Schneier on Security

Clive Robinson • May 30, 2026 4:32 AM

@ Hendrik, ALL,

With regards CIFswitch and your,

“Will this be the season of the kernel devs becoming more security conscious in their coding?”

CIFswitch is not really about “coding”

It’s actually about an architectural failing that goes back to the early days of not just *nix but other OS’s, that was basically caused by “resource issues”.

I explained this back on last weeks Squid Page,

https://www.schneier.com/blog/archives/2026/05/friday-squid-blogging-regulating-squid-fishing-in-the-south-pacific.html/#comment-454725

In essence we have a “legacy issue”… In that OS’s that originated from before the 1990’s had limited security capabilities due to “lack of resources”.

Thus as the OS’s were brought forward into this century and resources became available a problem arose…

Due to various issues in the base OS extra security was needed.

There were two basic choices available,

1, Completely rework the base OS design.
2, Add extra security as a layer over the base OS.

The first option would create no end of “legacy code” issues, so the “safe path” was seen as being the “add the extra security layer” and “encourage replacement” of legacy code.

The problem was that “adding the extra security layer” would still create “legacy code” issues, unless the layer could be bypassed by legacy code.

The not unexpected result of this is that the “extra security layer” suffered two failings,

1, It was too complex to use.
2, The default “use” for everything was “bypass”.

Thus SElinux and similar became rarely used, or too permissively configured.

This has “enabled holes in security” for “legacy code” to not just exist, but be exploitable by “ease of use” behaviours of system operators.

This “Support legacy code security model” is going to cause lots more problems and not just in *nix OSs.

Clive Robinson • May 30, 2026 9:24 PM

@ nil, r,

With regards,

“Zero Emission Pad is a simple text editor with anti-Tempest features.”

I don’t remember the name, but an editor using the UK Cambridge Computer Labs “soft TEMPEST fonts” was around back late last century.

That over the next decade things got pulled as technology improved. One such improvement was “Software Defined Radio”(SDR) that are not just very wide in frequency coverage 0.1Mhz-6GHz, but also wideband width on the I&Q outputs upwards of 1MHz became commonly available and made Van Eck “freeking” possible beyond what could previously have been possible.

But another issue was the “display technology” put simply “soft fonts” nolonger worked due to changes in graphics display systems, where “chips replaced software” and random bit dithering etc were nolonger accessable.

You can read more at,

https://www.cl.cam.ac.uk/~mgk25/emsec/softtempest-faq.html

The last time I looked –which was a while ago– there was still links based on this work up on the Internet, but they suffered from the issues identified in the FAQ.

Clive Robinson • May 31, 2026 4:06 PM

@ ALL,

“Something for the boss’s weekend…”

You might have heard there is a nasty succession of malware that gets on your system by “code reuse” and the supply chain it requires behind it failing due to the fact it can not be made secure…

The most recent was named after the “Shai-Hulud” sand worm on Arrakis in the Dune series of books, that chews up everything on the surface.

This is amusing to some as the attack if you try to remove it has a “Dead-man’s Switch” that issues an “rm -rf ~/” or equivalent[1],

That swallows all the files in the directory.

But annoying as that is, the “Shai-Hulud” infestation is down to the stupidity of badly managed supply chains for code reuse.

And the reason this happens and will happen again is something I pointed out to @Nick P and others on this blog years ago[2].

“Code Signing attests to little to nothing. All it does is a checksum on one or more files and uses a crypto signature to say it’s unchanged from when it was signed. All that really says is someone/thing had access to the private key, nothing more.”

So you can “code sign any old garbage” (and people have done). Which due to the “stupidity of trust” that people put in such things has ment that malware writers can get bad code into the “code reuse” supply chain and they have done.

Well a young lady Addie Lamarr who is getting a bit of a name for herself as a security explainer / guru has just dropped a YouTube video about Shai-Hulud and the background to it,

https://m.youtube.com/watch?v=CM8sjQcQsPs

Which should be sufficient for the “non technical boss types” in your life.

Interestingly though whilst she does mention people getting called “paranoid” for foreseeing the parts of this attack. She does not take it back to the real issue that is the fact of “trusting code signing” is a waste of time that will cause you to get bitten.

