Schneier on Security

Clive Robinson • May 5, 2012 3:27 AM

@ Daniel,

Not really new but it’s in the news again…

And I would expect it to stay that way untill they get their way.

Essentialy the reason is simple nearly all “Social Networking” especialy those with SSL/TLS access (especialy if it allows TOR or other anonymising access connection).

I identified this as an issue on this blog some time back before the “Going Dark” episode.

In essence “Social Networking” is a “communications cut out” and as it’s almost always on privatly owned systems who’s companies don’t have “Common Carrier” status it’s not amenable to much of the current legislation (which assumes point to point communications with identifiable end points for “pen&trace” wire tapping).

Much worse some social networking is “store and forward” in nature with multiple end point termination, which makes “traffic analysis” difficult at best.

To see why a little scenario,

You and your “Mafia / Columbian partners in crime” wish to communicate privatly, with a little thought you will realise that most forms of traditional communications paths are moniterable, and worse those that are not (think traditional Spy Craft) are not very timely and quite difficult to implement.

Ordinary Internet traffic is likewise “point to point” thus you are only effectivly changing “telephone numbers” for “IP addresses”. And even where you can hide the distant end point through an anonymising network such as TOR it’s “immediacy” allows “traffic analysis” to be performed.

So on the face of it the Internet is little better than the telephone network for hiding in.

However what if you could combine the electronic communications asspect with a tried and trusted bit of “Spy Craft” such as a “drop box” or “dead letter box” or similar?

Well you can through major service providers such as the “Social Networks” and “Search Engines” and open post blog sites. So much traffic goes into these sites that from a “traffic Analysis” point of view there is little or nothing you can effectivly get a correlation on except “simultanious connection” or “packet size”.

The “simultanious connection” is easily broken by using the “store and forward” nature of these services (think writing on a popular friends wall etc) and the “packet size” can be likewise broken by using an interactive function such as an online editor where you type in and delete mainly “filler” that is several times larger than the network packet size and in one encrypted connection session you edit several messages.

The existing legislation does not in any way cover these usages and the simple solution of “banning them” we know does not work (think various totalitarian regimes such as China and Iran who have tried and so far failed). Thus “back doors” into these services and “encryption technology” is the next best thing from their point of view. However as I’ve indicated in the past there are ways you can use search engines etc to fully decouple a communications path between users, so from that point of view even “Social Media Supplier back door access” is not going to work for them.

The simple fact is there is way to much redundancy under the users control on a peer-to-peer network like the internet so smart people will almost always be able to communicate not just securely and privately but importantly anonymously as well. It’s not so much a “cat and mouse” game but a “blundering elephant and agile flea” game, most times the elephant cannot even see the fleas it needs to see and only manages to crush some more by accident than design.

Clive Robinson • May 5, 2012 4:44 AM

OFF Topic:

From time to time and much more frequently of late the vulnerability of “critical infrastructure” and the associated APT attacks comes up.

Usually it is in connection to the lamentable behaviour of the utilities and government agencies involved.

Well for once their might be a little good news…

http://www.nextgov.com/cybersecurity/2012/05/dhs-cyber-chief-industrial-system-threats-are-growing/55541/

The DHS deputy undersecretary for cybersecurity at the National Protection and Programs Directorate (Mark Weatherford) appears to be atleast in touch with the subject.

Importantly note from the article,

Much of the technical infrastructure running the machines was installed between 30 and 50 years ago, and security flaws are introduced when digital enhancements are layered on top

Critically this is not just “a past problem” but also “a future problem” and as I keep banging on needs proper “framework standards” that “mandate effective and efficient security upgrade paths for embedded infrastructure”, otherwise the likes of “smart meters” etc are going to be a very major security risk upto 50 years out from now.

If you want a reason to think about why it must be a “framework standard” with “mandatory upgradability” think on most if not all our lower level crypto algorithms and security protocals have had to become second or (considerably) more generation in considerably less than 50years, and many many attack vectors exist from having to support embedded hardware with now known to be weak protocols and algorithms.

And also as indicated in the article,

The main upgrades needed, according to Weatherford, are clarifying Homeland Security’s function in civilian cybersecurity, eliminating legal barriers to information sharing in the private sector, and ensuring critical infrastructure systems institute baseline security practices.

Whilst a good idea the implementaion could easily become a disastrous “straight jacket” not just on industry but all of us. Thus I would urge people not to follow the usuall US path to such things but the European approach of a tiered framwork of requirments and standards each of which has a tight focus and can be individually upgraded as required in a timely fashion and has a required review process built in.

