Schneier on Security

Richard Steven Hack • July 29, 2011 8:01 PM

While it’s a nice idea, the only problem with saving the “off topic” stories for the squid thread is that it will end up being confusing with several different stories being discussed in the same thread.

OTOH, that’s probably not so different from the current situation. 🙂

The real problem is there’s just too much fun stuff to talk about in security. And too many smart people here to discuss it with! 🙂

Meanwhile, the Antisec crowd nailed another FBI security contractor, Mantech. The hackers point out: “”What ManTech has to do with the FBI? Well, quite simple: In Summer 2010 the FBI had the glorious idea to outsource their Cybersecurity to ManTech. Value of the contract: 100 Million US-Dollar.”

Richard Steven Hack • July 30, 2011 9:45 AM

Wish I’d known this back when… 🙂

Researchers Say Vulnerabilities Could Let Hackers Spring Prisoners From Cells
http://www.wired.com/threatlevel/2011/07/prison-plc-vulnerabilities/

Of course, where the hell you go once the cell is sprung is another matter… Even if all of the prisoners are sprung at once with the intent of starting a prison riot and mass escape, there’s no guarantee anyone can make it out of the facility.

You’d have to spring ALL the doors and almost all prison facilities have multiple sealed doors between the housing units and administration area, let alone the outside world. There are some exceptions – Florence Federal Correctional Institution has only one set of mantrap doors between the housing units and the central grounds, for instance. It’s a medium security facility, which means surrounded by double alarmed fences topped with razor wire and guard patrols between the fences.

OTOH, the Alameda Country Jail in northern California has locked doors between the housing units and the mess hall, between that part of the building and the external corridor (and the central control room for the housing unit), and between the corridor and the central yard – and more doors between the central yard and the administration portion of the facility. Some of those doors are large sliding steel doors which are quite impenetrable if locked. The entire facility is poured concrete. Getting out of that facility would not be easy even if you had the run of the place.

Richard Steven Hack • July 31, 2011 12:05 AM

Following up on the post above about Anonymous hacking cops:

http://zone-h.org/mirror/id/14515221

Quote:

“In retaliation to the unjust persecution of dozens of suspected Anonymous “members”, we attacked over 70 US law enforcement institutions defacing their websites and destroying their servers. Additionally, we have stolen massive
amounts of confidential documents and personal information including email spools, password dumps, classified documents, internal training files, informant lists, and more to be released very soon. We demand prosecuters immediately drop all charges and investigations against all “Anonymous” defendants.

The 10GB of private law enforcement data contains:
* The mail spools of police officers from dozens of different PDs
* Usernames, passwords, social security numbers, home addresses and phone numbers to over 7000 officers
* A list of hundreds of snitches who made “anonymous” crime tips to the police
* Hundreds of internal police academy training files

The leaked data also contained jail inmate databases and active warrant information but we are we redacting the name/address info to demonstrate how those facing the gun of the criminal injustice system are our comrades and not our adversaries. On the other hand, we will be making public name and contact
information about informants who had the false impression that they would be able to “anonymously” snitch in secrecy.

End Quote

Quote:

While many of the recent “Anonymous” arrestees are completely innocent, there is no such thing as an innocent cop, and we will act accordingly.

“The day will come when our silence will be more powerful than the voices you are throttling today.” – August Spies, Anarchist Haymarket Martyr

End Quote

I’m beginning to love these guys… 🙂

Quote:

“Sheriff John Montgomery says the server for the sheriff’s website was shut down Tuesday. He also says he doesn’t have any specific information about a hacking incident, but that he’s not too troubled about any alleged security breach.”

YEAH WE OWNED YOUR NEW SERVER TOO! SHOULDA EXPECTED US … HACKLOG COMING SOON!!

End Quote

Quote:

Over 70 US law enforcement institutions were attacked including:

