Schneier on Security

Clive Robinson • April 20, 2012 6:42 AM

@ Bruce,

I’ve occassionaly mentioned the UK satirical bi-weekly magazine “Private Eye” as a worthwhile read, esspecialy the “In The Back” section. Well guess what they have mentioned this very smart meter issue in the latest issue.

@ Jurgen,

Isn’t this typical of an arms’ race, that sometimes, we see a flip to the roots again… …Same here ..? Bruce, is this a studied pattern ..

It’s a very very old pattern and it often involves a gap of about one human generation (15-25years).

The reason is often given as “people failing to learn from history”, however it’s a bit more complex than that. If you look at IT security it’s happening in that the old malware built to exploit initialy floppy disks and later from floppy to hard disk boot sector etc are showing up again. The reason is that removable media has come back into fashion with the likes of USB thumb drives.

So it also requires technology to go in cycles as well as human memory remembering the good but not the bad. Normaly each cycle tends to be an improvment on the previous cycle because the technology whilst improving rapidly over the first couple of cycles usually fairly quickly ceases to make sufficient improvment to open new attack vectors.

Oh and on the purely human terms “con tricks” have followed these cycles just as fashion does…

@ Gweihir, Nick P, RobertT,

Seriously, I expect these things have an XXXX interface and no security at all. Likely no security was something along the lines: “We do not think there is a problem”. Very low amateur level indeed.

Ever get that feeling “we’ve been here before” and “talked it to death already” 😉

Sadly it appears many “engineers” either don’t learn or have given up under marketing and managment preasure.

Lets be honest we are seeing “open comms” on a whole variety of very cheap contactless technology and I amongst one or two others have said it’s going to be a significant issue for around twice the expected life time of the products.

Smart meters although being very cheap are very expensive to instal (between 30 & 120 times more than the cost of the device) so they are expected to have a +25year life expectancy to break even.

So guess where the Marketing dept and Managment thoughts have gone? yup how to get a tied market selling “add ons”, but in order “to get the in” they have to come in at a very low individual unit price. Now the “consumer” of these devices are not the end users but the utility companies. It’s not in their interest to get stuck in a “tied market” so they specify certain things in their tender specifications to prevent that.

But the Utilities are only interested in the “utility interface” not the “end user interface”. Which has a perverse effect in that some end user interfaces do have “obscurity features” to get the tied in market.

However the utilities are painfully aware that they are likely to buy many manufactures units in order to keep the unit price down, and this would under ordinary market conditions mean they would have to buy many sets of meter reading and programing equipment.

So their solution (from restricted documents I’ve seen with regards “water meters”) is “known plain text protocals” so they can have a seperate market place in reading and programing equipment.

So we are coming around to “common specifications” but only at the lowest possible price, which means no security of any kind not even “obscurity”…

We have seen this all happen with “remote controls” for TV’s / Video’s / Home Entrtainment systems. So much so that you can buy “universal” or “programable” remotes (hint the electronics in these are compatable with some of the utility meter interfaces and as we know you can by Universal Remote USB dongles and for those with an interest there are Linux drivers).

Now as some of you know I’ve been banging on about a properly thought out “International Standard” communications protocol with inbuilt security for not just utility meters but for medical implants as well. Importantly with “upgradable” base security protocols so we don’t end up having to use 50year old security protocols (remember DES was broken in much less and RSA keys of 700bits or less as well and various hash protocols).

@ Bruce Clemens,

He used to wander around turning off unused lights and appliances. What’s worse, he corrupted his children by teaching us to use the same scam

He sounds a lot like the (supposadly) “richest man in Britain” the Duke of Westminster, apparently he has a mania for such behaviour boardering on OCD.

However it needs to be said, that many “low energy” lights actually use less electricity when on than many home appliances in standby…

The problem is then that “switched outlets” are not that reliable, as I’ve said before many switches and plugs/sockets are only guarenteed for 50-200 operations. The cheaper the design the worse the problem, and beleive me when I say that many UK “switched faceplate” outlet sockets are not going to be upto to many operations.

Oh and this applies to our “in pocket appliances” as well, many people are finding that their nice shiny smart phone with USB charger is not charging to well on micro USB after less than a year, and that they need to use a rubber band or put the phone and lead in “exactly the right place” for it to reliably charge (Motorola appear to be way better on reliability in this respect than HTC, LG or Samsung).

