Schneier on Security

Clive Robinson • March 24, 2012 11:14 AM

@ Z.Lozinsk, M.V.,

Spanish Civil War Enigmas.

From what I remember the Enigmas used during the Spanish Civil war were “plain rotor” machines and did not have a plugboard were wired in “typwriter order” from the keyboard to the rotors. Also the rotors did not have the alphabetic slip rings and also the fast rotor wass at the opposite end of the rotor set to the later German Enigmas.

The reason for the last particular change was the method used to crack the comercial and Civil War Enigma (method of batons IIRC) which used strips of paper and if memory serves correctly was thought up by a Frenchman.

I guess I’m going to have to look in a box full of dusty old notes I made some years ago to refresh the old “noodle bucket” if anybody want’s to know more.

Clive Robinson • March 30, 2012 5:22 AM

OFF Topic:

The ex US “Super Spy” Richaed Clarke was interviewed by the Smithsonian Mag about Stuxnet and other things, but the interviewer did a bad job,

http://www.smithsonianmag.com/history-archaeology/Richard-Clarke-on-Who-Was-Behind-the-Stuxnet-Attack.html?c=y&page=100

You will see from reading the article that there is nothing new Mr Clarke adds that is not already known other than addding dubious reasoning/spin on it. Essentially he trots out what most web sites tell you already which sugests he either knowns no more or he’s following a standard playbook.

The fact that the interviewer appears to be as in awe of Mr Clarke as a three year old on first seeing a “Sanata in a Grotto” does not help.

First off on Stuxnet Mr Clarke states,

“I think it’s pretty clear that the United States government did the Stuxnet attack,”

And his reason given for his belief that the US was behind Stuxnet is,

“that it very much had the feel to it of having been written by or governed by a team of Washington lawyers.”

Which he justifies with,

“What does this incredible Stuxnet thing do? As soon as it gets into the network and wakes up, it verifies it’s in the right network by saying, ‘Am I in a network that’s running a SCADA software control system?’ ‘Yes.’ Second question: ‘Is it running Siemens?’ ‘Yes.’ Third question: ‘Is it running Siemens 7?’ ‘Yes.’ Fourth question‘Is this software contacting an electrical motor made by one of two companies?’”

But he then blows his credibility with,

“Well, if the answer to that was ‘yes,’ there was only one place it could be. Natanz.”

His two step logic is,

Firstly the four publicaly known steps he repeates are what you would expect of “Washington lawyers” sitting in the managment chair.

But this is at best quite flimsy reasoning…

Because it’s exactly the same steps you would use if you were “targeting” the malware and also wanted a “low probability of detection” which any credible “cyber espionage” malware writer with the number of “zero day” and compromised private keys and other techniques would do irrespective of where ever thay came from.

Secondly Mr Clarke reasons that meeting those four requirments means “there was only one place it could be. Natanz.”.

That’s a totaly false conclusion and Mr Clarke should darn well know it, and the interviewer should have as well and not have let him get away with it.

It would have been more accurate for Mr Clarke to say,

Well, if the answer to that was ‘yes,’ there was a good probability it was in a system based on a design by Pakistan’s A.Q.Khan one of which might be Natanz.”

We know that Khan Labs in Switzerland sold “engineering” parts to build centrifuge cascades to atleast six countries and it is believed the basic design to maybe twenty four countries in total.

Of the six buying parts the most notable were Iran, Libya and North Korea. Those being sent to Libya were intercepted and the US got to know all the details and passed them on to Israel etc. We know from what the departing Mosad head said in his leaving speech that a system was built up and tested in Israel (which is where the NY Times made it’s story from).

So we know that there were production systems based on the A.Q.Khan design in Pakistan, Iran, North Korea and test systems in the US and Israel and one or two other countries.

We also know that for reasons that are not provably known Stuxnet ended up in a number of odd looking places if you only consider Iran as the target. So being there has been publicaly said it was a mistake in the Stuxnet design.

As I’ve said before what if Stuxnet was actually aimed elsewhere? Say at a nation that the US certainly considers a significantly more dangerous threat than Iran. And that unlike Iran was almost impossible for the US to get into with spys/agents and not connected to networks outside of the country like the Internet which might have alowed covert access…

Well consider North Korea, it is known that their scientists collaborate with their Iranian counterparts over nucleaar, missile and other technology. Likewise North Korea is supposadly “sealed by sactions” from the western world, however it is known that it trades covertly with and through some countries that Stuxnet appeared in (supposadly as a mistake…).

We know that North Korea certainly believed it was the target of the attack and sent the US a very public “single finger salute”, by very very unexpectadly and publicaly pulling in an international nuclear inspector and rocking his world in a fairly profound way. They took him to an old plutonium production site that was generaly thought to have been decomissioned but now had row after row of centrifugaes numbering in the thousands, that were recognisably advancments on the Khan design. The North Koreans gave the inspector virtually free run to go and examine the centifuges, with one exception it was made bluntly clear to him that he was very definatly being kept away from the control systems.

Now Mr Clarke is almost certainly aware of this and the interviewer should have been so as well. Which begs the question of “why” Mr Clarke just regurgitated stale and very likely incorrect findings in the way he did as it throws doubt on his credibility when he is effectivly still pushing his book and consultancy business on the fact that he is “The Man in the Know”.

But it gets worse on the subject of “cyber espionage” Mr Clarke says of the US,

“We hack our way into foreign governments and collect the information off their networks. The same kind of information a CIA agent in the old days would try to buy from a spy.”

Not exactly a surprise revelation, it’s fairly public knowledge that every country that has the ability to do so is at it, even against their friends, be it on an amateur or professional basis for either political or criminal gain.

The when the reporter asks about commercial IP Mr Clarke blows his credability with,

“Diplomatic, military stuff but not commercial competitor stuff.”

At best it was a very silly attempt to gain the moral high ground for his argument about China, at worst an idiotic attempt to re-write half a century or so of the CIA and other US Agencies activities.

I know from personal experiance having caught them at it the US Government carries out activities against the companies of other nations as it considers them loosely as “National Security” activities.

Even past US Army Major Generals have made it abundantly clear that the US Government uses the US Agencies to aid US Companies to get, maintain or destroy others access to raw materials or markets (Google “Smedly Butler” or look him up on Wiki).

So you would be forgivien for thinking that because Mr Clarke has handed out a very large “crock of shyt” to the interviewer, I think the whole interview is also a “crock”… well actually I don’t apart from trying to “big up” and “white wash” the US most of what he says is actually worth thinking about.