The simple fact is nobody has so far come up with a solution to the obvious “code signing” problem and ultimately it means that by far the greatest part of the “software supply chain” that of “code reuse” is a complete and utter fail as far as security is concerned…

Which has all sorts of implications that turns nearly all the ICTsoftware Industry into a bunch of “heads in the sand” types…

Yup I can already here the sound of people sharpening their pitchforks and that “flint on steel” sound of setting sparks to kindling so the “torches can be lit” and the vengeful vigilante march begin in my direction 😉

[1] The existence of “rm” CLI command on *nix systems predates just about every “file delete” CLI command on current commercial and consumer OSs. The “force -f” switch to “rm” is one of the best reasons to run backups on a very very regular basis. As the old saying has it “Crap happens” and mostly nothing you can do after the event can make up for a lack of forward planning hence “The ship was lost for the want of a hapenth of tar”… Backups are the equivalent of a bucket of tar. The “recursive -r” flag tells rm to descend into all subdirectories and the “shell ~/” is a short cut for your “home directory” as the place to start the file munching from. You can read more at,

‘https://www.geeksforgeeks.org/linux-unix/rm-command-linux-examples/

[2] With the predictable result I was called “paranoid” or was “attacked” for pointing it out, as well as not having a “drop in solution” (for which there is none, nor can there be under current assumptions).

Oh and please don’t say in the future “nobody told me”…

Clive Robinson • June 1, 2026 11:32 AM

@ Weather,

With regads,

“… you have been out of the green…”

I stopped getting paid to wear it quite a few years ago…

Now they would not take me back, even if I paid them… as my beard whilst not as Snowy as our hosts, is however getting towards looking like “swarf on a lathe bed”…

Clive Robinson • June 3, 2026 8:58 AM

@ ResearcherZero, ALL,

With regards,

“The malware spread via the mini Shai-Hulud does not activate on Russian-language systems.”

This is one of those issues of where attribution becomes a guessing game…

Back in the early cyber-crime days Putin “supposedly” gave cybercriminals immunity and protection if they did not touch Russia.

This sadly became one way to say of malware that it’s developers had Kremlin associated alignment…

Thus this became a way to run a “False Flag Operation” for other people including the CIA…

So it’s now a useless attribution indicator.

But also consider, is it actually worth trying to do standard cyber-criminal activities against Russian organisations?

The answer is,

“As the Russians are short on real money but long on real vengeance… Probably not.”

Clive Robinson • June 4, 2026 6:06 PM

@ JG5,

Sorry I tried to reply but got auto-modded, then auto-modded again after editing and re-submit…

I’ve kept a copy so I can try later “in parts” if it does not appear.

Clive Robinson • June 6, 2026 2:21 AM

@ Anonymous,

With regards,

“Fedora Linux 43 Exposes 20-Year-Old Microsoft Outlook Security Failure”

By the description this would have to have been clearly visible “on the wire” inside the Network perimeter…

Which begs the question as to why in two decades and thousands of use cases nobody once ran WireShark[1] or equivalent and noticed it[2]…

Or if they did notice… why they did not go public about it? (which bearing in mind Micro$haft’s recent reported behaviours with security researchers…).

[1] For those new to such things WireShark is an Open Source and free Network Protocol Analyser,

https://www.wireshark.org/

[2] Before any one asks me “Why not you”? I’m notorious for not having personal email as I regard it as something that can not ever be made secure no matter what you do. Back almost in the last century when it was “a new invitation only” thing, I had a GMail account that had Web Access that I “played with” so I could “support others”. As for the flip side ie work, back then we did not run MicroShaft for anything other than “desktops” (this was due to Microsoft being so late out of the barn with networking Novel was that side of infrastructure). So email MTA / servers[3] were either *nix SendMail on Sun OS’s or “Lotus” Notes and Domino. As some will know and curse Sendmail still is regarded by many with grey beards[4] as “the reference by which all others are judged”.

