Schneier on Security
A blog covering security and security technology.
« Weaponized UAV Drones in the Hands of Local Police |
| Fake Documents that Alarm if Opened »
November 4, 2011
Friday Squid Blogging: Star Trek IV, now with Squid
Someone edited Star Trek IV, removing the whales and replacing them with giant squid.
As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.
Posted on November 4, 2011 at 4:47 PM
• 42 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
So the probe is calling out with... squidsong?
The United States Postal Service is creating ads implying postal mail is more secure than other communication options. Catch-phrases include:
"A corkboard has never been hacked."
"Mail is the feeling of safety and security."
Personally, I've never had a credit card number stolen as a result of using it online. But I have had someone steal a piece of mail containing a credit card and ID that were being sent to me, and then use them to commit fraud in my name.
Anyone aware of any merit to this ad campaign, or is it exactly the FUD it looks like?
So I was considering downloading it but it is way to big for skipping around looking for the edits. Anyway I noticed it was an *.img file and it would be funny if it had an auto run payload in the DVD image. Only because you know this is a security blog. :)
@Someone, that's the great benefit of the USPS - it's only possible to steal mail if it's delivered. The USPS has discovered this loophole and has been working for many years to close it.
For a large number of hotels, plans have been made for hotel room TVs to carry a PSA from the US Dept. of Homeland Security.
Among other details in the article were concerns that the encouragement to report suspicious activity could lead to large numbers of reports with limited value, and that this could impose a load on law enforcement. In addition, the situation where two street vendors reported a smoking vehicle near to New York's Times Square was mentioned in justifying citizen reporting, though there is the question as to whether a vehicle giving off smoke is so out-of-place that official PSAs are not necessary for such circumstances.
Bruce's Bedtime Stories, guaranteed to knock 'em out in 5 minutes or less...
(OK, maybe it didn't go down exactly like that, but SOMEONE nodded off in between the protocol discussions... :-)
Remember the debian openssl random number issue from a couple of years ago? Yeah, who doesn't.
Apparently the ruby devs have been taking lessons from the Debian guys.
From the commit message of revision 33633:
* ext/openssl/ossl_pkey_rsa.c (rsa_generate): [SECURITY] Set RSA
exponent value correctly. Awful bug. This bug caused exponent of
generated key to be always '1'. By default, and regardless of e
given as a parameter.
!!! Keys generated by this code (trunk after 2011-09-01) must be
re-generated !!! (ruby_1_9_3 is safe)
And this just in:
I fear this is more a privacy invading data collection tool for marketing and neferious purposes (going back to their telco hidden room surveilance). All networks and their associated connections can be compromised, and what richer playground of information than when the children are alone, or the aging parents are alone, or the house is empty (lack of data), but mostly for annoying marketing pitches when someone coughs, has fluid ejection problems, or the need to sell insurance coverage or increase rates (same attributes of data collection in cars, your energy devices in the home, and of course, your cell phone as well as your home based computer workstation).
I have just pictured the replacing of the rescued animal in Star Trek IV being the new Downfall Parody craze on you tube. Kirk & Co rescuing a whole host of creatures or ideas that are extinct in the star trek universe, such as currency/money since Earth apparently doesn't use it in the Star Trek future.
Stumbled onto a product for your spidey sense Bruce.
They promise key innovation!
"The CryptoFile™ establishes a versatile powerhouse for security ... Hack-resistant Key-in-a-File insulation trumps the standard simple key strand. ... Encrypted data is shape-shifting. No two encryptions are alike, even when using the same key and data input ... Keys scale from 2000 bits to 2 Gigabytes in length "
So, you're behind this massive breakthrough right?
"The unpublished algorithm is not based on mathematical technique and not subject to normal statistical analysis."
That one sentence pretty much says everything.
For those that don't know (and that appears to be 99.999% of earthlings ;) there was a Cyber Security Conferance in London this week.
Attended by many senior Government representatives and Spooks from around the world and one or two security experts.
It appears the event was something akin to a badly run "love in fest" with little or no interest from the press, public or many security people (admittedly knowing that Hillary Clinton was scheadualed to speak would have put me off from the outset but then that's just me ;).
Star Trek IV - restaurant scene: re-edit
GILLIAN: What's that?
