Schneier on Security

Clive Robinson • April 4, 2012 6:22 AM

I guess this shows most of us are “defectors” from social norms when we think we are not being watched…

That said however some of the “looking” might have been people trying to find details to contact the owner (then again maybe I like to think the best of people 😉

Clive Robinson • April 4, 2012 7:12 AM

@ RobertT,

Smart phones are the new attack vector for high security air-gapped networks

I’ve been aware of some of the obvious potential for this (ie people are daft enough to plug the USB lead in to recharge etc) but I’ve not been able to find specifics on other potential vectors.

I’d be curious to hear if some of the more interesting active attacks (Hijack etc) that were known about with old style mobiles thirty years ago are happening today.

Clive Robinson • April 4, 2012 10:56 AM

@ Swatne,

There is way too much FUD over mobile security

There is and there is not depending on your perspective.

Locking your phone could be looked at in the same way as shutting your windows (the ones on your home not your PC 😉

It used to be the case that people would go out of their home in warm weather and leave the windows open, they might not even close let alone lock their door (unless it had a snap lock on). It was not unknown for a neighbour to pop in and borrow a cup of sugar or flour etc rather than trudge off to the shop whilst in the middle of baking etc.

When I was a youngster even in quite densly populated urban areas it was still very common if not the norm. In fact I used to know of many people who used to leave money by an open window to pay either the milkman, window cleaner or coalman (yes I’m that old…) it was considered normal behaviour.

However in what many regard as the break down of society “helping yourself to other peoples property” has become more prevalent and if you live in urban areas around a large city you probably have not only the windows closed but have locks on them as well (partly because of insurance companies partly because of fear). But it is noticable in quite a few small villages etc “out in the sticks” or countryside in very rural areas that people still leave not only their windows but also their doors open not only during the day but quite often at night.

The average “urbanite” would be both supprised and shocked to see this rural behaviour (along with being jealous and wanting to live that life). Likewise those living that rural life would be horrified at “city life” and what the urbanite would consider normal behaviour.

Thus I suspect that in areas like NYC and other major business areas having phone security enabled is considered normal, not of necesity by personal choice but normal none the less. However in places like Orange County and other effectivly wealth segregated or “gated communities” I would suspect having phone security enabled would be looked on as a little wierd.

However as time changes and mobile phone theft rises (as it almost certainly will) peoples viewpoints will change.

Clive Robinson • April 5, 2012 3:59 AM

@ RobertT,

OT: What is interesting is that the reduced battery life on many Apple and Samsung smart phones (only a few hours) is resulting in many employees charging their personal smartphones at work. This by itself is a security nightmare, when USB ports are the preferred charge method.

It’s not just phones… The first real evidence of this sort of wholesale attack via the supply chain was on Apple media players (this was a long time prior to the term “APT” surfacing). Loaded onto the media player prior to “shrink wrap and security seals” going on the purchase presentation pack, was a PC virus, Apple indicated it had been done by one of it’s subcontractors, but the details at the time were a bit sketchy (ie the “who what and where” were not indicated).

And yes I know both Apple and Samsung use Chinese sub contractors for all their products as some part of the production process.

Likewise those manufactures of the memory cards they include with the phones, and you can bet (a years income against a pinch of salt) that those memory cards are not checked for malware before being put in the presentation box. Also as this is usually done at a sub contractor it’s a not unreasonable bet that Apple and Samsung don’t even know if the memory cards are the ones they purchased…

Now as Apple is popular with both Gov and Mil types as well as managment and psudo geeks their products get in all the “best places” for APT. Which is an issue not lost on the DOD, NSA et al, which might be a reason behind Apple setting up a new production facility in Texas and effectivly shortening the supply chain…

However getting back to memory cards, the fact is that you realy don’t know what’s in them…

At the very least we know they contain the uCard comms interface into an onboard CPU which mediates via various life extending algorithms to more flash memory than is printed on the packet, or accessible by the host device…

In actuall fact we know that some memory cards contain considerably more flash than the packet says simply because it’s less expensive to make a single production line of large capacity devices and “hobble down” to fill other product lines than it is to have multiple production lines.

If you are of a curious / suspicious mind then the question might arises of ‘With a CPU and spare memory that is hidden from view just what sort of nasties could be hidding in there, tucked out of sight behind the CPU’?

Now it’s been a while since I looked in this area with a storage scope etc but it used to be the case that the signals on the comms interface were driven by software on the host device and as such varied slightly from device type to device type. Effectivly leaking information about the host device. Thus there is a reasonable chance the CPU in the memory card could “enumarate the host device” and know reasonably well what it’s plugged into…

So to the curious / suspicious mind another question then arises of ‘What capabilities does this give for covert action by the supplier of memory cards?’

Which brings me onto your last comment,

Now what is really worrying me is the additional fact that we getting lots of reports of sudden and complete loss of data stored on these quick-swappable smartphone Flash memories…think about it….

We know that the various memory card specs allow for not just selected deletion but “bulk deletion” of the whole device, the question then is ‘Where does the command originate?’, followed by ‘Why?’.

As you and I have discussed before a suitably long binary string/number could be used as a trigger for hidden malware not just in software but hardware. The length of such a string effects the probability of it being discovered, the longer the less likely. But importantly to be usable the trigger string would have to fit within the alowable length and range of a comms protocol which would keep it relativly short.

The problem with most comms protocols is there is very rarely a uniform distribution across the range as many are designed for one reason or another to be human readable (it eases testing and compatability). So if you were looking to pick a “hidden trigger” string you might well pick one that was on the fringe of the distribution.

Now how might this go wrong… let’s assume for arguments sake the hidden trigger is chosen to be in the file name. Most memory cards used for file storage use MS FAT for compatability reasons this allows for the 8.3 “printable character” file name with some characters reserved for extended file names. Thus not only is the length short, it’s range is also restricted. But as the field is ment to be human readable it has a very biased distribution as humans don’t as a rule use random file names as they convey no meaning.

But in most cases the lower levels of the file system tools will alow you to use the larger range of non printing characters as well. So the choice of trigger string might be chosen to be an improbable file name to reduce the chance of accidental triggering. Both the Apple and Android OS’s are unix based and the unix file system unlike that of earlier MS OS’s does not care if you use some control chars, so alowing a larger range across the entire file system tool range.

Now most of the Internet servers actually run on Unix for one reason or another and content managment systems especialy those that differentiate between desktop and mobile web browsers have some very odd file names that are effectivly generated automaticaly, because they are not ment for “human reading” just “link clicking”. Thus having a much wider distribution they would have a higher probability of hitting a trigger word picked to be not human readable.

I’m by nomeans saying this is what has happened, but if you don’t go through the thought process you won’t see the possibilities that others have and might have chosen to use.