One size “fits all” solutions often don’t work because they are overly complicated, self contradictory, with many edge cases and exceptions, all of which makes for excessive baggage and thus “legal burden” whilst providing so many loop holes most sensible people will just play the “lawyer game” and carry on doing as they please with ultra short future objectives encouraging “Russian Roulette” stratagies to compliance.

Clive Robinson • May 5, 2012 4:33 PM

@ Daniel,

It looks like people are waking up to the New FBI push, there’s a post on CNet you might want to read,

http://news.cnet.com/8301-1009_3-57428067-83/fbi-we-need-wiretap-ready-web-sites-now/

@ Bruce,

This new FBI push to have backdoors in social media sites looks like it’s going to be a “stick thrust in a hornets nest” as it’s happening at the wrong time politicaly, thus you may well be getting phone calls.

Clive Robinson • May 5, 2012 7:01 PM

OFF Topic:

For some time now various commenters on this blog have said in effect,

You cann’t stop crackers get over it and learn to mitigate them like other crime

Further some of us have derided “best practice” as at best a sad and meaningless joke.

Well it appears that others including a senior retiring FBI person are finnaly saying the same thing (It’s only takenthem XXX years to catch up 😉

http://www.wired.com/threatlevel/2012/05/everyone-hacked/all/1

Sadly nobody quoted in the Wired article mentione the fundemental reason why ICTSec is not realy working…

For several years now I’ve been saying that ICTSec lacks any kind of scientific rigour and the reason for this is it’s not currently possible due to a total lack of real metrics/measurands. Almost the first step of the scientific process is observation, not just looking, but looking combined with meaningful measuring, collecting and colating the observations so that they can be meaningfully analysed. Without doing this we have not got a hope of moving ICTSec forward into a more enlightend future, instead of it’s current dark ages of “magical thinking”, “magical pixie dust solutions” and “casting of bones prediction” (thankfully we are a mainly too squeamish bunch to try prediction by freshly eviserated animal entrails, but I know some who might be happy to try it on certain “carders” etc 😉

Clive Robinson • May 6, 2012 7:03 AM

OFF Topic:

As many have been aware one or two agencies under the DHS have given briefings about “Cyber-attack” and “Cyber-War” and it was getting to a point of sillyness because most of it had the same “ramblings” the “Chinese APT War-Hawk” mob have been getting uptight about for some time..

Does anybody remember the alert of water/sanitation supposadly issed by the DHS last year that caused much embarrassment and consternation in equal measure and was later attributed to poor equipment maintanence?

Well the DHS agencies changed their reporting methodology (especialy ICS-CERT) more it would seam to stop further embarisment than be of use to industry.

Well it appears to be happening again this time with the Gas supply side. Again through directed Spear Phishing attacks (a good reason not to have a linkedin, FaceBook or other social networking account).

Importantly it may have been detected upto a year ago by some commercial organisations (as part of the McAfee “Night Dragon”). ICS-CERT issued some general advisories at the time (such as http://www.us-cert.gov/control_systems/pdf/ICSA-11-041-01.pdf ) and things appeared to have died down.

Well the first public acknowledgment of the resurfacing or possibly new series of attacks from ICS-CERT was as a lead comment in their month end round up report for April released on Friday ( http://www.us-cert.gov/control_systems/pdf/ICS-CERT_Monthly_Monitor_Apr2012.pdf ) where they are saying they detected it towards the end of last year…

Well it appears there is quite a bit more behind the story, however what is fact and what is half truth is difficult to tell.

What has happened is the Cristian Science Monitor has released an investigative style report by one one of their Staff Writers (Mark Clayton). It gives some interesting details but not much that can be corroborated and it has a brushed up FUD style in places (see comment on Amber alert). In particular the piece alledges that ICS-CERT wanted the activities to not be interupted by the commercial organisations. If true this is unprecedented as the general rule of thumb is “slam the door and erradicate the vermin” in order to reduce legal liability…

Any way read the CSMonitor report ( http://www.csmonitor.com/USA/2012/0505/Alert-Major-cyber-attack-aimed-at-natural-gas-pipeline-companies ) for your selves, as since it’s release it’s all gone a bit viral and is being regurgitated on most news feeds and subjected to the usuall “Chinese Whispers”.

I would however urge caution though as the ICS-CERT has neither a good history nor a good reputation amongst many in the ICS industry for a whole variety of reasons (including a reputation in some places of “collecting and stockpiling cyber-weapons” for use by various US agencies), and this is almost certainly going to colour many re-reports.

