Schneier on Security

Clive Robinson • October 9, 2021 5:05 AM

@ Moderator, JonKnowsNothing, SpaceLifeForm,

note: many posts were lost during road-rash episodes

Like @JonKnowsNothing, I to have seen a post I made in reply to @SpaceLifeForm in the same time frame “disapear”.

This has been going on for some time, and it is noticable that the number of posts made to the blog have significabtly decreased in the same time period.

So the question of “cause -v- coincidence” must be in the back of more minds than just mine.

The fact others are breaking their posts into little pieces some of which have quite spread appart time stamps suggests they are trying to mitigate the same “road rash” problem.

Clive Robinson • October 12, 2021 9:05 PM

@ SpaceLifeForm,

I just have to prove that Dirichlet’s Theorem can apply to Quadratic Curves.

Not of necessity, there may be other proofs that have been formulated you could use, or… you could formulate your own new proof using different criteria.

Me, I prefere graphical proofs, because they are way way less likely to be open to argument and importantly are usually well within the capabilities of “ordinary mortals” with what they have to hand. And importantly usually do not as such require specialist knowledge, that even specialists in the domain may not be aware of…

The problem with infinities is there is just not a piece of paper big enough 😉

Clive Robinson • October 14, 2021 11:40 AM

@ Winter, ALL,

With regards,

“Mordechai Guri of Israel’s Ben Gurion University of the Negev described the disarmingly simple technique”

Simple and a re-boiling of an existing technique in the TEMPEST EmSec cannon.

Be aware that “The Register” article contains some misleading information, and It is not immediately obvious how they arose. So you need to read the 11 page research paper[1].

For instance The Register article has two statments,

1,

“Guri when El Reg asked about the obvious limitations described in his paper [PDF]. “However, due to environmental noises (e.g. from other cables) higher bit-rate are rather theoretical and not practical in all scenarios.””

2,

“He added that his setup’s $1 antenna was a big limiting factor and that specialised antennas could well reach “tens of metres” of range.”

One type of once specialised setup uses “Phased Array” antennas. Put simply two or more antennas spaced and angled correctly produce a much narrower beam with deep nulls so that interferance can be “notched out”. As the antennas are spaced quite an angular distance appart they effectively cover a “patch” or “volume” of space where the beams cross.

Whilst known in engineering circles prior to World War II, it was certainly made available to a much wider audiance back in the 1970’s when Prof R.V.Jones published his book about the technology war within WWII. There are a number of chapters that talk about the “Battle of the Beams” and give a discription of how they worked, and why things went wrong and the consequent devistating Blitzing / “Bombing of Coventry”. So the basic information has been available to the general public for nearly half a century, and the practical technology available for around a century or more.

But more importantly the techniques were used in early radio networking with “Space Diversity” systems and more recently multi-antenna WiFi systems.

For those wishing to dig deeper there is a couple or more decades of Open information on “MIMO” radio systems that will give you nearly everytging you need to know.

But of more interest to Network and System Admins was how this attack is possible… The standard literature implys that “Cat Cables” do not radiate, even though they contain enough radio energy to be picked up at several miles in favourable circumstances, The Register article mentions this with,

“Nonetheless, the research shows that poorly shielded cables have the potential to leak information which sysadmins may have believed were secure or otherwise air-gapped from the outside world.”

Firstly I keep saying “air-gapping” is insufficient and you need to do “energy-gapping” that does require a degree of EmSec knowledge. Fortunately much of which in this case can be found on books dealing with EMC design.

However “poorly shielded” is only part of the problem, because many Cat Cables used for Ethernet Networking are not shielded at all, they use “twisted pair” cables where two signals are sent one down either wire in the pair. When properly phased the signals cancel each other out and do not radiate. Likewise any radiated EM signals that cross the twisted pair lift both wires equally so gets canceled out by the differential receiver (which can be as simple as using a specialised transformer often called a “balun” in communications work).

However getting both the phase and amplitude of signals correct is actually very hard and requirse specialised equipment that few Network or Sysadmins would have or know how to use to achive the required “balance” of the differential signals.