20jdpa.com, adamscosheriff.org, admin.mostwantedwebsites.net,
alabamasheriffs.com, arkansassheriffsassociation.com,
bakercountysheriffoffice.org, barrycountysheriff.com, baxtercountysheriff.com,
baxtercountysherifffoundation.org, boonecountyar.com, boonesheriff.com,
cameronso.org, capecountysheriff.org, cherokeecountyalsheriff.com,cityofgassville.org, cityofwynne.com, cleburnecountysheriff.com,coahomacountysheriff.com, crosscountyar.org, crosscountysheriff.org,drewcountysheriff.com, faoret.com, floydcountysheriff.org, fultoncountyso.org, georgecountymssheriff.com, grantcountyar.com, grantcountysheriff-collector.com,hodgemansheriff.us, hotspringcountysheriff.com, howardcountysheriffar.com,
izardcountyar.org, izardcountysheriff.org, izardhometownhealth.com, jacksonsheriff.org, jeffersoncountykssheriff.com, jeffersoncountyms.gov, jocomosheriff.org, johnsoncosheriff.com, jonesso.com, kansassheriffs.org,kempercountysheriff.com, knoxcountysheriffil.com, lawrencecosheriff.com,
lcsdmo.com, marioncountysheriffar.com, marionsoal.com, mcminncountysheriff.com,
meriwethercountysheriff.org, monroecountysheriffar.com, mosheriffs.com,
mostwantedgovernmentwebsites.com, mostwantedwebsites.net,newtoncountysheriff.org, perrycountysheriffar.org, plymouthcountysheriff.com,poalac.org, polkcountymosheriff.org, prairiecountysheriff.org,
prattcountysheriff.com, prentisscountymssheriff.com, randolphcountysheriff.org,rcpi-ca.org, scsosheriff.org, sebastiancountysheriff.com, sgcso.com,sharpcountysheriff.com, sheriffcomanche.com, stfranciscountyar.org,
stfranciscountysheriff.org, stonecountymosheriff.com, stonecountysheriff.com,talladegasheriff.org, tatecountysheriff.com, tishomingocountysheriff.com,
tunicamssheriff.com, vbcso.com, woodsonsheriff.com

End Quote

Richard Steven Hack • July 31, 2011 12:24 AM

Clive: “”Getting out of that facility would not be easy even if you had the run of the place”

What’s your meme about security?

I know someone who claims that if ‘food and water can get in, and waste out, then given time people can and will get out.’

Oh, sure. I was talking about how if you got out of your cell as a result of someone springing your lock, you’d still have a problem getting out of the compound, particularly in the case of an active response from the staff.

The Guardian case is in a prison with bricks. Most of the new prisons in the US are poured, steel-reinforced concrete. Even the bunks and desks are just extruded out of the wall. The only possible exit might be through the toilet if you can rip it out. The only window – which is thick safety glass (which can be set on fire and broken that way, I’ve seen that done) – is too narrow to fit a human head through.

The one vulnerability I noted at Alameda County Jail was the small court used for recreation in each housing unit. It’s monitored by cameras. The only escape route would be to somehow get up to the 20-foot high roof which is open and covered by a wire mesh. Spiderman or someone well versed in climbing probably could do it – if he had the tools to get through the mesh. That would put him on the roof of the facility from which presumably he could get close to the surrounding fence.

Probably the only realistic way to escape from one of these facilities is by social engineering. Allegedly someone was preparing to try that at Florence FCI. They managed to somehow acquire one or more guard uniforms and hid them in the chapel. The idea apparently was to disguise themselves and somehow talk their way past the various checkpoints into the administrative area and out the front door. Someone ratted them out, however.

Reminds me of the Peter Sellers movie where he had someone come in who looked like him while he escaped. When he got outside, he tugged the “fake” beard, which wouldn’t come off. He exclaimed, “The wrong man has escaped!” 🙂

Richard Steven Hack • August 1, 2011 7:08 AM

GAO report blasts DoD computer security ability:

Is it time for the Pentagon to turn cyberwar over to someone else?
http://www.itworld.com/security/187699/it-time-pentagon-turn-cyberwar-over-someone-else

Quote:

There is a military term for armies so uncertain of their own skills, resources, strategy and command that the enemy is able to find out more from spying missions than the commanders can by asking questions:

The term is “loser.”

End Quote

Richard Steven Hack • August 1, 2011 10:47 AM

Interesting:

Feds Say They Can Search Bradley Manning’s Friend’s Laptop Because They Can
http://www.techdirt.com/articles/20110729/17410415325/feds-say-it-can-search-bradley-mannings-friends-laptop-because-it-can.shtml

Especially this part:

“On a separate note, the reason given for having to keep House’s laptop for so long? Because the laptop ran both Linux and Windows and the tech geniuses at Homeland Security had trouble understanding how to deal with that.”

Richard Steven Hack • August 2, 2011 2:30 PM

Nick P: “Preventing recovery of the data in the event of equipment seizure is the purpose. The protection of the owner is a separate issue.”