KIRK: What's what?
GILLIAN: You got a pocket pager. Are you a doctor?
KIRK: Actually, I’m a gynaecologist, but this is my lunch hour. Boom, boom!
[The Communicator beeps again. Exasperated, Kirk flips it open.]
KIRK: (testy) What is it? I thought I told you never to call me --
SCOTTY: Sorry, Admiral. We just thought you'd like to know, I’ve eaten the squid!
KIRK: Oh you bloody fool. Now what am I supposed to do?
SCOTTY: Lovely with a bit of mint source.
GILLIAN: Wanna try it from the top?
KIRK: That’s very charitable but we only just met.
[Loud singing is heard from Kirk’s Communicator] SCOTTY: "Should old acquaintance be forgot, and never brought to mind? Should old acquaintance be forgot, and squid with old lang Syne..."
KIRK: Oh shut up Scotty. I’m sorry Gillian, squidgy-poos, you're not exactly catching us at our best.
SPOCK (from underneath the table): That much is certain. And just listen to those thighs.
KIRK: I think he meant you...
LOL - "hackers don't know how to break it" since the algorithm is unpublished. But decryption tools (SOFTWARE!!!) can be downloaded for free...
Variable key lengths? Passwords have variable lengths too. They get broken too.
"Small keys" for AES, but 256 bits = 2^256 variations - that can't be bruteforced! You do NOT need longer keys! Even if the algorithm needs a longer key internally, you can just make it "longer" using various methods with hashes. The "randomness" in 256 bits is enough!
"Breakability" - if it can be decrypted it can be broken! And AES can't be broken in OUR lifetimes!
"Detactable" - only with ECB, not with XTS. Also, "unpredictability" - ever heard of IV's?
"Traceable" - lol
"Practical" - Uhm... You HAVE NO ADVANTAGE here!
How do you send files securely to people you haven't met? How have you avoided the PKI problems?
The postal service campaign has to be a joke. As far as I know, nobody has ever successfully sent a bomb or anthrax by email. I'm pretty sure that's a conversation the post office doesn't want to start.
@ Natanael L
I mean, their company slogan is "Protect your privates!" I read that and think, "I gotta take these people seriously."
In the company section, they say the code was designed by "a rocket scientist" named Paul Sobel from NASA. He received a commendation for "automation of spacecraft programming." (I swore there was a huge team that did that stuff, but maybe I'm wrong.)
I looked into Paul Sobel. He's got a LinkedIn page full of nice claims & 7 recommends. However, there's no mention of him on the NASA page and the news sites talking about the commendation were domains I haven't seen before. Smells of fraud. The company web page that mentions him also provides a link to the LinkedIn page for customers to learn more about him, making me think it's an advertisement.
@someone "never had a credit card number stolen as a result of using it online. But I have had someone steal a piece of mail "
Willing to be that theft occured at your endpoint.
First class mail is secure enough that the Federal Government has used it to transmit information classified to the SECRET level for decades.
Something they won't do across the internet using SSL.
@ BF Skinner
"First class mail is secure enough that the Federal Government has used it to transmit information classified to the SECRET level for decades."
I recall reading a brochure for a Type 1 voice & data encryption system (probably General Dynamics' stuff). One of the benefits was that the buyer could avoid using the defense courier service (or something like that) to transfer classified files. It made me assume that highly classified documents had to go through such a courier. Is it just TS & above, whereby C & S can go through USPS? Or am I missing something entirely?
Messages and pub changes were usually mailed. (once in guard mail, oops)
It's been a while and there have been some changes. For instance most of the most senstive material was crypto, keymat and the like. That's largely been replaced with OTA rekeying.
Other changes. You can fedex some class material too. Using DHL for the same thing was something of an argument I understand.
Some classified marterial was also sent registered. (I had to go to the FPO cage at the post office and sign for stuff daily, once it was two long cylinders for the storekeeps who left them in an unsecured vent space over the weekend. Turns out they were tactical shotguns for the armory. Good thing the SK3 signed for them.) Point being the goverment mails a LOT.
I'll have to look it up. I believe all our crypto was couriered. And when we were underway all class material was either held back or delivered to the closest embassy to our ports of call. But when we were underway most of the class traffic was carried over secure radio.