Clive Robinson • May 6, 2012 12:44 PM

In the UK it’s Sunday evening which would normaly mean bleary eyes and parched throat of a monday morning is just a few hours away.

This would normaly require a large infusion of double or quad espresso in the throthy latte etc to try to restor normality prio to entering the office.

Sadly for many monday mornings is the day you are most likely to spill your “bring back from the dead juice” all down the front of your best suit and blouse/shirt just before that important meeting you spent the weekend slaving over a hot keyboard making that special presentation (that I assure you most others in the meeting will be to brain dead to appreciate or even be interested in when compared to the option of starring with a smirk at your steaming coffee stain).

Well as it’s a bank holiday in the UK tommorow that nightmare will be delayed for a day for some.But for all of us an article that explains in part how to avoid some of the likely spills,

http://news.sciencemag.org/sciencenow/2012/05/the-physics-of-spilled-coffee.html

However for those of us of a certain age or older this is not news, we know that the best solution is to have a verticaly damped support on a gimble orthagonal to the axsis of motion in the horizontal plane to reduce the sloping process in a cyclinder (think bucket full of sea water on the beach when building sand castles 😉

Clive Robinson • May 7, 2012 2:19 AM

@ Figureitout,

Here in “Yankee Land” we have mostly new buildings with cheap materials… but, I think with enough time the U.S. will blossom

Sadly in the UK we have Local Councils stuffed with philistiens, who believe their true calling in life is to have their sad little blip of an existance marked by some architectural edifice with their name scrawled across it’s frontage in som vulgar way.

Which in of it’s self is bad enough, however in most towns and cities building land is at a premium so in the words of the song “somethings gotta go”. And when it’s not the local municiple recreation grounds, sports facilities both often bequeathed under covernant or school it will be some other historic building of merit.

Because the idiots concerned have no concept of what “architectural context” is, nor for that matter do they care, they call in some consultant who then calls in some overpaid “architect” of little merit to provide some hideous concept design. Sir Richard Lord Rogers, of Millennium Dome and Lloyds Building fame for instance is a man who has shown that “selling an emperor new clothes” is a fast track to fame, fortune (with attendant tax avoidence scams) and a title or five.

Worse still are those with responsability for churches or famous historic buildings, they insist that things have to be added to them to provide modern amenities such as, conferance rooms, educational centers and spiritual enhancment facilities all with other attendent supposed “revenue enhancing” facilities such as restaurants and all the other “then necessary” bits such as offices and sanitary facilities fire escapes etc etc. All of these invariably slapped on the side of the building of merit, usually ruining the lines and the setting the building is in. Worse in some cases these glass and concrete “amenities” are designed by an architect who want’s to make a “personal statment” to get the awards etc that can be capitalised like Lord Rogers. So you end up with something designed not for those paying directly or indirectly (the community that has to live with the results) but what some aspiring idiot thinks will exicte another bunch of idiots they call their peers, but are in reality a clique abusing patronage to enhance their positions to get the honours of nighthoods etc.

What the churches or other buildings of historical and architectural merit end up with is a glass “lean to” or box unsympathetically grafted on like a clowns nose painted on the Mona Lisa.

I used to shudder at the concreat brutality of some places (look at Blake’s Seven to see fine examples such as Leeds Poly, Royal Festival Halls London, Rutherford Labs Didcot and Oldbury nuclear plant used as various settings). However they are almost enchanting compared to some of current designs around and some are hideously ruining the sky line over a thousand square miles or so (the Shard next to London Bridge station that is clearly visable from well over 30miles away and it’s not yet even compleated). But some are plainly ridiculous, in South west london there is a building that looks like an outsized Lip Stick and has thus earned it’s self the nick name of the “Lippy” it is truly awfal to look at as those traveling by train to Waterloo or Charing Cross are only to aware as they wince from overhearing comments made by amongst others “American” tourists about how silly / ugly / out of place it looks.

Mind you Lord Rogers has just recently come out to criticize plans to change UK planning laws, using L.A. as an example of what could happen ( http://www.dailymail.co.uk/news/article-2061260/Britain-Los-Angeles-style-ghetto-planning-reforms-warns-Lord-Rogers.html ). However one can not help but feel this is self interested due to his history.

Clive Robinson • May 7, 2012 6:15 PM

OFF Topic:

As some of you know Bruce used to do a piece in the UK Guardian newspaper (when they still had their printed technology section).

