Schneier on Security

Clive Robinson • December 18, 2011 3:37 AM

OFF Topic:

Part 2.

However it’s not just Amex having ITsec probs, Visa and the Romanian Banks Association have reported notifications of a possible database security breach at a European processor. Details are being kept quite currently but… you can read more at,

http://www.scmagazineuk.com/rumours-of-database-security-breach-causes-romanian-bank-to-block-17000-cards/article/219473/

Naturaly one of the questions some people will ask is “Were insiders involved?”. Normally we don’t get to hear much if anythingg at all about insider theft of customer details etc. But over on his blog Brian Krebs has an interesting couple of posts on the subject.

The first post is on street criminal gangs in NYC using insiders for ID theft,

http://m.krebsonsecurity.com/2011/12/ny-id-theft-ring-used-insiders-gang-members/

The second coincidentaly is in Romania again, where the Romanian authorities have arrested a Ukranian General and a couple of others,

http://m.krebsonsecurity.com/2011/12/ukrainian-general-arrested-in-cyber-heists/

But when you get down to it the real issue underlying all of this is access to databases and the information we put in them and why. Some of the reasons are frankly ludicrous and have the side effect of turning a database with low value to the creators (and thus often low security) into a very high value target (thus a significant security risk) for those with less than honest intentions.

Ross J. Anderson over at Cambridge labs has an example of this,

http://www.lightbluetouchpaper.org/2011/12/14/blood-donation-and-privacy/

Unfortunatly it appears that in most cases the wrong problem (ie access) is being addressed and at best woefully inadequately. It looks simple on paper, deny access and the problem does not exist, but that is not the case in practice because autherised access is still required. Firstly is the question of “insider attacks” be they deliberate or by social engineering. But secondly it is becomming more and more obvious that outsiders will get arround any and all access controls with a little lateral thinking and persistence. Often this is by getting malware onto an authorised users client machine, thus bypassing the autherisation controls. As we know from bitter experiance all current commodity operating systems are vulnerable and non commodity OS’s although more secure generaly have other issues resulting in increased costs. But even with secure OS’s the problem has moved up into the intermediate application layer. The use of web browsers for “clients” means that the web browser needs to be as secure as the underlying OS, currently no commodity browser is even close.So other methods have to be considered based on the assumption that unautherised access will be made.

In part the solution is the removal of non essential data from data bases it’s simple, it’s effective but unfortunatly it has “business isssues” that often prevents it’s use. Also in part for the data that remains, is some effective form of anonymisation to help reduce the impact of any such loss. This is because the current thinking of “encrypt the database” only works for “data at rest” not when it’s in use which is where attackers are focusing, simply because it’s where the data is effectively decrypted. But as we are finding out the hard way anonymising data effectivly, is at best difficult if not actually impossible with many data sets.

Unfortunatly in the UK the Government has anounced it is just going to make everybodies health records available to the “chosen few” companies supposadly for “research reasons” but in reality to bring cash into the Treasury (but no doubt certain MP’s and Tory Party funds and senior civil servants will benifit as well). In order to “placate the masses” we are being assured the data will be “anonymous”. But we know from previous experiance it’s a “big fail” in that even relativly minor analysis against other databases starts striping of the anonymization.

Ross J. Anderson gave a presentation on the problems with health and other DBs containing significant personal and highly confidential data at a new conferance,

http://www.lightbluetouchpaper.org/2011/12/05/privacy-event-on-wednesday/

It’s certainly one to keep an eye on.

Clive Robinson • December 21, 2011 3:57 PM

@ Kingsnake,

“I long ago learned never put in electronic form that which you do not wish others to know.”

It’s a bit more awkward than that, sometimes you are required (by a judge etc) to reveal information, and thhese days all the talk is “electronic submission”…

This is needlessly dangerous for a number of reasons both legal and pragmatic, which is why I always advise,

“Paper, Paper, never data”

That is submit a paper copy and put a big red stamp across it that says “Copyright, under no circumstances may this document be copied or transmited in any form without prior written authorisation from the copyright holder.” with a hand written issue and serial number on each page.

Aside from making the copyright of the document blatently obvious it serves two purposes,

Firstly it means they only get what you haves seen, as many document storage formats contain hidden meta-data that can be unknown to you.

Secondly and perhaps more importantly why should you make the compeling parties job any easier by giving them the ability to put the doccuments into a DB which they can then search easily or perform statistical analysis on.

Thus it goes without saying that any paper documents you submit should be in as an unfriendly to OCR font/format as possible. Which is also printed from a large single image file per page, which has been put through Ross Anderson’s program for distorting images to break up hidden watermarks.

If the judge or who ever does not like it and insists on electronic format then scan the paper document into a brand new never used before computer and save each page as an image (preferably in an obscure format) with the copyright included and charge a fee for doing so.

The basic rule of thumb is to deny your adversary any advantage they might seek to gain at your expense.

One problem people are starting to see in US Courts is “Electronic Discovery” whereby an adversary seeks to effectivly bankrupt the opposition by making them pay for steadily more difficult to do presentation of documentation whilst also trying to get more information than is actually required.

The solution to this is as noted don’t keep information in electronic format, and if it starts that way get into.