I've seen datacenters I've been at since courier dead class drives (never greater than (S)) to an non-disclosed agency (not DRMO) for incineration but that was probably more for convience than anything.
I failed to post this question in the correct Squid-related blog post. Sorry for submitting this a second time:
I recently encountered a problem that I have a question about.
A credit card of mine expired a few months back, and I got my replacement in the mail. I chose to never activate it as I haven't used it in over a year. However, I checked my account the other day, and there have been purchases made on it in the past month that are clearly fraudulent. How is this possible if the card isn't activated? I've never used this new card, so they couldn't have stolen the number from somewhere I've used it.
A simple question,
"How much is your identity worth?"
It's an important question because it sets a bar on fraudsters using your ID fraudulently with various credit issuing organisations. (banks, card issuers, retail outlets, etc, etc).
Brian Krebs has been having a look around and it may surprise a number of people that effectivly all the required details on them are available for as little as half a dollar.
Now depending on who you beleive this info is worth around 10,000 dollars in fraud. So it is easy to see why various people would be interested in the potential profit...
what would you say to a Critical Infrastructure product vendor who in response to a vulnerability (with exploit code) said, "no, we have no intention of fixing it" but kept right on selling the product?
(sorry for blowing my own trumpet, but no-one else seems to be reporting this)
"what would you say to a Critical Infrastructure product vendor who in response to a vulnerability(with exploit code) said, "no, we have no intention of fixing it" but kept right on selling the product".
Not much, I'd by product from another company in another country.
What you need to know is this is going to get a lot lot worse due to the US Government.
Basicaly they have decided that critical infrastructure computer based systems such as SCADA and their control consoles etc are "so critical" that knowledge of flaws by those other than in the private club they have set up is "verboten" thus you are required to inform them, but they are not required to inform anybody other than the chosen few and that does not include many of the equipment manufactures.
It is without a doubt stupidity of the highest order and as others have commented one likely reason is the stock pilling of vulnerabilities to be used against others...
As many will know today (11/11/11) is Armistice / Remembrance Day where we remember those who have fallen or given their lives around the world.
However it is also the 60th Anniversary of the first commercial computer.
Contrary to what many think it was not a US design or construction for a US company but like the first electronic computer it was a British design and costruction for an English company.
Back during WWII and into the 1950's one of the largest non heavy industry companies in the UK was J Lyons, most known at the time for the Lyons Tea Houses and Bakeries.
Well they had perhaps the largest distribution network of perishable goods of it's time in England and it was getting difficult to manage.
The future looking managment who effectivly invented Operations Managment in it's modern form decided the solution would be an automated tabulating machine and they got amongst others David Caminer decided what was needed to replace some of the Dickensian labour intensive work practices was a computer.
A team was sent over to the US to look at ENIAC which as it could only be programed with wire cutters and a soldering iron (ie hardwired not stored program) was considered unsuitable.
However they did get pointed in the direction of Cambridge University in the UK where a team was developing a system using mercury delay lines (which Alan Turing had some part in that to this day is still unclear). In late 1947 Lyons directors paid the team at Cambridge a sum of money that would be close to a quater of a million these days to design what became known as LEO ( http://www.leo-computers.org.uk/index.htm ) short for the "Lyons Electronic Office". Some two years later the leo had a workable programing interface and in November 1951 it began it's operational life. Due to the expense Lyon's spun off LEO development into it's own company Leo Computers Ltd which later became ICL and development of the LEO II and LEO III followed. The LEO III was notable because it used germanium transistors (equivilent of the OC71) and ferrite ring core store.
However the company lacked the deep pockets required for advertising so lost ground to International Business Machines and their 1964 360 system. Which the LEO IV was effectivly a copy under license. ICL moved from the original Hamersmith Office and had three tower blocks built, which are still in existance today (one as a hotel) and if looked at carefully from a distance you can still see faintly the marks of the I C and L on each building.
ICL went on to design other systems which ran the George Operating System that had a little joke built in. Every so often the message "The phantom programer strikes" appeared on the operators console.
Due to LEO II's relativly slow clock speed one of the debuging and systems engineers tools was a loud speaker built into the engineering/operator console that could be conected at various points. An experianced ear could quickly tell from the tones generated if the programs were performing as expected or hung up.
