Schneier on Security

Nick P • July 13, 2011 4:30 PM

@ hwood

“I would think that the cyber threats in the movie are about as realistic as taking down a helicopter by jumping a car into it.”

I agree. Comments like these make me question Kaspersky’s credibility as far as opinions on public events. Very little of the movie was realistic at all. The only thing I got from it was subverting a PC to explode upon a certain key sequence. That requires the obvious: bomb and electronic detonator in the PC. I tried to make a design for the rest: a rootkit installed via physical or digital compromise; keyboard driver modified to send signal upon certain key sequence; signal contains a unique pattern to prevent accidents; detonator connected to PCI bus & receives the signal that way; possibly powered by the PC’s own power supply.

I also added detonate upon opening case for situations where the modifications led to a weird event that caused the user to look at the hardware. This also made me think it’s easier to just use opening the case for detonation & make the software send up bogus hardware errors to get the target to open the case. Much simpler than detecting certain keystrokes, interfacing to the PC, etc. Hardware errors could pop up as soon as screen lock password was entered. As for the rest of Die Hard 4, it was so dumb that it got the movie in a Cracked.com article:

5 things hollywood thinks computers can do
http://www.cracked.com/article_15229_5-things-hollywood-thinks-computers-can-do.html

My favorite is their claim about Jeff Goldblum, in Independence Day, hacking the alient spaceships with a Mac.

“Why it’s ridiculous: This is difficult to wrap our minds around. The aliens in Independence Day were not only thousands of years ahead of us technologically, but also were an entirely different species. Therefore, Goldblum’s feat was the equivalent of colony of baboons in the Congo hacking into CitiBank using tree bark and clumps of their own feces.”

LMAO!

Nick P • July 14, 2011 9:46 AM

@ Richard Steven Hack

“Ah, but remember the assassins sent a virus TO the machine from a laptop in their van just prior to detonation. ”

I didn’t remember. My bad. That would seem like a bad idea because you have to physically be in the same place. Taking over the camera for visual confirmation would be better. But these hackers probably didn’t let anyone else use their “rig.” So, if they entered the password, then it was them. Boom. In my scheme anyway… (Movies just got to overcomplicate things to make it look cool to lay people, who still think hacking uses Swordfish-style GUI’s instead of terminals)

“I mean, once the plan was in effect, who cares if someone figured out which hackers were involved? They ALREADY killed off enough hackers to raise a red flag at FBI, so who cares how it was done? Just shoot the guy in his house. ”

It would be less entertaining on film. In real life, it would be more likely to happen as you said. They might even make it look like a robbery gone wrong if they want to try to reduce risk of fed’s discovering the scenario.

“This was the stupid part of the scenario. The virus they sent up caused the screen to flicker, which, for some utterly unknown reason was supposed to cause the victim to hit the delete key. ”

I know, right? I said “wtf?????” I keep thinking lay people write all these movies that feature hacking. But, they must have had help. A well-known hacker friend of mine froze the screen and did an analysis of the icons on the dude’s desktop. He said it was a bunch of hacking tools, malware, etc. All legit stuff. So, someone involved in that production knew stuff. Unfortunately, they weren’t calling the shots about the rest.

“Since the target was a hacker, he might be motivated to open the case. But the average user wouldn’t.”

That was the point. 😉

“Note: I just re-watched that movie the other day so everything is fresh in my mind.”

Glad you said that. I was startin to feel like my memory just totally sucked. Now I know that it may, but this is no evidence of it. 😉

“Even thousands of Chinese hackers haven’t penetrated the US to the degree shown in the movie for several years (as far as we know 🙂 ).”

Your best point. A similar Chinese-directed scenario might have been more believable. Don’t tell the US Govt though. Imagine how much better their “cyberwar” BS would work if the public saw the Chinese rip us a new one on Die Hard 4: The Art of [Cyber]War.

Nick P • July 14, 2011 12:40 PM

@ Dilbert

“Security guy warns the gov’t that the nations infrastructure is at risk”

Our national infrastructure is certainly at risk. There are real vulnerabilities and possibilities for sabotage. Many will require inside knowledge of the specific facility or inside help in enabling a remote attack. Others require quite a bit of sophistication. Others would fail entirely thanks to good setups. So, we have to add qualifiers to claims like Die Hard makes, even the more subtle version.