But simply radio receivers which the “Software Defined Radios”(SDR) being used by the researche are have a number of specifications that define how usefull they are for this application,

1, Front end noise.
2, System Noise Floor.
3, Linear dynamic range.
4, Effective demodulator bandwidth.

The sensitivity of the radio is defined primarily by front end noise and sufficient applification such that a signal is lifted above the system noise floor. Most modern receivers if sufficiently well designed can get within a few db of the 4KTB Noise floor which for a 1Hz bandwidth is -174dbm. Which is the equivalent of 4x10e-21 Watts of CW signal. Which when compared to the ~0.1 Watts of actual signal power. So the noise floor of -174dbm/Hz is not even measurable with most standard test equipment.

Yet signals only 2x10e19W can be received at 2.4meters, 3.4meters at 4x10e19W. With standard dipole antennas, however “long-wire” antennes at the operating frequency provide noiseless “gain” as do other antennas. Like the Yagi-Uda antennes many think of as “TV antennas” and more importantly the likes of Log Periodic Dipole Antennas(LPDA).

Any one who has done “Echo 4” or TEMPEST training should know all of this. Even though they have been told the information is “classified” it’s all quite publically available in both standard Physics and Radio Engineering texts and EMC Design guides.

I could go one and on and on, but I realy do not see anything fundementally original in the paper. Oh and I was doing similar over a third of a century ago, as were quite a few other engineers.

So as I said cabbage re-boiling, yet again…

That said, hopefully it will actually wake a few people up now they can see it as practical as opposed to theoretical.

[1] The actual published paper,

https://arxiv.org/pdf/2110.00104.pdf

If you read through it you will discover nothing that has not been discussed on this blog years ago other than their software, and as far as I can remember the toggling of the Ethernet speed, which requires “root” or better access.

Clive Robinson • October 14, 2021 3:15 PM

@ Winter,

I consider $30 for the whole setup to listen into UTP quite informative.

If you look up the SDR they claim they used the HackRF you won’t get it for $30 it’s more like $300.

Mind you I can get an SDR for around $12 that goes upto ~700Mhz which should work as well…

I have help make an extensible system with some frends using multiple SDR’s connected to individual Raspberry Pi’s. The hard part is “gen-locking” if others can get the code right it will form part of a radio telescope as a building block for a 1km square system.

Clive Robinson • October 15, 2021 8:26 AM

@ Winter, ALL,

It is about the cost of fixing the flaw: $50M

Remember,

“Never an honest word passes a politicians lips, when they are on the make.”

I very much doubt the $50M figure. I doubt the annual budjet for the IT unit responsible for this is a fraction of that, and I doubt that fixing this particular bug will take more than a Man-Week.

The question is though, just how many “follow on” security vulnarabilities are involved.

Think of it this way, the SSN’s could be replaced with an encrypted version…

But even though it’s not the SSN any more it would still be a “fixed identifier” unless other work was carried out. So other design problems would quite likely still be there…

That is the fact that the SSN or any fixed identifier was used in such a cavalier fashion, does not inspire any confidence that a similar attitude was not used through out the rest of the design process.

Which tickles a thought in the back of my mind. Which is,

“Such an organisation that let this through is clearly not even competent at a rudimentry level.”

Thus what would a competent or above person in such an environment feel like?

Which raises a “prickly short hair” feeling,

“What if the system has been designed for revenge?”

That is to embarrass the heck out of the whole organisation… If you are going to encode one “embarrassment” and get it through to deployment, how about two, three or more each more subtle than the others?

What would an incompetent organisation do when facing that?

The logical solution would be to scrap the entire current system and replace it with one designed and built by people that are more competent. Which is not going to be inexpensive but $50M? I think will be unlikely.

Clive Robinson • October 15, 2021 10:09 AM

@ SpaceLifeForm, astronomy geeks, ALL,

Those strange radio signals from the heart of the milky way.

Well Andy Wang who has been credited with their discovery is being interviewed in this very resent You-Tube video about it,

https://m.youtube.com/watch?v=rpBPY71Gs5E

Clive Robinson • October 15, 2021 2:43 PM

@ The usual suspects, ALL,

This might be of interest,

https://research.nccgroup.com/2021/10/15/cracking-random-number-generators-using-machine-learning-part-1-xorshift128/

Note it’s a non-cryptographic xorshift128 PRNG not a TRNG or CS-PRNG. However as our host @Bruce is known to comment these things tend to get better with time.

