Schneier on Security

Clive Robinson • April 22, 2021 3:22 PM

@ Winter,

I do not see these doing lots of damage to US companies

France has admitted doing economic espionage as it’s less expensive than R&D, and Israel have certainly been caught at economic espionage repeatedly.

The Dutch who have very lax phone tapping legislation are known to spy not just on their own citizens but many many EU and other nations citizens. Why do you think they keep poping up in EU criminal cases with evidence that would be illegal if collected by any other EU nation. Whilst the UK may have written a chunk of the malware that was used against EncroChat and other CryptoPhones, it needed the Dutch and their lax laws to get it onto peoples phones without the legal oversight or required probable cause of other EU nations. It’s why some of the lawyers are trying to get what should be illegal evidence made inadmissible.

Whilst Sweden are a little more circumspect like the UK the divison of services thus regulation alows them to spy on all sorts of people and organisations. Whilst I can not say Sweden does economic espionage, I know darn well from experience that the UK does economic espionage along with the assistance of the US.

Germany is an interesting case when it comes to the economic side of spying, yes they have been involved with it via Siemens and other German companies and assisted the US. The problem is the German oversight has issues and limited scope, hence can be walked around.

Italy is an odd one, nobody including the Italians them selves appear to know exactly what goes on, nor dors it appear they want to either. Thus it’s hard to say what they have got upto in the past and may be still doing now and how arms length it is. One thing that is known is the odd attitude to private cyber spying organisations by the Italian authorities who appear to run a “Don’t get caught and we will not need to look” policy.

Clive Robinson • April 22, 2021 3:40 PM

@ vas pup, ALL,

The drones are thought to be the latest weapons in a deadly war between the drugs cartel and the security forces and vigilantes opposed to them.

It’s a logical progression from using drones for smuggling, and they have considerable experience thus are likely to be more successful than certain terrorists.

The real question as to effectiveness is how the payload is delivered. If it’s “a bomb run” where the drone returns, then it is considerably less likely to be successful than if it’s a fly the drone into the target. We know about relative effects on accuracy from WWII planes where mostly bomb drops were done by eye and hand and had very kow accuracy. During Operation Desert Storm it became ubundantly ckear that there was a lack of air to surface capability, where to make up for inaccuracy bombs had to be four to ten times the weight of current bombs which considerably limited on target capabilities. Hence the modern day popularity of Joint Direct Attack Munition (JDAM) Smart Weapons,

https://www.military.com/equipment/joint-direct-attack-munition-jdam

Clive Robinson • April 23, 2021 12:02 AM

@ SpaceLifeForm, ALL,

So, it could be that various APT groups are exfiltrating another APT group’s tools

Remember that US IC “false flag” code that got released supposadly by mistake?

Well that did the same thing. So wr’ve known for what about a decade now that is what the US IC does, so it is to be expected that other nations ICs do the same.

It’s why I keep talking about ditching SigInt, ElInt and code analysis for atribution and go for HumInt.

The Dutch IC had a nice line on new HumInt methods, that with activating laptop webcams and microphones. But the US do not want HumInt getting in the way of a “good misatribution” so they flapped their gums in public and burned not just that method but several other similar ones in the process[1]. Remember the US on the addmission of one of their seniors “Kills by meta-data” the last thing they want to happen is “inconvenient HumInt” getting in the way of the “workflow”[2]…

[1] When you are aware that people are looking back down the pipe at you, it’s near childs play to stop all such methods working. I’ve mentioned one of many ways before on this blog that I’ve been doing for years for other reasons (mandated, instrumented choke points for “gap crossing”). The reason the methods worked is most “smart people” have “depth not breadth” and are “goal focused” and like the US SigInt policy are “all attack and no defence” in their thinking untill someone tells them… Then the shutters come down very hard and fast and that method is burned till as happens so frequently in ICTsec “people forget” and then the method will start working again with some “new kids on the block” but like elephants the “old guard” allegedly have long memories.

[2] We know from other information that such workflows are highly automated, in part because it keeps humans out of the loop as much as possible. HumInt is “inconvenient” in that it requires humans to go back in the loop, which for some is highly undesirable. Because the big benifit of computers is it’s the new “Only Following Orders”[3] which means “no one is to blaim” just like those RoboDebt/Pay systems which have driven people to suicide.

