Schneier on Security

Clive Robinson • October 31, 2011 11:54 PM

@ TS,

+1 for the smile +3 for back refrencing to last weeks blog post about TwoFish.

@ NobodySpecial,

“Of course a group as technologically and strategically skilled as the UK police would ensure that nobody is carrying a mobile phone while on duty wouldn’t they”

+10 for that my cup off midnight tea went all over the place when I read that.

For those who don’t know the Met Police like a number of other emergancy service organisations have been stuck with a Trunked Mobile Radio System from Motorola that realy is a bad mismatch for what they do day to day. The result many of the Met police officers carry the “damed radio” and usually two or more mobile phones…

“If I understand correctly the difference between this and running a fake base station is that this isn’t limited to one network and it isn’t easily detectable by the user – you also don’t have to deal with actually handling the call or by raising suspicions by rejecting it”

I’m not sure of all the features of the Datong device has, however the Vodafone femto is a compleate UTMS base station in a package the size of a WiFi router. Because it uses a stripped down version of linux underneath the radio modules once you have root console access, you can make it do quite a lot of things extra. One of which is just sitting on a control channel passivly “slurping up” registration traffic that might be talking to a “proper base station” in the area.

@ Andrew,

“This is just the tip of the iceberg as to what procurement we have undertaken to protect the public and the city”

The question is after the initial purchase of the equipment for the couple of weeks of the 2012 games, what is going to become of all this very expensive equipment and the personnel trained to use it?

Personaly I don’t think it’s going to sit in some cuboard gathering dust, and the personnel go back to ordinary duties… So the question is where will they go. Parts of the Met have a very poor reputation of spying on peaceful protestors, then giving their private details to various companies so that the companies can take out private prosecutions or worse against these people. Likewise some parts of the Met have been caught in undercover roles for acting as ‘agents provocateurs’ or for purjuring themselves in court.

@ Dom De Vitto,

“Geee. This company is at it’s 2nd lowest share price in the past 10 years”

Datong have been around for some considerable period of time. Originaly they developed kits for the UK Amateur Radio enthusiasts (and allegedly Pirate radio as well) there was also some sugestion they were indirectly involved in the design of very high speed high energy pulse generators that would have ended up going off to a Middle Eastern country. Think solid state version of a krytron and sprytron switch if you want to know why various people (including the CIA & MI6) got twitchy about it ( http://en.m.wikipedia.org/wiki/Krytron ).

Like many companies involved with VHF and above design they were also involved in the surveillance industry (bugs, tracking equipment etc), and I guess like some others they found the very high profit on low volume sales to be to a seductive side line.

“Hope operating this stuff is legal…..not sure under what law it could be used, without a warrant.”

It’s use and sale are covered by different bits of legislation.

To be sold on the EU “Open Market” it is probably illegal as it’s almost certainly not type approved for use on the harmonised European Market (ie it’s probably not got the required CE or (!) marks). However if it’s sold as a component part, sub assembly or kit of parts then in general those rules don’t apply so can be sold to “manufactures” or end users capable of self certifing for type approval. Also as radio equipment it should be type approved if it has a recognised “interface” such as an antenna (see early parts of the RT&TTE Directive).

However if you look at all the EU Radio directives and much other national law within Europe there is an exception of the universal get out of jail free card of “National Security”, which means it’s OK for a National Government or it’s various “Military, LEO’s, etc” to operate but not the rest of us.

Likwise the “licence to operate” the “Military, Leo’s, etc” will be licenced appropriatly to operate the equipment, the rest of us not.

Now untill not so long ago the Met Police did not do “National Security” that remit was kept to the likes of MI5 (domestic) and MI6 (foreign). However starting with the Special Branch investigating the supply side of “Irish” terrorism they have taken on more of that role. Various side shows thought up by the politico’s such as the defunct SOCA have also had their snouts in the trough of “National Security”.

Worse “National Security” has been weekend down in it’s meaning to the point where it includes “economic benifit” which some regard as an open licence on Industrial Espionage against foreign competitors, a small part of which is “APT”.

Clive Robinson • November 1, 2011 3:22 AM

@ Andrew,

“SOCA is only defunct because its being desolved into the soon-to-be National Crime Agency (NCA).”

Whilst it is true that some of SOCA’s functions are ending up in the NCA not all are. Some are basicaly disapearing or being thrown back onto the various Police forces, without appropriate budget consideration.

SOCA was this dream of a high tech crime fighting organisation that in reality was all but usless and dropped the ball more often than those in charge are prepared to admit, hence the usuall political solution “re-organisation (out of existance)”. We saw this with HM Customs and Excise, who had powers of aresst etc, they set up a sting operation, that a judge basicaly described as an illegal money laundering scheme, and a whole bunch of arrests etc got chucked out. HM C&E got “re-organised” with their hated rivals Inland Revenue to become HM Revenue & Customs and lost their ability to make arrests etc.

Oh and the NCA are already showing signs of being to strategic to succeed, but I guess time will tell.

Clive Robinson • November 1, 2011 7:07 AM

@ David,

“.. the bomb goes off when the call drops unexpectedly.”

Yup, many many moons ago I worked for an organisation that did research for various military organizations. I pointed this out as being a problem with using jammers.

The idiots in charge then sugested some other solution involving their precious jammers (then made by Racal). I pointed out that whatever they suggested using the stupid things was always going to be vulnerable because it radiated energy that the receiver could detect (in most cases by simply using a random “dual tone” ontop of a signal).

Or worse passivly they could use what I called the “doughnut effect” to explode the device when the jammer was right on top of it.

Basically back in the early 1980’s jammer designers wanted to radiate out the signal as far as possible so the antennas go ontop of the vehical. But this means at ground level the signal pattern is like an American doughnut, with a deep signal null almost directly under the vehical, so a simple pair of low pass filters on the signal strength will indicate when the signal starts to drop and bottoms out thus with a few op-amps and D-Type latches in TTL you could make a detector that would. triger either in the doughnut or if you wished just after the signal peak or both.

Thankfully your average IED designer thinks differently, but sometimes they go even better. The PIRA once used a photo detector at the end of cheap plastic kidies telescope or binoculars, and to trigger a flash gun mounted in the optics of a better telescope pointing at it. provided they set this up with the detector field of view orthagonal or normal to the jammer or VIP vehicle then it cannot be jammed…

The optical transmitter to the IED can be put on a suitable high point with say a RC receiver so that it can be triggered well outside the jamming radius…

It’s why I tell anyone who asks a jammer is a far from fallible last resort device, as always your best defence is good humint first last and at every step in between.