As is the way of such things some of the engineers made it play recognisable tunes, so it might also have been the worlds first digitaly programable music synthesizer as well.
For my sins in the distant past I also worked with some of the original development team and have one or two bits they told me came from the LEO II design along with a few bits from a LEO III which I helped break up back in 1980.
Considering that Britain was in financial dire straights after WWII untill well into the 1960's with shortages of just about every thing it is remarkable they were able to get the valves and other resources to make LEO.
Due to the number of valves they got through on a weekly basis it appears that they did not benifit from the knowladge of Tommy Flowers over at the Post Office in Dolis Hill London, who had found a way of vastly increasing the reliability of valves that made the first digital computer Colosus possible.
So as you are sitting their over your keypad cursing the slowness of the technology spare a thought for rememberance for those pioneers (most of whom are nolonger with us), working with clock rates in the audible range not those of microwave ovens.
@Clive "For my sins in the distant past I also worked with some of the original "
Today Clive Robinson hippy, Klingon, admitted he is older than dirt. . .
Just say it man YOU'RE Q!
What's the worst they can do?
@ BF Skinner
Whatever they can do before he snaps his fingers and they go "POOF!"
@ BF Skinner,
"Just say it man YOU'RE Q!"
My word might be my Bond, and yes I've designed quite a few little surveillance gadgets in my time (Including a Spread Spectrum bug that turned up in a photocpier in a well known seat of Government). But I've put that all behind me as the fun went out of it when the costs of semi-custom chips ment you could do most of it in an unmounted chip.
These days with SoC you can effectivly buy a "chip bugging device" as a standard part. I'm sure if you asked Robert T nicely he would give you some chip numbers you could get to play around with. With such parts comming on 1000+ reals for just a few thousand dollars and selling prices for those sorts of bugs in the +200 dollar price range your only real problem in making lots of money would be finding the customers.
@ Nick P,
"Whatever they can do before he snaps his fingers and they go "POOF!""
I've got BF thinking I'm a "Hippy Klingon", and you thinking I'm "Gandalf".
I know my hair and beard are getting a little long and bushy at the moment, but hey guys I still wear jeans and a tee shirt for working and a suit for the weekend (Thus I'm still "Agh ha, Staying alive, Staying alive" ;)
On another note you might find,
of interest, it was posted "November 11, 2011 4:03 PM".
ON Toppic but different ;)
I don't know if you've seen this or not,
Put simply a species of squid has a photosensitive dye in it's skin that changes colour just as fast as E-Ink in the likes of the Kindal E-Book reader display.
@ Clive Robinson
Actually, I was thinking more of the Q in Star Trek. ;) Thanks for the Brian Snow link. Not surprising that he thinks it could be taken down: RSH and I designed a fire sale on another thread of this blog. It would cost all that much either compared to previous wars against the US.
On Chameleon Cephalopods
I posted a link a while back on this, although idk if it was this blog. I sent this nifty video to a bunch of people. I dare you to spot the one in the bush. This camo is simply amazing.
@ Bruce, Nick P,
Not sure if I should put this hera or in the APT so I'll post hear and cross link back.
One of the presenters at
F-Secure CEO Mikko Hypponen, one of the presenters at the Tokyo PacSec 2011 conferance, has indicated that the "China APT Mob" are almost certainly scapegoating China over the activities of other countries (which is a point I've been making for quite some time).
He has said that F-Secure have some evidence to support the view point due to the way the attacks are prosecuted.
Essentialy what Mikko Hypponen points out is that nearly all the attacks come in a very similar if not text book way,
1, User receives a very targeted Email.
2, The language used is effectively as expected.
3, The Email contains an attachment (usually PDF) again targeted at the user.
That is there is very little or nothing in the Email to arouse any suspicions in the user that the Email is anything other then genuine.
There are several implications to this.
Firstly the attacker has a lot of background material on the targeted user, which has been obtained from somewhere (possibly by examining the Email of the real person the Email impersonates).
Secondly the language used in the Email is almost exactly what would be expected of the person being impersonated, suggesting a very good command of both the language and current idioms and the field of endevor as practiced by the user.