[3] The ins and outs of the various stages of email is fairly complex and the likes of SendMail as an MTA interfacing with user authentication systems often involves “Eye of newt and toe of frog…” along with a couple of rabbit foot amulets / totems to rub (and some M4 proficiency). So for those not standing close to the caldron and practice in stirring the pot,

https://emaillabs.io/en/everything-you-need-to-know-about-mail-transfer-agents-mta/

[4] Just remember a grey beard beneath a witches hat does not a wizard make 😉

Clive Robinson • June 6, 2026 6:21 AM

@ r,

With regards,

“we are all living on borrowed npu-time.”

There is so much wrong for humanity in the Current AI LLM and ML Systems, that it is hard to know where to start.

On this blog we’ve seen reports and articles that it is going to have a significantly destructive impact on the environment that will be dumped by legislators and infrastructure suppliers onto those least able to defend themselves (ie ordinary families and consumers).

That the hype is actively destroying the US and other economies.

That it can not in anyway deliver on the promises made.

That it is a serious data security threat.

That it is the most invasive surveillance tool so far.

That it gets things so wrong that 30-90% of the time under real world tests it “fabricates output” and in the worse cases it gets called “Hallucinations” or more correctly “soft bullshit”.

That it has been causally linked to mental harm, suicides and even murder.

And these are just some of the “bad for humanity” points…

Then there is what is happening with the IDF and US Dept of War…

In essence they are using Current AI LLM and ML systems to get tighter curves in the “kill loop” more commonly known as Boyd’s OODA Loop.

As with all rushed or snap decisions based on false, incorrect, or unverified information “collateral damage” is significantly happening.

A well known US military man General Michael Hayden, former head of the National Security Agency once said publicly,

“… We kill people based on metadata… But that’s not what we do with this metadata.”

See video clip in,

https://www.justsecurity.org/10318/video-clip-director-nsa-cia-we-kill-people-based-metadata/

That was over a decade ago before we even had Current AI LLM and ML Systems. Back then it was slow cautious humans as intelligence analysts making “the call”.

I’ve noted for a long time that the nut jobs that are Palantir want to take the human intelligence analysts out of intelligence gathering, the detectives out of law enforcement and any other similar occupied human out of the loop via what is now Current AI.

Thus my other stared concern that those with “political mantras” that have no factual or other basis can use AI systems as unregulated “Arms Length facilitators”.

What we do know where ever such “automated decision makers” have been put in place disaster after disaster has followed. The most famous is Australia’s Robodebt. In a European nation similar brought the entire political leadership down.

In the UK they are now using a similar system to attack the often severely disabled for “political mantra” and “financial mismanagement” reasons…

And people wonder why I advise “Caution not hype” should be the way we go with AI.

I’ve worked on and off with AI and robotics since the early 1980’s and I’ve seen enough to know what AI “is and is not” and to be frank it’s mostly “not” for reasons I’ve detailed before.

The few very specific areas it “is” are highly specific and little different to a mix of 1980’s Expert Systems and Fuzzy Logic. As such they can not realistically support either the cost or the hype of Current AI LLM and ML Systems.

So in oh so many ways they are little better than the childs “Spirograph” drawing tool/toy,

https://en.wikipedia.org/wiki/Spirograph

Clive Robinson • June 6, 2026 3:23 PM

@ ALL,

Was Yesterday AI Black Friday?

And if so is it,

“Bailout or Blowout time?”

I’m not up on all the details as I’m bed bound at the moment for medical reasons so my enthusiasm for hunting down corporate fraudsters and neo-con flighty types is a little low.

But it appears Broadcom had shall we say “disapointing figures” and a bit of a rout started in semiconductors,

Broadcom set to shed $300 billion in value as AI results fail to impress

The losses, if sustained, will erase more than $315 billion from the company’s market value of about $2.268 trillion, in one of the biggest one-day wipeouts ever.

“June 4 (Reuters) – Broadcom (AVGO.O) shares slumped more than 14% ​on Thursday, dragging chip peers lower, after the company’s results fell short of lofty expectations around demand for its ‌custom AI chips business.

