Schneier on Security

Clive Robinson • February 3, 2025 8:33 AM

Zero-Click, the modern curtain twitching.

From the article we see,

“Experts said the targeting was a “zero-click” attack, which means targets would not have had to click on any malicious links to be infected.”

It’s a bit more complicated than just telling users Do Not “click on any malicious links”…

Without going into lots of details, it’s possible to send somebody a message where the users “Smart Device” phone does something really “Dumb” like “pre fetch” images and the like thus do the equivalent of a user clicking…

But the other thing which really annoys me about people talking glibly about “malicious links” is that even Security Experts can not actually “Positively identify” them as being “malicious links” untill they follow them… So,

“How the heck do we expect ordinary users to be able to magically know every time what links are malicious or not?”

Personally I blame the likes of Microsoft, Google, and other major software developers in the industry. Because they talk a lot about “User Security” and then do just about everything they can to destroy user security in the name of “User Convenience” or some other “Marketing Nonsense”.

Further we know that they can not find vulnerability exploits in code despite their special teams…

Just ask yourself how many times have you heard about “malicious exploits” in the software they say is OK to go in their “Walled Garden” App Stores and similar.

As long as this nonsense goes on then the likes of “Paragon Spyware” will be continued to be developed and made available to be used by all sorts of undesirables and criminals.

If we want to reduce it we have to treat Microsoft abd Google etc like those who “grow or manufacture” drugs. That is send in the military with flame throwers etc. Because if the War-On-Drugs has taught us one thing, “as long as their is product, then a market will exist to trade it”. It’s the same with vulnerabilities lock up the producers and burn the product, then others might learn there “Individual Rights” to push bad product for profit is capped by “Societal Responsability”.

Clive Robinson • February 7, 2025 4:19 PM

@ ALL,

With regards the UK Gov and Apple over encryption, the fact that it’s garnered a fair few comments already suggests it’s a matter of interest.

So when you see in an MSM news article,

“Security officials in the United Kingdom have demanded that Apple create a back door allowing them to retrieve all the content any Apple user worldwide has uploaded to the cloud, people familiar with the matter told The Washington Post.”
“

You need to dig a little deeper.

Firstly the reason it got mentioned in a US newspaper first, is not a sign that the UK MSM is failing. What it tells you is that there are significant “reporting restrictions” but “once the mouse is out of the hole” any cat can chase and pounce on it by quoting or reporting or verifying on what the foreign MSM has printed.

There are still things the UK MSM can not reveal unless they are first formerly revealed to them (and no that does not include “whistleblower statements” or copies of official documents see DORA and the two OSA as well as RIPA and subsequent nonsense legislation “dirty laundry by officialdom” gets hidden behind).

So keep your eyes on non UK MSM for now, however as a UK citizen, whilst I can point you to UK MSM reporting as I have done, pointing to non-UK MSM can get me into rather more than hot water.

But there are other “Technical Things” I can say that although the UK-Gov would very much rather I did not… As they have been in the “Public Domain” for quite some time and are the consequences of what are in effect “laws of nature and mathematics” I’m reasonably safe.

One such is to point out “Shannon Channels” and how they relate to cryptography.

Every communications path is a “Shannon Channel” basic information theory that really can not be “arm waved against” says that every channel that carries information must have redundancy within it to be able to do so. It’s one of Shannon’s fundamental points and it’s quite important.

Another researcher pointed out that if there is redundancy, then you can use this to set up a Shannon Channel within a Shannon Channel.

More importantly it was also shown that information “meaning” in the inner channel can be kept from any and all outer Shannon Channels.

Thus the UK-Gov request fails.

Because Apple can not give the meaning of what is in the “Inner Shannon Channel” unless certain information has been made available to Apple.

At the simplest level if Apple do not have access to the “Secret Key” used to encrypt the messages all they can hand over is the encrypted files and whatever public Meta-Data exists about them. Whilst with sufficient Meta-Data it might be possible to deduce Meta-Meta-Data, that would mostly require simple failures by the 1st & 2nd parties in the communications. This information in a more extended form has been in various “undergraduate text books” for years and also in declassified information about the likes of TEMPEST and Traffic-Analysis. Fun thing some of those undergraduate texts are actually “Physics texts” not “Communications or Information texts”.

I’ve previously described how to use One Time Pad encryption to give “deniable encryption” that is as sent apparently “plain text” thus it’s near impossible to show there is a Shannon Channel within a Shannon Channel.

Thus with a little thought, it’s possible to neuter the UK-Gov requests, and if you go about things the right way little they can do unless they decide “Disappearing You” in one way or another is their only method of persuasion.

Which is why the original “Regulation of Investigatory Powers Act”(RIPA) contains legislation to that effect. That said so far as far as we can tell Judges recognise the danger of this and either do not allow it or give very minimal sentencing.

The problem for most users of encryption is they are not very switched on, thus they take the word of “Application Developers” need I say,

“This is actually worse than rolling your own crypto”

In oh so many ways.

I still recommend using “off communications device” encryption and “hand to hand KeyMat exchange”.

Where the encryption is “Perfect Secrecy” based and produces “plain text” as enciphered text using no more than pencil and fast burn “flash paper”.

If you want security in a modern heavily backdoored technical gizmo world, you actually have little choice than to go “Old School” of World War II SOE etc techniques. That likewise have been sufficiently documented in the Public Domain.