As this is being done in over thirty languages, it is a remarkable feat if carried out by just one country alone. And one you would expect only from those who have been at it in other ways for a considerable time (ie the US, UK, Russia, France, Israel and other mainly Western Nations).
It is this asspect that Mikko Hypponen believes adds weight to the slowly growing evidence that other countries use China to mask their own targeted spy and espionage activities on the internet (this is not to say that China is by any means innocent but that they are not as the "China APT Mob" would have you belive the only ones).
Mikko's recomendation is, as the Adobe Reader is the technical target of choice, not one I would generaly recomend which is to expunge it from all systems within an organisation.
There are several reasons why I'd normally say no to this sort of solution the two top ones being,
1, The attacker will try again with another technical target in short order, if it does not succeed with this one.
2, The disruptive effect on the business work flow would be excessive.
However this second point is as Mikko Hypponen points out mainly irrelevant with Adobe Reader.
Basicaly Adobe Reader is it's own worst enemy being bloated, slow and historically full of easy exploits, whilst it's many rival PDF viewers are generaly small, fast, and importantly do not have the exploits the attackers are using, whilst also being free to use across the majority of OS's.
But that still leaves the first problem of other technical attack vectors using different software that is quite common, which the attackers can easily and quickly switch to. Put simply the attackers rate of fire is way way above the ability of the target to dodge so sooner rather than later a shot is going to hit the target and at that point it's effectivly game over.
The solution to the problem is not the removal of a technical target, there are just way to many of them for this to be anything other than a very short term stop gap measure. It is to address the method by which the attack is delivered, specificaly to address the Trust issues involved with "invited inbound information" behind which these attacks operate.
None of these attacks would work if there was not a way for code to be executed by the user when they received it in their Email inbox. Thus plain text and no attachments would reduce the attack vectors to just those in a simple Email reader.
However this would significantly effect the ability of users to carry out their ordinary everyday work activities, many of which have become reliant on Email or web access as an "enabler".
What appears to be needed as a first measure is a technical way by which trust could be established that the Email was genuinely from who it claimed to be.
However although this is currently fairly easily achievable if an organisation wishes to there are several problems,
1, It only establishes trust in one link of a very long chain.
2, Few Email readers actually handle the technical trust issues even remotly well enough.
Whilst the second issue is reasonably easily solved the first is not. It is quite likely that the attacker has already "owned" the impersonated persons computer in order to gather sufficient information to make the impersonation work, or has established themselves at some point in the communication path such as the MTA or router etc between the impersonated person and either the user under attack or some other user the impersonated person communicates with.
Thus the attacker has ample oportunity to move "up the chain" untill they find a weak link by which they can inject an attack to transverse down the chain to own the impersonated persons computer, by which point it is game over for the technical trust solution on the last link.
On the premise that no software is perfect, there will always be an opening for an attacker at some point. It also follows that many of these openings will be unknown for a period of time relating to how they get exploited (ie rise above the noise floor). Thus we will always have a window of opportunity for an attacker to get a toe hold by which they can with care exploit their way across many systems and networks. Thus it may not be possible to find a technical solution to the APT issue of "invited inbound information", other than "don't invite the information in". Which in effect will give you a simple "air gaped" system, which is not terribly usefull for many activities these days.
Thus the ancient Chinese Curse has come of age and we are "living in interesting times".
@ Clive on the At-Risk Survivors
Thanks for the links. Those were hilarious, except the 3rd that doesn't load. (404 page not found) Got another link to that one? I still wonder what kind of a ring the guy managed to squeeze his whole... ouch. I don't ask why, anymore. We should definitely nominate him as an At-Risk Survivor.
"None of these attacks would work if there was not a way for code to be executed by the user when they received it in their Email inbox."
It seems to me that any simple "virtual machine" approach will eliminate most of the spearfishing exploits. Although, as you say, the attacks would quickly migrate to ones that breached the virtual machine barrier. Still for the time being something as simple as "Sandboxie" should address the problem and requires almost no change in office routine.....
On the second point of trust chains, Spearfishing attacks utilize the very concept of a trust chain to deliver the packet, so I'm not sure that beefing up the trust chain changes anything. Seems to me that only solutions with two or more piece security can hope to fix the problem. Bluetooth keyfobs with email signatures would be one technical solution, but it will only stop the lowest level of attacks.