…

The results sparked a selloff in chip stocks, with Marvell down nearly 5%, while AMD (AMD.O), Intel (INTC.O), Micron (MU.O), and Qualcomm (QCOM.O), fell between 1.6% and 6.5%. The stocks had gained sharply earlier this week thanks to a flurry of positive announcements at Computex./i>”

https://www.reuters.com/business/broadcom-tumbles-revenue-miss-clouds-ai-boom-bets-2026-06-04/

South Korean Tech Stocks likewise took a hit as well. As well as other US stocks related to AI like Microsoft.

But is this just a blip or something more architectural?

I’m not a financial analyst just some one observing for the fun of it but others are taking it rather more seriously,
https://garymarcus.substack.com/p/ais-black-friday

But one thing is true, whilst there is a lot of paper floating around AI with unimaginable figures written on them, there really is no real money to repay the ludicrous investments. What little there is goes around and around and ends up in the Chip Makers Pockets. The fact they are loaning it back to keep sales going is something that should concern everyone.

Especially as the chances are real that if a bail-out happens it will fall disproportionately on those at the bottom end of the socio-economic ladder yet again, who pay tax and have savings rather than assets.

Clive Robinson • June 7, 2026 6:54 PM

@ KC, ResearcherZero, ALL,

With regards,

“… getting ‘green’ time”

Or as the article says “touching grass”

I used to do a lot of “getting out and about” either running or ridding my bike every day. On average I used to do 500miles a week by leg power back last century.

Then on one of the rare occasions I had to travel by “public transport” it all went horribly wrong. The result is I had my head karate kicked into a a street sign post by a teenage student and got a full fracture of the lower jaw… As they say “not fun” especially as the hospital nearly killed me by neglect…

Suffice it to say I started spending a lot lot less time out doors, with the expected not good results.

However the thing I miss most is “sun on bare skin” with the right foods, it gives you a major dose of Vit D which you just can not get from tablets. The thing is it is now known Vit D helps with just about every part of your autonomous and immune systems as a “modulator”.

Very importantly it helps a great deal with stopping respiratory infections both viral and bacterial. As well as helping those with chronic stress/depression and the likes of PTSD and “Seasonal Effective Disorder”(SAD) which is now regarded as being a significant sub category of major depressive disease.

Health Care, Office, warehouse and factory workers effectively denied natural daylight are quite prone to SAD and the significant ill health consequences (apparently it can shorten your life by over a decade).

So yeh get out there and enjoy “touching the green/grass” as often as you can especially when there is sunlight.

Clive Robinson • June 9, 2026 11:19 AM

@ ALL,

“Why LLMs aren’t secure nor may be ever…”

For those that like YouTube videos security researcher Addie Lamarr posted a video on the subject yesterday,

https://m.youtube.com/watch?v=YtdLHrzZyB8

For those that prefer the written word…

It’s about the old and vexed question of what is data and what is code. That most will have heard about when learning about basic computer architectures.

Originally it was about the contents of RAM and the fact the CPU could not differentiate between data and code. Hence a whole load of security vulnerabilities arose and are still doing so.

Now consider an LLM is like the CPU in that it can not differentiate data and instructions at it’s inputs…

Hence all the “prompt injection” and related attacks we are seeing with LLMs.

Any suitable input can cause the LLM to be subverted.

The solution is supposedly “guardrails” only they don’t really work and there is evidence they might not be able to at all that has been written up as a proof (based on certain assumptions that appear valid).

So the question boils down to how to bypass the guardrails at all the inputs and outputs such that the LLM can be subverted and at the very least data can be exfiltrated.

This is where two issues can be combined,

1, The observer problem.
2, Simple obfuscation / encryption.

The observer problem is that in the case of the guardrails whilst they can look at what is the input that goes through it, it can not treat it as “instructions”. So any obfuscation that hides instructions as data will bypass the protecting guardrails.

So a simple substitution or permutation cipher will get past the “observer” acting as a guardrail.

The trick is to split the process into two parts.

1, The enciphered instructions,
2, The method to decipher them.

And send them through the guardrail for the LLM to act on.

If you think on it for a while you will see there are so many ways to obfuscate instructions as data that a guardrail can not be aware of even a fraction of them.

The fun part of this is that with people being encouraged to develop AI Agents that in effect have “access to all areas” of the users workspace the number of ways to get such obfuscated instructions into an LLM is in effect “unbounded”.