[3] It appears that the EU is increasingly worried about lack of humans in the loop and are starting to legislate against them in various so far minor ways, but then first steps are the most minor of any journey.

Clive Robinson • April 23, 2021 1:39 AM

@ Winter,

You forgot the USA spying massively on the Europeans, both political and economic

I’ve mentioned it before, I’d give you a link but I could not find it…

It’s also a very touchy subject as it conflicts with the “But we are the good guys” image required to pretend to hold the moral high ground, rather than just admit they “get down and dirty” in the pig-wrestling contest just like everyone else (I tip my hat at the French, not for doing it, but for saying that they do it and importantly why, as it kicks the stool out from under other peoples pretentions).

My father had a very rude comment about those that walk around with their nose in the air, it was almost certainly not original to him but nether the less apt… But I’ll have to politen it up so it’s fit for work 😉

Let’s just say he said it was an indicator that they had done something messy/filthy down below and were trying to distance themselves from the bad odour/taste eminating from it whilst pretending they had not done such a foul thing hence their standoffish manner 0:)

Clive Robinson • April 24, 2021 2:22 AM

@ No name, ALL,

An important point from the ABC News article on the long painfully slow Solarwinds issue is,

“The intruders in the unrelated hack of Microsoft Exchange email servers disclosed in March — blamed on Chinese spies — used wholly different infection methods.”

(Emphasis mine)

Whilst the same basic failing source “Microsoft” was to blaim and in fact Microsoft it’s self got more seriously attacked than they have admitted or I suspect even know. The real important point that is getting “brushed over” is,

It was at least two and possibly more sets of independent attackers.

But if every one realy wants to know what the “root cause” of the problem is, –because it infects the entire software industry, not just Microsoft and it’s near monopoly on OS and Office– it is rather simple,

Baked in conveniance that grows unmanagably.

Products these days only sell if these two primary requirments are met,

1, It should be as users currently do.
2, It should require no extra paid for training and certification.

These are the same two reasons why the Boeing 737 MAX disaster happened.

These “customer requirments” always end up creating a mono-culture that has decade old failings so “baked in” that it’s near impossible to get rid of “historic issues” in what is glibly called “backwards compatability”.

Which amongst many many dangers includes “Fall Back Attacks” where a “Man in the Middle” can by using “auto negotiation” failings reduce security from the best there is available to the worst lowest common denominator which can and has been “no security” without the user or system owner being aware of it. As such we need to stop this backwards compatability issue[3].

Having warned about these issues repeatedly over the years including the perils of “single passwords” and by extension “Single Sign On”(SSO)[1] I’m not surprised they have happend (no do I suspect were many “older hands”).

Which also unfortunately means,

Expect more of these sorts of attack or vulnerabilities.

[1] The root cause of this is a “human failing” that has been known for a very very long time and the reason Bank Card PINs are only four digits long. It realy hit me in the mid to late 1990’s when trying to switch OnLine Financial Transactions from “authenticate the communications channel” which is a very weak security model and easily subverted to a stronger “authenticate the individual transactions” model that is quite a bit stronger[2]

[2] Neither,

1, Authenticate the communications channel,
2, Authenticate the individual transactions,

Are sufficient these days, you also need to,

3, Authenticate the user environment,

As well.

But importantly all three authentications must be fully orthogonal and independent to each other. Which means “No Single Secrets” and “No Common Methods” at all levels, with importantly no negotiable downgrading for older systems[3].

[3] The implication of no “backwards compatability” in security is,

1, All systems should be continuously upgradable to the same higher level of security.

A requirment that can only happen if it is,

2, Put in place by regulation enforced by legislation (Mandatory Standards).

Something that is now so long overdue it’s a significant industry wide embarrassment. It’s also something I’ve banged on about for some years now, in that NIST should stop it’s “crypto competitions” untill it has come up with a standard for a “Secure Open Extensible Security Framework” to be built into all products. With regulation requiring it be “built in” befor products are placed on the market. Because history tells us that even crypro standards have a relatively short shelf life compared to many common products that have quater to half century expected service lives (think of very expensive or risky upgrades such as utility meters, medical electronics that get put in you by some form of surgery, or safety systems such as navigation equipment in remote and dangerous places).