Unfortunately if the attacker has the resources and interest in you, than sooner or later he will own your computer, phone, network, digital identity. That is the cold hard reality we all need to accept....
On the point of other attackers impersonating Chinese hackers. There are a number of reasons for doing this, my top three are:
1) It is where most targets expect the attack to originate, so it is where they will stop looking
2) Even when Chinese officials collaborate, the information that they provide is often incomprehensible (i.e. Chinese) and further obfuscated by the very function of the GFC (great firewall), which BTW is a secret....
3) Fundamental mistrust of China by the west is the Hackers best friend
On Clive's APT post
If the con's are really that good, then it would lend itself to a more advanced attack. The Chinese source IP's being non-Chinese is a given: many hackers make use of Chinese systems just BECAUSE they're less likely to cooperate with the Western police forces or "competitive intelligence" people, especially the US. (Or am I the only person using Chinese relays for this purpose? ;) Tying the two together, there could be numerous intelligence agencies involved. I'd also add organized crime.
The Adobe Reader recommendation is good. I switched to Foxit a while back. I also often recommend the use of formats like PDF-A that are inherently lower risk. We probably need a group to get together & produce reasonable subsets of the major formats that automated tools could verify before opening. A virus scan would be used, as well. At the least, Reader should be sandboxed with something like a browser VM or Sandboxie. (There's a recent paper at SANS reading room about an efficient VM sandbox scheme with instructions for building it.)
As for handling the situation, it would require a good TCB and a trusted viewer/signer running directly on top. The recent microkernel + isolated apps + Linux VM/GUI push is going in the right direction. Well, as much as can be done in the COTS market. I think if we isolate the security critical apps, graphics subsystem, and trusted software, we can accomplish something like that in organizations. An added benefit is that you can't just exploit one vanilla application to control the entire machine. It would be much more complicated. Thin client approaches are also preferrable.
A starting point are designs like Nizza, Perseus, INTEGRITY Workstation, Turaya Security Kernel, and OKL4 SecureIT. I've mentioned many technologies in the past, but these have actually gained traction & can be implemented on many types of COTS hardware. The INTEGRITY method has been used for isolating browsing, VPN's, messaging and more. Turaya offers trusted boot & transparent endpoint encryption. Nizza demonstrated secure, user-friendly eCommerce. OK's SecureIT provides many mobile functionalities that run on their kernel directly & alongside the user-friendly, paravirtualized mobile OS.
So, I don't think that problem is intractable. If the security-critical aspect can be isolated, then HID people might be able to design user-friendly apps that make it harder for a user shoot themselves in the foot (read: head). The best part is that the dual nature of these designs, combining untrusted user-friendly stuff with trusted isolated processes, means that developers get a lot of benefit without the pain of a high[er] assurance development process.
@ Nick P,
Re "third link", it was a typo on my behalf try,
I'm looking forward to the end of the contract on this phone because the "touch screen" and the driver required for cut-n-past are a bit flaky to put it mildly, and the version of Android has not got to the bread baking stage let alone bunging the ice cream in to make a sarni ;)
P.S. For those not from "de sarf of hingland" (as it is becoming known by it's inhabitants these days) a "sarni" is another name for a sandwich, also known by those a bit further north as a "butty" and north of the border in the land of the "Sweaties" (as in sweaty socks = Jocks = Scots) where they use a roll not sliced bread a "barm". And by those wearing the green to be a "banjo" especialy when it contains "fresh" (ie "fresh food" not MRE or Meals Regurgitated by Everyone) that is usually runny such as a fried "egg banjo". For those wishing to know much much more about "UK Slang" (so they can fake Emails etc ;) may I commend to you,
When your ccard "expires", the 15-16 digit # stays the same, the optional 3-digit CCV code changes and the expiration month and year change. If the merchant doesn't require a CVV code, all that's needed is for someone to guess the new expiration date. Typically it is a guessable fixed increment from your old expiration date. Ie 1-2 years in after the prior one. In any case, the new expiration date doesn't take many guesses in the scheme of things with only 12 months per year.
Thanks for the link. So breast implants now stop bullets on occasion? What neat thing will they be used for next?
I know: a silicone great seal bug! Bet Im the first on that one. Consider it copyrighted. ;)
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.