But it’s actually not if the fact of preventing recovery puts the owner directly at risk. And it’s not just criminals that are the issue, it’s law enforcement. And not necessarily US law enforcement.

RobertT: Your imaging solution is good only if you don’t actually need to take any data with you that might be incriminating.

In that case, clearly the only solution is that the data should go separately from any device that might be searched. Which means either concealed in a flash device elsewhere which is fairly certain not to be found even with a fairly complete tear-down – or it has to be carried by someone else not likely to be inspected (like those unwitting drug mules discussed earlier) – or it has to go by the Internet.

I think when one is deliberately confronting authority – such as at a border crossing – the only rational approach is to have a computer that is completely clean – and to know the country’s laws so you can be sure what you do have on it IS completely clean under their jurisdiction.

Just like any hacker with brains has his home PC completely clean and uses a separate machine hidden elsewhere which cannot be discovered or traced to him to do his hacking.

With near ubiquitous VPNs and wireless these days, why carry (dangerous) data around when you can access it fairly securely from any place with Internet access?

Richard Steven Hack • August 2, 2011 8:24 PM

Anonymous: You’re probably right. The case in point was someone connected with Wikileaks in some manner. However, that’s not a movie plot, but a real situation in which there wasn’t even any allegation of impropriety on the part of the individual. It was simply an investigation because of the individual’s being involved with a support network for Bradley Manning. There was ZERO probable cause to seize House’s laptop.

Like Thomas Gabriel said in “Live Free and Die Hard”, “The rules can always change.” And governments like to change the rules to suit them, as in the House case, which is why DHS is being sued.

So the problem generally is you can’t be sure what circumstances you’ll encounter in every case. You could walk into Abu Dhabi right after some Mossad or Al Qaeda hit locally and everyone is paranoid and checking everything. Or more likely, you come home from Abu Dhabi right after another terrorist hit in the US and the US security is on full alert and checking everything.

So the point is if you have anything at all questionable on a laptop (whether legally questionable or just proprietary or personal), don’t take it into the presence of authority, especially at a border crossing.

You may be right about the rules being the issue with a dual boot system. But 1) I don’t really see how those rules couldn’t be applied for two OS just as well as one – unless they’ve been written strictly for Windows which would be stupid in itself, and 2) I really do believe that DHS probably has a lot of people who have never seen a Linux system. Linux systems are only being used by maybe 3% or so of the population, let alone a dual boot (especially with, for instance, Windows 7 which is a different beast than XP.). So maybe they did write the rules just for Windows…

Richard Steven Hack • August 3, 2011 9:02 AM

Duh…what else is new?

Report on ‘Operation Shady RAT’ identifies widespread cyber-spying
http://www.washingtonpost.com/national/national-security/report-identifies-widespread-cyber-spying/2011/07/29/gIQAoTUmqI_story.html?igoogle=1

““We’re facing a massive transfer of wealth in the form of intellectual property that is unprecedented in history,” said Dmitri Alperovitch, McAfee’s vice president of threat research.”

He says that like it’s a Bad Thing…

How about the “massive transfer of wealth that is unprecedented in history” from, say, Wall Street? Or the military-industrial complex in terms of three to five trillion dollars for current wars?

“Scott Borg, chief economist at the U.S. Cyber Consequences Unit, a research group, has assessed the annual loss of intellectual property and investment opportunities across all industries at $6 billion to $20 billion, with a big part owing to oil industry losses. These firms spend hundreds of millions of dollars to explore oil fields before bidding on them, Borg said.”

$6-20 billion? Across ALL industries? That’s chicken feed!

What is the current oil industry profit level? CNN Money: Exxon Mobil profit nearly doubles By Ben Rooney, staff reporter, July 29, 2010. “The world’s largest public energy company reported net income of $7.56 billion, or $1.60 a share, in the second quarter, up 91% from $3.95 billion, or 81 cents a share, in the same period in 2009.”

The MIC? “Halliburton’s revenue was $18.0 billion for the full year 2010, an increase of 22% from the full year 2009, and consolidated operating income was $3.0 billion, an increase of 51% from the full year 2009.”

Oh, pity the poor multi-score-billion-dollar transnational corporations! China is stealing their intellectual property!

I say good for the Chinese (and anyone else ripping off corporations and the government for IP.) They’re leveling the playing field after US corporations have bled the rest of the world’s population dry for the last hundred years.