Well they still do an occasional technology piece, and this one is an interview with Major General Jonathan Shaw (one of my contempories back in the days I wore the green),

http://m.guardian.co.uk/technology/2012/may/03/hackers-breached-secret-mod-systems?cat=technology&type=article

Put simply he is saying that the UK has had it’s fair share of APT and that to expect 100% security is not possible.

However he goes on unfairly (to us old’ns) to state,

“My generation  … we are far too old for this; it is not what we have grown up with. Our natural recourse is to reach for a pen and paper. And although we can set up structures, we really need to be on listening mode for this one”

And he’s only 54 the cheeky git 😉

The actual problem is two fold “unfamiliarity with the problem domain” and “rigid thinking”.

One of the problems with becoming a staff officer used to be that you learn from the history of your predecessors to re-run the last battle (something that has been taken to ludicrous extreams by the TSA). Often with no change in tactics (an example from the Falklands war being, still using “salt-n-pepper” style advancing and commander lead assult attacks on dug in machine gun positions).

Over the past thirty years more flexibility in thinking has been encoraged in the armed forces command structure to keep up with the weapons development, but it still lags well behind that you would expect from those of similar age in the leading edge of comercial technology development.

And a big part of that problem is “command structure”, it’s way to deep and upwards progression is to put it bluntly to slow to encorage more than a limited degree in flexibility, especialy with the old “seniority” card being played more often than not.

But even if the command structure was flattened and the problems of seniority removed there is still the lack of familiarity with the problem domain that needs to be addressed. It is all very well to listen to youngsters but at the end of the day somebody has to be mature enough to take the responsability of making a command decision and they need the knowledge to evaluate what they are being told other wise they might be better served by throwing darts at a newspaper.

Now if any army wants to get “cyber-smart” soldiers and thus commanders they need to provide the career paths and rewards to encorage this progression or the “smarts” will follow the money out the door to a keenly paying commercial technology sector.

Oh and it’s also long past the time where politicians should be using armed forces as cannon fodder on political windmill tilting.

Clive Robinson • May 8, 2012 6:56 AM

@ Bruce,

A simple question,

Why the two certs on your site?

You have the EFF one for basic “read” connection and the Rapid one for “write” connection…

Clive Robinson • May 8, 2012 7:34 AM

With regards my post above about the latest “underpants” bomb plot.

I identified two groups who would benifit from such a “fund raiser” but forgot to mention one group subdivides.

Three letter agencies can be divided into

1, Agency staff.
2, Suppliers to agencies.

Now whilst it is unlikley that “suppliers” could directly carry out such a plot on their own, there are plenty of agency staff who might do it out of self interest.

One set of suppliers in particular fit the frame as it were at that is the suppliers of very high profit “advanced scanners”…

Now in the UK at present and I suspect from reading certain news sites in the US as well the claim is “The CIA foiled a plot” (apparently not true) for “an undetectable under pants bomb (definatly not true).

The very expensive “nearly nude” scanners can detect an underpant’s bomb (if makers claims are true) but a bomb without metal parts is undetectable by a magnetometer scanner such as were in common use prior to 9/11 and still today.

Now what we also know is that even the fancy scanners will not work against “butt implanted bombs” that we know the terrorist being blaimed for the design of this current bomb has perfected the “butt implanted bomb”.

We also know that certain high placed politicos and senior three letter agency staff have “cusshy jobs” either taken up or will take up with these fancy scanner firms, provided contracts get awarded by the smae staff to the companies…

What others may think on this depends on how cynically the think and how much evidence they have seen of “revolving door jobs” being taken up by various political and senior staff.

As I’ve said in the past it is difficult to argue backwards from event to cause because it’s not the natural order of things. However what does flow in natural order is being rewarded for services performed…

Clive Robinson • May 9, 2012 5:24 AM

@ Powdered flesh,

I think some things are getting “lost in translation” with the story…

In the version you quote it’s,

… babies whose bodies were chopped into small pieces and dried on stoves before being turned into powder …

Other English language articles say “microwaves” not “stoves”, A Korean friend tells me it’s actually “medical desicators”. Which sounds more likely because if it was a stove or microwave, the flesh would be quite well cooked before it had dried out and thus bacteria likewise would be cooked and thus not harmfull.

However he urged me to treat the story with caution as the state of play between South Korea / US and North Korea / China is getting perilously close to an excuse to “go to war” and all sorts of extrodinary and many mainly baseless stories are surfacing since the North Korean “space missile” launch (including one that the misssile had a biological war head on it and that the supposed failure and break up of the missile was actually the way the biological component was released…).