” policy decision, including work I’ve done on both passive and active surveillance equipment from back in the 1980s and onwards. But the upshot is from a more general view point, I have to run some very old OS’s and hardware including MS-DOS 5 and Win 3.1 as I developed what we now call ICS software on them I still support. Likewise hardware development where the toolchain only works with real serial ports not USB etc as they talk directly to the chipset…

Clive Robinson • May 1, 2021 6:57 AM

@ Rachel,

Clive you focused on the need to learn before the age of 5. As we can safely guess you are highly competent in the use of Morse , if you learnt Morse Code after age 5 then you contradict your line of reasoning.

I indicated that certain parts of the process which is the auditary sensing was best learnt as early as possible. It’s what is assumed[1] to be the reason behind why some people can never learn certain parts of a language as they do not have the ability with certain phonemes (the C and R in my name) yet have many many times the number of “pitch perfect” people in their population.

The ability to learn morse easily was found during WWII to be quite age related and they found those under 18 learned faster and better than those over 18.

With regards my ability with morse no I’m not profitient in any way any longer I just don’t use it and have not for decades.

I started learning morse code back in the early 1980’s not to use it, but to get the HF provison of the license. So I was never going to put the hours in any way. But as often happens about when I was sufficiently profficient various changes happened and I did not take the test (it’s why I’m not a G4). Also my reason to get the licence was for “experimenting” not “contesting” or “rag chewing”. I did almost all my operating over the years calling “testing testing testing” not “CQ CQ CQ”. But could send my call sign in morse when required.

There is a saying of “If you learn it well you remember it well”…

Let’s just say I never got into the rhythm and certainly never got to the point of hearing the sound of words in morse. It takes a lot of practice and their is a brick wall effect around 15WPM where you can nolonger grab a letter at a time but have to grab the words (if you can call them that, most morse is so full of codes it might as well be random letters to anyone who has not learnt them).

My intetest in morse kind of stopped when I’d finished developing a program for my Apple ][ to not just send but importantly for the time receive it. I then went on unsuccessfully trying to write a program to recognise phonemes thus speech (technically known as a discrete utterance speech recognition engine[2] it was not a success due to lack of computing power).

So my knowledge on what does and does not happen in humans and when is based on researching others research when trying to get a computer to replace the human.

Which brings us to,

A big one is ‘need to learn as a child or the opportunity is lost forever’.

Is true, when you actually know what it is that is being learnt. Learning “new skills” rather than “new things” has over many years been shown to have an age related component. Learning a new latin language is not learning a new skill, but learning a new thing for which you have already aquired the skills.

There are languages that have a “tonal or pitch” content that if you are “tone deaf” you are never ever going to learn. As I’ve mentioned oriental languages have a tonal component, with some to Western ears sound realy unpleasent as we tend to regard the tone as an “emmotional side channel” with a deep voice indicating being in control and with a tonal flatness as being not emotionaly perturbed. Whilst high frequency as panicky and animated tonal content indicating very high emotion such as anger or being scared or both.

But if you speak one of most Germanic/latin languaged you already have the skill set, you just need to learn new things which again you are often more than half way there with. It’s known for instance that those who speak German usually pick up other languages fairly easily because it requires a broader range of skills than speaking english.

But you see a problem with skill sets and the switch from gutteral languages from Northern Europe to more sibilitic languages such as the Romance languages.

Sibilants are made by the use of the tongue and forced air preasure and do not require the use of the vocal cords or throat (try saying “shhhh”). They sound notably louder than their non-sibilant guteral or frictive counterparts due to most of their acoustic energy occuring at higher frequencies. Importantly though skill with sibilants requires fine motor control of the front of the mouth thus face muscle control (as does tunefull whisteling). It’s why people who speak romance languages appear to have younger thus more attractive faces because their cheek bones look higher due to the improved musculature that gutteral languages do not need.

Thus learning a language with a high content of sibilants from a language that does not, requires both the learning of new skills and the learning of new things.

Which brings us to the difference between “skill” and “knowledge” many see them as being compleatly different that is it is almost as “physical” skill or it is “mental” knowledge. Which kind of misses the point, after a few moments thought most sgould realise that it is a spectrum, or more correctly a hierarchy of levels which is why I have used “things” not “knowledge” upto this point because most of what you actually have to learn when learning a new language is those bits in between and you have to build them up just like you do your face muscles.

The problem is we have no real idea how people learn. Take a fine motor skill such as pen manship it is assumed that you “pick it up with time and use” actually more recent findings suggest that’s about the worst way to do it. One interesting way to do it which has been shown to work is “thoughtfulness” that is you do not “do” but “think” your way through the action. You see this best with certain types of marshal art, where you go through the movment very slowley thinking where each part of your body should be. This slow highly thoughtfull process builds the skill into the lower levels of the hierarchy thus when you make the movment at full speed it is precise, efficient, and controled. There is some research going on into teaching people to learn to drive this way but I’ve yet to see the results.