It is this issue that Addie Lamarr goes into more specifically.

Clive Robinson • June 10, 2026 4:19 PM

@ ALL

Redmond get another lashing as deserved

Quite a section of the ICT industry expressed disquiet at Micro$haft threatening to stick lawyers on a security researcher who’s reputation Micro$haft had already damaged.

Micro$haft has made some mumbles and appear to have tried to fancy foot dodge around it with no appology… And have still not answered why their extraordinarily poor behaviour should be excused or forgiven.

Well “Patch Tuesday” happened and patches were rolled out but shortly there after another zero day POC was released by the security researcher…

<

blockquote>Angry bug hunter with Microsoft beef drops new Windows 0-day

Revenge is a dish best served code

“They are angry at Redmond and will have their revenge. Nightmare Eclipse, the prolific bug hunter and possibly disgruntled ex-Microsoft employee, disclosed another zero-day vulnerability just hours after Redmond issued a record-breaking number of CVEs and fixes for June Patch Tuesday.

The latest zero-day, RoguePlanet, targets Microsoft Defender and works against fully patched Windows 10 and Windows 11 systems, according to the researcher, who also released proof-of-concept exploit code for the security flaw. Assuming the attacker can win a race condition, this bug allows local privilege escalation and leads to SYSTEM-level control over an affected machine.”

<

blockquote>

So… Even your patched Win 10 and Win 11 MS OSs have that rear entrance sense of intrusion yet again…

The person said they have decided to take a little break.

Well I wish them well and hope the weather where ever they are is nice and they get out in the air and sunshine.

I suspect though that Micro$haft will continue to try to hunt them down this time with their friends at the DoJ and FBI, because that’s the type of people Micro$haft are as I know from experience.

Clive Robinson • June 11, 2026 4:30 PM

@ ALL,

Another reason AI guardrails fail.

The almost universally touted solution to making Current AI LKM and ML Systems “safe to use” is guardrails and as I’ve pointed out before they are fairly well “doomed to fail” and quickly become a nuisance for everyone.

Well as many know Mythos has been much touted and Anthropic has previously hidden it behind “invitation only” use as Project Glasswing. Which is never ever going to have any ROI even as Marketing FUD to make a dull IPO look exciting… So having “raised the Devil” it now has to be caged…

“So guardrails to the rescue?..”

But consider the flip side of “Raising a scare for profit”, the “Mythos is to dangerous for open use” message that has effectively been put out actually has implications that,

“Can bite back hard enough to hurt”,

Cybersecurity researchers aren’t happy about the guardrails on Anthropic’s Fable

Anthropic released its latest model Fable on Tuesday, billing it as a public and limited version of its powerful and much-hyped cybersecurity model Mythos.

But not everyone is happy with the restrictions, and a number of cybersecurity researchers and professionals have aired complaints online.

“[Fable] rejects any request that could be tangentially cyber related. Even innocuous tasks like reading a blog post,” said Valentina “Chompie” Palmiotti, a well-known security researcher who works at IBM X-Force.

“When a prompt triggers its guardrails, Fable pauses the chat and says that its “safety measures flagged this message for cybersecurity or biology topics.”

The guardrails were put in place to limit the risk that Fable could be used to develop malware or compromise software — a long-standing concern within Anthropic. The restrictions on biology come from a similar concern around developing biological weapons.“

https://techcrunch.com/2026/06/10/cybersecurity-researchers-arent-happy-about-the-guardrails-on-anthropics-fable/

So the current guardrails on Anthropics Fable effectively make it useless for actual work…

This was not exactly unexpected…

I’ve indicated guardrails suffer from the “observer problem” before and the fact that they really can not work because of simple obfuscation or encryption still alows “prompt attacks” to work.

So Anthropic in a rather sad attempt to try to make the guardrails work have made their product near useless for most to use.

BUT I think it’s fairly safe to predict that one or two people will soon show the guardrails can still be bypassed in some way. It’s just one of those challenges sone can not resist…

[1] For those who might not heard of Valentina “Chompie” Palmiotti,

https://www.bbc.co.uk/news/articles/c3r2zjpryzro