The hearing you’re referring to was mainly headed by Peter Neumman. His claims highlighted pervasive vulnerabilities and lack of security throughout our government and infrastructure. This is a real problem that’s led to the success of groups like Wikileaks and attacks like the defacement of the NSA’s web site. What was harder to believe was l0pht’s claim that they could make the “entire Internet unusable in 30 minutes”. That claim might have been true back then, but the Internet’s too complex now. The only attempt at a firesail that anyone made, back when the net was small enough, failed because a few of the critical nodes resisted attack. If anything, l0pht’s claim was hypothetical and failed the only test thrown at it.

Note that I do think there is a real way to pull this off to a degree: transoceanic cables. Destroying the cables between certain countries might very well be a practical way for certain governments or well-funded individuals to seriously disrupt internet access between countries. For some countries, they are connected by just one set of lines. That’s a single point of failure.

“How about hacking the gas company and blowing up the gas lines? Yep, we’ve done that (sort of). ”

The Siberian explosion doesn’t count in this. The reason is that was high class subversion that most of our infrastructure is unlikely to experience: top-notch security engineers designed a nearly undetectable backdoor; they obtained physical access to the systems; they integrated the backdoor with the systems; they sold them through a company the target would trust. It’s nearly impossible for a company to know their chips haven’t been subverted, making this one of the worst attacks. That’s much different than hackers firing IP packets off at systems.

However, you do make a good point. There have been real disasters and SCADA weaknesses. That there hasn’t been any deadly or financially devastating attacks recently says a lot when one considers how many skilled hackers would want to do it. Apparently, there’s plenty of weaknesses but exploiting them is hard. It would be a set of isolated instances spread out geographically & temporally. So far, it’s unlikely that a team of people could remotely take out things on demand, even knowing about SCADA security. Only the most vulnerable systems & Murphy’s law usually means that the would-be supervillian will run into the better ones.

Nick P • July 14, 2011 1:18 PM

@ Clive Robinson

“It was said that if you “poked” a specific address on a Comodor computer it would put a short on the power supply (never tried it myself).”

One of the hackers that got me started once claimed he fried a chip with a virus. I think he said it used the BIOS. I never really looked into it past thinking “that’s a cool idea” and “stay on his good side.” I mean, we already were capable of bricking a BIOS & deleting the HD data. Why bother going through all that trouble with a CPU when we’ve already got a sure-fire way to make the system unusable? 🙂

Just for kicks I Googled it. Turns out it was a valid attack on older AMD chips and might be possible on new boards if “the failsafe” is “bypassed by disabling the thermal-emergency shutdown procedure in the BIOS.” BIOS attack. Thermal effect. Yep, that sounds like what my friend did. (That was around 1999.)

“Can a virus melt the CPU?”
http://superuser.com/questions/54385/can-a-virus-melt-the-cpu

Nick P • July 15, 2011 1:07 PM

@ Richard Steven Hack

“as for physically damaging PCs via software, it was alleged that Tsutomu Shimomura, the guy that helped take down Kevin Mitnick, had software that could do that. I took that with a salt shaker full of salt, along with the line that he “allowed” hackers into his system so he could track them (since said hackers spread his stuff all over the place.)”

Yeah, he seems a tad unreliable. I think it’s safe to say it’s been done when I look at these two facts: my old buddy claimed to do it in 1999 by subverting a BIOS to overheat the chip; the recent paper says you can theoretically subvert a BIOS to burn the chip & old AMD chips didn’t have failsafes. This might be a coincidence, but I’m inclined to think he at least tried it on a system he owned & it worked. He had tons of old & recent PC’s in his closet that he used for spare parts & testing virii on.

“It might be interesting to see if one could utilize some of the BIOS manufacturer-provided utilities for overclocking to overclock a CPU to the point where it was damaged.”

That would be interesting. They’re stuffing so much functionality into BIOS’s these days, especially the EFI or whatever it’s called. There might be something in there.

“I suppose a virus could be written a la Stuxnet to select for a specific CPU and motherboard and then apply the one set of settings that would result in damage, though.”

Yes, that’s most likely because it has to be a targeted attack. However, it might also be easier to generalize & retarget thanks to the fact that there are few major BIOS vendors for general purpose systems.

“S African develops free submarine cables map”

Thanks for the link! After our Die Hard conversation, I had been working out a prototype fire sail scheme that was aimed at crippling global internet access to and from the US, just to see what might work. My main plan would require infiltration and sabotage of the Tier 1 providers (the “backbone”), along with destruction of all transoceanic cables (at least high bandwidth ones). This scheme wouldn’t be ease, but it appears to make a firesail a possibility.