Which leads into,

‘you remember something best if you learn it just before you are about to forget it’.

Whilst that may be true for “knowledge” how about “skills” or the “things” inbetween?

It kind of flies in the face of the old saying,

“Once you learn to ride a bike you never forget”.

It’s safest to say we know way less than we think about learning. Even the old “people think in three ways”,

1, Those who use words.
2, Those who see graphs/pictures.
3, Those who see formulars/equations.

With the obvious implication the order of efficiency is using words the least and equations the most. I try to do all three but I still have troubles going from the symbols of equations to the meaning without going through the picturing of graphs and flows.

But if you want to try it, imagine that learning an individal fascit is an effort process that is more or less linear. However your ability as your skills build is fairly obviously a percentage growth or more accurately an exponential one, the limit is your ability to form the chemicals and neurons to retain what you learn. We have reason to believe that neuron development has an inverse relationship with age, and what nasty chemicalls we poison our bodies with. Sadly good nutrition and clean living only takes you up to your supposed inate limits.

Anyway back to morse and my non use, my health being somewhat on the decrepit side, and having had a mis spent youth wearing the green my hearing is realy quite bad these days[3]. And whilst I can sort of lip read, COVID and masks has made me appear deafer than Beethoven… Very much to others anoyance my hearing appears to come and go, but speaking on any kind of phone is both difficult and embarrasing even with people I know. So I’m “mic shy” with radio as well, even though headphones and parametric equalisers on each channel do help a lot. Thus my interests are more in the non audio data modes of ameture radio these days. But whilst I do “listen in” to morse from time to time it’s more “watch in” as even idi-bidie $1 microcontrolers have the power to decode morse code if you filter it correctly and that is something I do know how to do with both analog and digital filtering.

Thus you might think I was a natural fit for social media but trust me on many levels when I say I’m not 😉

Anyway now I’m in “me time” I’ve a minor project to shuffle along[4].

[1] It’s assumed, as experiments to prove it would be quite unethical. However there were experimrnts done with bringing kittens up in a world of only vertical stripes then after a period of time putting them in a world of only horizontal stripes and observing the differences (and another group the other way around). However experiments with adult humans where they wear glasses that turns the world upside down shows it takes about 3-7days to adapt and slightly less to unadapt. Other tests have shown that removing one sense such as sight has an enhanced effect on other senses souch as hearing and touch.

[2] Whilst I could get the Apple ][ to do waveform matching it was way to much load on, 1MHz 8bit chip to do much more than that. Whilst I did start devekoping external hardware, it was not going to be a practical thus marketable product. It was around a decade and a bit later at the end of the 1990’s with 50MHz and faster 486’s being common on peoples desk tops that others finally got things working enough to be commercial products. But by then my interests had moved on to doing interesting things with video and encryption, which again suffered from lack of hardware grunt. My interests moved on and I started looking into making a properly secure computing system, you can read about bits of it here on this blog if you search for Castles v Prisons and C-v-P or as @Wael ended up calling it CvP. And yes it has a hardware issue as well though as pointed out to me by @Thoth after we had discused on and of using smart cards, somebody from Cambridge Computer labs started marketing a design based on what had been said on this blog… I’ve no idea if they made a commercial success of it or not.

[3] It’s actually difficult to explain the effects and probably why some maliciously call tinitus “selective hearing” as though sufferes do it deliberately. In my case it’s,probably due in part to the use of weapons and similar and I’m also told probably related to several boughts of labyrinthitis (which is what is believed caused Beethoven to go deaf). But trust me when I say which ever way does not matter, you realy realy don’t want the whistles, buzzing, squeaks and gurgles 24×7. For instance I can talk to people on a reasonably busy street, but go into a Mucky D’s and the noise inside just triggers it and placing an order is very very difficult if not imposible, which is why the cheap vouchers came in handy you just handed the cashier the voucher and the money…

[4] It’s a bit of fun, as you might know “stack based” OS’s and languages have a lot of advantages over more traditional ones in such things as you do not need MMU’s so high end microcontrolers can multitask without problems. However in general stack based systems are “type limited” that is values are put on the stack and that puts a limit on the size of unsigned integer to be that of the CPU data bus (usually but not always the maximum size of pointers as well). Which means all other types have to be compound which is messy on stacks or less than the range of the pointer or long unsigned int. So what I’m doing is building a stack based system that uses pointers for everything on the stack, these point to structures that then hold type information and methods. So far it’s working OK with 1kByte int’s and floats and complex numbers. I need to get matrix types working and then get onto the more interesting “crypto types”.