From the article,

“This blog post proposes an approach to crack Pseudo-Random Number Generators (PRNGs) using machine learning.”

“This blog aims to show how to train a machine learning model that can reach 100% accuracy in generating random numbers without knowing the seed.”

Clive Robinson • October 19, 2021 5:40 AM

@ SpaceLifeForm,

There were other keywords involved.

The question “key” or offensive to whom?

For some reason we keep running into this issue in the IT subject domain and it is almost enough for the “paranoid test”[1].

For example,

In parts of Europe the word “Encrypt” is directly equivalent to “entomb” with all the sinister side issues that come with it.

Likewise in the UK the word “nonce” has distinctly unpleasent conotations yet most other places they have no problem with it meaning “Number used ONCE”.

So it’s easy to have an everyday word in one knowledge domain have entirely different meaning to others.

Worse some go around very deliberately making certain words and phrases that have been inoffensively in use for generations, have meanings they never had or were intended to have. It appears in general they do this for their own gain even if it’s just “15 seconds of fame”, thus they in turn get used by others (hence the Paranoid Test).

For instance back in the 1980’s the IT industry was minimal and “Home Computing” suddenly kicked things up several notches. One thing that came up was “the lack of women in IT”. As a result for a while a group of four women one of whom had connections to the then prestigious UK newspaper “The Times” became prominent. When you dug down their argument was it was all the fault of nasty words like “bugs” and “debugging” (I kid you not). The fact that they were totally cluless about the origins of the term and just about everything else in the IT world did not stop them getting their “15 minutes” in the spotlight, mainly at the hands of others because it was helpfull to their agendas. Unfortunately as silly as it now sounds they caused quite a bit of harm befor they thankfully were pushed back into nonentities as saner more rational minds prevailed[2].

From what I remember @FA pointed out that the issue behind “Alice and Bob” controversy at Edinburgh University was yet another sign that certain behaviours were getting out of hand (much like Political correctness did a decade or two back). And that it was not just in one or two regions such as certain western nations, but more global. Which is what I suspect @Freezing_in_Brazil was agreeing with.

As for why I mentioned the artical, as longer term readers know our host, knows Prof Ross J. Anderson reasonably well, and so probably knows Ross has recently gained a “second chair” at Edinburgh University in addition to his Cambridge University one. Thus in a way Ross has walked into a minefield of pettiness which sadly are on the rise in academia these days[3] and cause much harmful distraction and wasted effort.

[1] The “Paranoid Test” started out as a joke from the combination of two modern workplace truisms,

1, You don’t have to be mad to work hear, but it helps.
2, “Once is happenstance twice is coincidence, three times is enemy action.

Both of which are based on older truisms the most pertinent being that atributed to the author of “Catch-22” Joseph Heller,

3, Just because you’re paranoid doesn’t mean they aren’t after you.

The fact they have become workplace truisms is indicative of “the rise” in the workplace of shall we say “certain others” covered by another “Hellerism”,

4, Some men are born mediocre, some men achieve mediocrity, and some men have mediocrity thrust upon them.

Basically “Tin Pot Dictator Hiring” where a leader with psychopathic traits appoints “Yes-men” to do the Dictators biding. Assuming more or less correctly that they are so incapable, they are not a threat to the Dictator… But they can be intensely “vain, vindictive and venal”, who will also be intensely “vengeful” if they think they have been slighted in any way.

So as a “person” of above average inteligence when you get that “prickly fealing” at the back of your neck in the workplace, is it just “ordinary everyday paranoia” or some one actually taking covert hostile action? Hence the invention of “The Paranoid Test”, basically where if you ask a colleague if they thing something is odd and they say “Hey man just coincidence” it’s time to “Update the C.V. and get it out there” because “It’s better to jump, than fall or be pushed”.