The good news is that this map you posted shows a LOT of underwater cables. It might be hard to take them all out. Best bet would be to have several teams spend a few weeks planting charges on the major cables, along with a reliable set of timers. The availability of submarines would make the job easier so long as US subs weren’t tracking them. The bombs explode or incinerate (e.g. thermite) the cables upon the majority of timers saying the time has been reached. Any attacks on the network backbones would have already been planned & in the making, simply executed at the time the cables are cut.

What do you think of my Internet firesail strategy?

Nick P • July 16, 2011 12:00 AM

@ Richard Steven Hack

” a ‘grammar nazi’ quibble: ‘fire sail’ should be ‘fire sale'”

Well, I saw so many people spelling it that way, including Urban Dictionary, so I went with it. Looking at it again, the ‘everything must go’ tie-in makes plenty of sense. So, fire sale it is. 🙂

“You need to take out microwave relays, and landline cable all over the place.”

Actually I did think about that and you’re right in that my plan intends to bring it to a crawl, rather a total halt.

“this doesn’t address how to take down systems that are not so much Internet controlled, such as transportation and energy.”

My post was just focused on the Internet aspect. I mentioned that.

“Okay, step one: take out all the transportation. Step two: the financial base and telecoms. Step three: You get rid of all the utilities. Gas, water, electric, nuclear. Pretty much anything that’s run by computers which… which today is almost everything.”

I’ll be honest. There’s just too much shit to do all that. Unless… Unless, all refineries & reserves were blown and a series of crippling EMP’s were used all over the state. It could be atmospheric nuclear detonations, but that’s unlikely for a number of reasons. The alternative is to sack the powergrid and use non-nuclear EMP’s on many areas. Sacking the power grid is the easy part.

During my research on the supposed 2012 doomsday, I did find one realistic (albeit not world-ending) possibility: a solar version of the storm of the century. They are coincidentally expecting one somewhere from late 2012 to early 2013, with the median in mid 2012. That NASA funded a study on the effects of a Carrington event (look it up) on modern society makes me think they are taking it seriously.

http://science.nasa.gov/science-news/science-at-nasa/2009/21jan_severespaceweather/

The important part of the study for us is that national power distribution runs through about 365 large transformers, whose overloading would cause cascading failures all throughout the US. Many of these also take a heck of a long time to replace. A large series of flares could take it out. But it also seems manageable for a well-funded organization. I suspect it would still take months to years to pull off, even with many teams. But, it seems like taking out 365 static, poorly defended targets isn’t that difficult. They might not even have to do it all at once if they can cascade it right. What do you think? (So far, we have Internet to a crawl, transportation disruption due to $8-20/gal gas, & electric grid mostly unusable, with all those side effects.)

“A nation state, however, would find this a trivial expense. ”

My thoughts exactly. I could see Russia trying to pull some crap like this on us. I doubt China would want to as they make so much money off us and love how we produce all this valuable I.P. for them. 😉

“Of course, the payoff in this case was billions of dollars, so any amount of effort was worth it. It’s probably the most profitable investment one could make.”

It definitely had a good ROI. I’ve honestly wondered why the Powerball wasn’t rigged yet. There’s few human targets to control, very little technology & some easy cheating protocols (with subverted workers). Considering the huge payoff & proportionally small cost of subversion, I can’t understand why the mob hasn’t tried. But, far as “most profitable investment,”

I think that goes to the banks behind the Federal Reserve who create money out of thin air, loan it to us, and then… charge interest. They aren’t really investing anything & don’t care if they get it back, but they do make over $100 billion a year in interest on this phantom money that only exists in computers. Got anything that tops that? I mean, the defence department at least does some useful stuff like employing tons of people and blowing shit up, but what have those banks done that’s worth trillions? Answer: the best con of all time. 😉

Nick P • July 16, 2011 1:39 PM

@ Richard Steven Hack

“Probably would take out those main energy transformers, too, depending on the size needed. Using regular explosives on those transformers might or might not work, since they’re pretty big facilities. But an EMP probably would fry them. How much damage done would depend on the size of the surge.”

Indeed. And the biggest ones have shown that they could probably do the job. The one that most people saw on Future Weapons is nothing compared to those the DOE publicly gave the performance of. The power levels and range were incredible. It could have been transported in large trucks, perhaps.

“We probably should stop this before we get visited by the FBI and charged with “material support to terrorists”. :-)”

lmao. I was starting to get anxiety before submitting the last one. So it’s probably a good idea to stop here. Been fun being one of the only guys with a practical fire sale. 😉