Schneier on Security

Clive Robinson • January 11, 2012 8:53 AM

The simplest advice is take nothing with you across any border at any time except the minimum you require to get to your hotel etc.

You arange for anything else to be sent another way.

Two reasons for this,

1, You have nothing that you don’t know about on you.
2, You don’t have any devices on which malware etc can be added to your detriment.

Oh you also have less to be stolen/mislaid and nothing for the TSA et al to scratch the backs of their heads over…

Clive Robinson • January 11, 2012 2:18 PM

@ Lisa,

And I don’t trust that Apple Lion’s closed source FileVault does not have some secret back door for officials

It might have but then again it might have bugs or even faux bugs that are realy backdoors.

That’s the problem with complex security and software, you can easily drive yourself crazy trying to “verify and trust”.

So the best thing is to assume that all software has bugs and is thus insecure (including products that claim EmSec level security), and you have to make the choice of how to mitigate accordingly.

The usual choice for low value data items is to chain various pieces of the security systems in sequence giving you the “onion layer” model. However on most OS’s this has a fatal flaw which is the OS it’s self, because it provides the link between all the pieces.

For higher value data items it used to be “use hardware” such as “Inline Media Encryptors” but as the US Gov and others have found the hardware is made outside of their control these days and could well be “Backdoored” by foreign nationals working for their governments…

Thus as I’ve said before on a number of occasions sometimes the best way to work is not to take high value data items with you across a border, nor the hardware&OS that can be “backdoored” as you go through.

There is however another option available which you are part way to with your external USB drive, but is not an option available to all. Which is “roll your own”.

I’ve used a number of the more recent micro controlers with multiple USB ports to do this. You can buy the source to a RTOS that has multi tasking, and you can also buy the source to the USB and other stacks. You can also download for free very striped down RTOS’s and limited schedulers from the net and USB stacks and software for flash drives etc. You can thus design and build your own “Inline Media Encryptor”.

For those nervous about “flash memory” just remember provided the drive only has encrypted data on it as Nick P has pointed out if you lose the crypto key you go from “data brick” to “house brick” in one go.

There is also a further wiggle you can do (simplest with stream ciphers) which is to have the data in flash encrypted under one key, the inline hardware changes that to encrypted under the transmission key to be sent across the USB cable and the driver on the commodity computer changes that into decrypted plain text. Now the trick is to make the transmission key evolve with time and data usage such that any data a third party picks up off of the wire will be different every time.

You then pick a method of sending/agreeing the transmission key from the commodity computer driver to the inline encryptor. There are a number of well known and well described protocols for doing this.

Oh and finally just incase you think “rubber hose” analysis will be applied to you, as you presumably work for an international company you can use MofN key shares from different jurisdictions with agreed “duress codes”.

But to be honest when it gets to this level you realy should consider not moving high value data items around, and changing the working practices to suit. Simply because it removes the risk to you and others, as a hostile agency that has targeted the company is almost certainly going to know what the internal company procedures are before they grab an individual “courier”, it they know no data gets shifted by courier they will leave all the companies travlers alone.

Clive Robinson • January 12, 2012 4:25 AM

@ The Conversation

“I would hope those working in “sensitive” fields would already be programmed in ways of dissociation.”

The “cognitive dissociation” methods are now used as part of pain managment for those with chronic pain of various forms. As far as I can tell in the medical profession started this with people who have “Phantom Pain” due to amputation of a limb etc (giving fairly good evidence that some asspects of pain realy are all in your head).

It is now also taught as part of Cognitive Behavioral Therepy (CBT) to those who have severe pain and cannot for a host of reasons take the various forms of pain killer.

Over simplisticly one method teaches you to “wrap the pain” and either move it or yourself to one side of it so effectivly splitting the pain out of the self mental image. And I know from experiance this actually works but takes a lot of practice to be good at.

There are a couple of Doctors who have put the methods up on YouTube etc so you can practice with them.

When you look at them you can see some are based on CBT “distraction techniques” and others on either meditation or self hypnosis induction techniques.

And it is said in China they routienly perform operations in hospitals using hypnosis not anesthesia, and importantly the recovery rates are considerably better…