@ Doug C,

I have learned how to not get shot, they act really nervous and over the top

Please don’t get me wrong on this but perhaps you might be better off if you did get shot…

Certain Federal and other LEO’s in the US have basicaly just “gone in hard” sometimes even “with gun’s a’blazing” and injured people, who have then sued and received not just substantial damages but considerable publicity, the result being they have become “gold plated” in that all LEO’s “know, the varmint has sharp teeth” and give them a wide berth from then on.

However like you I would prefer not to have any more additional holes in my person where nature did not put them by design. I know from personal experiance that such holes tend to hurt and cause medical complications for years afterwards.

However a funny story about “living of the grid” for you.

In the UK untill recently you could get paid a considerable multiplier for every watt of electricity you “put back into the grid” than you would pay that is you got paid about five times the base unit price for “renewable energy”.

Well I’m aware of someone “fudging” the system. They put in solar cells, wind generators and a woodburning generator. Thus their home electrcity was more than covered “off the grid” and they were making a “few bob” putting back the excess. Well they got together with their neighbour (semi-detached house) to make the few bob a much better payer… Basicaly they took grid electricity off the neighbour, down converted it to DC and put it back into “the solar cell” interface to make a nice little earner for them both…

Clive Robinson • April 23, 2012 10:33 PM

@ mrrisk,

If you are going to choose to do criminal activities to make money, there has got to be stuff with less risk for the same (~$200) a month reward.

It depends on how you look at it.

For instance I’m fairly sure that many otherwise law abiding US citizens that try a bit of “creative accounting” with their expense claims, tax returns and even stationary requests for a great deal less than $200/month. Not because they can but because they look on it either as not being a crime or a victimless crime. Some even do it because they beleive that they “are owed” the money for some reason or are “sticking it to the man”.

Making false financial claims is more commonly called fraud and in most places for most people it’s a crime which in some cases (taxation) can lead to quite long terms of imprisonment or long term unemployment etc.

However these same people would not “shop lift” or go and commit various non violent “street crime” or “breaking into homes” all of which if done with intelligence can carry less risk and greater reward.

It is all crime but the risk / reward is rarely if ever seen correctly by the people carrying it out and that is often why they are caught.

Clive Robinson • April 24, 2012 11:30 AM

@ P.Anderson,

But where can taxation crime lead to long term unemployment? In UK

As far as I’m aware in all Sovereign Nations “Tax Legislation” is actually law, and (in many nations actually larger and more complex than other areas of law) thus breaching it can be considered only as one of three things,

1, Unintentional (usually punishable by paying owings pluss interest).
2, A Tort (punishable by fine).
3, A Crime (punishable by a fine and or imprisonment).

The person who initialy decides which it is, is the taxman. As we have come to see in the UK the chance of option three or two being selected is proportional to how many resources you have to fight, and the amount of influance you have purchased from the taxman or the politicos.

Thus the big fish (Tesco’s, Vodafone and various other large businesses) hardly ever get taken to court and if they do they usually have the resources required to hamstring the system such that they get away with it (because tax legislation is so extrodinarily complex most judges cannot get their head around it and the reason it’s so complex is because the politico’s want it that way as it alows them to benifit from the system).

However if you are one of the little people who the taxman knows does not have the resources to fight then the chances are you will end up with a criminal record or a very very large hole in your pocket (ie you pay off the taxman to avoid prosecution).

Now in the UK it’s a bit more complicated, because we have the Proceads Of Crime Act (POCA) and this can be used to “strip you of your rights” basicaly the taxman sequestrates all your assets prior to trial on the excuse that you will “flee with your illegaly aquired gains” (please note this is putting the cart before the horse in that at that point no illegal activity on your part has been shown let alone tested in court or proved). So you have no money to employee sufficiently qualified representatives to help defend you…

The result is you end up with a criminal conviction irrespective of if you are guilty or not but that’s OK because “Justice has been SEEN to be done” irrespective of the actuality.

Now in the UK and many other places your employer will ask you if you have a criminal conviction, caution or have ever been arrested or have County Court judgments etc. The fact they are not supposed to about “spent convictions” or most of the rest of it is neither here or there, because if you say no when the answer is yes your employment can be terminated immediatly without recourse as you have breached you contract of employment. If however you decline to answer (for whatever reason) you don’t get hired…

And as has been revealed via recent legal action in the UK there are quite a few private organisations who collect any and all data they can on people and build profiles. The fact that this is in contravention of both UK and EU data protection legislation is neither here or there as they usually base the part of the organisation iinvolved with such activities in foreign countries…

And as far as I can see this applies to the majority of first world nations and all WASP nations…