[2] Currently we have been talking about the reoccurence of insanity with regards to the reporting of software defects and threats of litigation, thanks to Missouri Governor Mike Parson and his run away mouth. But it was just a short while ago we were talking about “Crypto-Wars II”. These are just the visable symptoms of the same problem which is those who can not move forward through their own inadequacy and mediocrity, but being possesed of vain, venal, vidictive, and vengfull mindsets want to drag society to their wants and whims, irrespective of how much harm it does to society. History shows that eventually all such people eventually fail as society eventually pushes back sufficiently. But like the definition of madness of “Doing the same thing over and over again expecting different outcomes” such people do the same thing over and over, to them history is not just a closed book but one that should be burned…

[3] Academia has become subject to the “Camels Nose” problem, in the US many Universities have effectively become “money machines” some are effectively “Hedge Funds” now. The result is those with such mentalities are destroying academia’s primary purpose which is to educate minds such that they can be capable of keeping society moving forward not just in the immediate but long term. Thus infighting and politics and all that realy nasty backstabing behaviours and the ability to “play” in them are rapidly becoming the primary job skills… Look on it as an infectious disease that is infecting and spreading out causing it’s own pandemic. As such an infection gains ground what you are left with are what have been described as “Crab Buckets” where nobody can rise up because everyone else pulls them down. The result is first stagnation, then society moving into reverse back out of enlightenment into the dark ages.

Clive Robinson • October 19, 2021 7:48 AM

@ Winter,

I welcome Hindi and Chinese writers using Hindi and Chinese names, like the recently discovered Wukongarchaeota…

Which is fine for “the new”, but that which is not, and has already been named, by the creator, originator, or discoverer, should not be subjected to idiots. Especially those that delude themselves they hold Thor’s Hammer thus can smash what is, as a way to obtain some form of debased self gratification.

If that is to be the case, why should I not be entitled to get rid of the very offensive –deliberately so– word for what is actuall going on “decolonized”?

Under the usual meaning of words, it does not even make sense for the use it is being put to, so actually there is no valid reason to use it other than as a smoke screen for what is actually going on.

But the point of language is clear, effective and efficient communications of meaning. Unfortunately as with many things “pragmatism” takes a role and other things such as efficiency suffer.

If other “nations peoples” decide for what ever reason to rename something in their own language that is upto them at the end of the day.

But they in turn must understand that there is a price to pay for so doing which is the disruption of communication and all that goes with it.

Take my own name, each noun has a phoneme that is not used in many asian languages, thus those who have reached a certain age who have not spoken a language with those phonemes have effectively lost the ability to say them.

What should I do? Change my name so that it can be said in every language? Well that is in reality not going to be sensibly possible. Have multiple names? That is even less sensible, and arguably illegal in some jurisdictions.

And so on.

There realy is no reason to change Alice, Bob, Eve or one or two of the others used, and they have become a “de facto standard” in common and accepted usage within the knowledge domain. As part of that process they have become vested with meaning, in that Alice is equivalent to “first party”, Bob to “second party” and Eve with “evesdropping”.

We often talk about “legalese” with long inefficient expressions and how inefficient it is and make jokes about it such as,

“The party of the first part agrees with the party of the second part to transfer in an agreed manner intellectual property that the party of the first part has entitlement too to the party of the second part who in turn agrees to…”

When Alice has said to Bob, “I’ll call you?” and Bob just nods or smiles etc[1].

As I indicated we’ve been through this nonsense before with “Political Correctness” and much that is similar. Yes there may be an underlying cause, but as I point out from time to time “You can not fix societal problems with technology” the same applies to legislation, regulation or anything with sanctionable outcomes. Because all you do is “Weaponise it”, which makes things worse without solving anything and at the very least cause harm by “Lost Opportunity Costs” and more often than not further problems due to resentment, manipulation and worse.

The actual behaviour behind this “decolonization” is the same as any “ism”, which is power over others. Only it gets used in a different way, perhaps it would be better called “neo-puritanicalism” as the purpose is at the end of the day being used as a form of “Witch Hunting” “water trial”. That is where the outcome –your destruction– was decided long before even the accusation was made, and the rest as was once said “is window dressing” to hide the truth via faux legitimacy.

[1] Which in part gave rise to the running joke of “I’ll have my people call your people?”.