Schneier on Security

Clive Robinson • October 6, 2012 6:30 AM

OFF Topic:

First off a nice little synopsis of the issues of keeping data secure from Business Week,

http://www.businessweek.com/articles/2012-10-02/the-battle-to-protect-confidential-data

It’s not saying anything many of us already know, but it’s usefull to point less ITSec informed managers etc to as it’s kind of got the “seal of approval” that well known business publications have for those sorts of people.

If the middle managers and above still don’t grock it then point them over to,

http://m.darkreading.com/133696/show/cb7a1aa4dbbd7848c8571ac7e7311587&t=6600b77fc6ad026d88a2b3836204a0f3

Where they can see what various security concious Gov organisations are trying to combat APT issues.

Over on Brian Krebbs site there is an interesting article on why it’s not just the fact that there is a zero day attack on a piece of software you use that should affect your choices but more importantly if it is being used to perform exploits,

http://m.krebsonsecurity.com/2012/10/in-a-zero-day-world-its-active-attacks-that-matter/

Put simply the discovery of a zero day is like the discovery of any other bug, it’s been there unknown since the software release and now it’s known you have to chose what you are going to do about it. The point is if it’s not effecting you then you can in theory carry on using the software, the fly in the ointment is if an exploit is developed for the zero day. Now the probability of that is actually more related to the popularity of the software you use, which leads to some odd looking advise. That is you have the choice of two web browsers MS IE and some other package. They both have current zero days that have been advised, do you do nothing or do you switch from one browser to another? Well the advise is if you normaly use the popular browser MS IE you would be advised to switch but if you use another browser that is not as popular you probably don’t need to switch…

Now an interesting story on trust in base metal and why there is more gold in repositories than there should be…

https://financialcryptography.com/mt/archives/001386.html

Basicaly people are puting tungstan inside of gold bars as it’s sufficiently similar for the bar to “pass the usual tests”. The real question is do people realy want to know bearing in mind the effect it could have on the global economy in it’s current precarious state…

Whilst I can understand the idea behind a “gold standard” I’ve always thought that it was unwise to use a single metal and that it should be based on a raft of finite precious resources. This is due partly to the problems with supply and demand on a single finite resource such as gold that is also used for industrial and other uses and partly due to such issuess of fraud as in this case. At the end of the day “wealth” is derived from “the application of work to raw resources to produce goods of value”. Thus the alternative to finite raw resources is of course to use energy as the base standard as this is directly related to what we consider “work” in the abstract sense. However although there is only so much energy in the universe from the point of view of humans it’s effectivly a continuously renewable resource as long as the sun shines so more accuratly reflects the vaguries of fiscal inflation etc.

Over on Gunner Peterson’s site there are a couple of posts of interest one being his series of articles on Android developmentt the other being about Googel’s release of OAuth 2,

http://1raindrop.typepad.com/1_raindrop/2012/09/oauth-20-google-learns-to-crawl.html

Gunner makes the important point about OAuth having to be used with TLS but also several other points about why care should be used by developers of both client side and server side software.

Speaking of Authentication and it’s problems over at the UKs CambLabs there is more on the storing of plaintext passwords, this time by the UKs Companies House which is actually quite worrying (see the comments section as to why),

http://www.lightbluetouchpaper.org/2012/09/20/plaintext-password-reminders/

Some of you might have heard that “53 Universities” were hacked and thousands of personaly sensitive details were released. Well whilst some of it might be true other bits are not,

https://freedom-to-tinker.com/blog/sjs/sloppy-reporting-on-the-university-personal-records-data-breach-by-the-new-york-times-bits-blog/

There are a couple of underlying issues as to why this happens. The first is the race to be first on the Internet to comment, this has several advantages financial advantages for the news organisation. The second is that we are nolonger constrained by immutable news publication. That is it’s very easy to change the historic record at the press of a button. Some people are honest about this and mark up what they have edited and why but others just make changes without comment, which in my view is dishonest behaviour.

In my view the more people who try to be human and not perfect and thus admit their mistakes and correct them then the easier it is for the rest of society to do the same. As was once observed “perfection is for deities, and even they aren’t perfect” or more simply “to err is human”. As for me I’ve occasionaly said “The only time I open my mouth is to change feet” 🙂

Clive Robinson • October 6, 2012 9:07 PM

@ kashmarek,

Laser strikes on aircraft becoming epidemic…

It depends on what you mean as “strikes” you can purchase various battery/hand held lasers some green lasers are sufficiently powerful to be clearly seen reflecting off of buildings considerably more than a mile away on dull overcast days.

At night they can be seen reflecting atleast 2-3miles away without any augmentation.

You can easily augment the range by using a pair of binoculars where you shine the laser into one eye piece which effectivly colimates the beam. You can then look through the other eye piece and I’ve been told that distances of well over ten miles are possible.

That said you can augment the laser even further, because some green lasers are actually much higher power infra red laser diodes shining into a crystal that multiplies up the frequency to make it visable in the visable light spectrum. The power loss in this conversion is 15-20db.

Importantly although this infrared is not visable to the human eye it is very much visable to the IR cameras used on police / customs / military helicopters and can be used to jam some of these systems with little difficulty. Also some IR laser diodes produce significant output in the range that can also effect visable light cameras.

However most comercial aircraft once the front wheels are off of the tarmac are not effected by low powered lasers of any frequency simply because they take off and fly in such a way that the pilots eyes are shielded by the airframe. However this is not true for aircraft that are landing where the pilots eyes are more vulnerable.

The problem for helicopters doing some kind of surveillance is that when “painted” by a laser the pilot has little or no idea if it is just a hand held laser or some kind of gun sight. The pilots eyes are in danger of being partialy or fully blinded temporarily due to iris closing down in the same way as happens with the headlights on full beam of an oncoming car at night. Further as indicated the laser can also shut down the cameras thus effectivly blinding the pilot and observer, which leaves the pilot with few options the best of which is to turn away from the laser and fly out of range of a potential sniper weapon which is effectivly 2-4Km.

From a criminals point of view using a laser that can easily fit in a coat pocket that will cause a surveillance helicopter to break off is rather usefull when making a get away, especialy if they can get others to point lasers at the helicopter as well by simply phoning them up.

Clive Robinson • October 7, 2012 5:28 AM

@ Nick P,

It doesn’t seem wise for the US to warmonger against Russia

Yes Russia is still very much a super power these days, it’s just that the political influence tactics have changed.

Where as it was once militaristic with high counts of bodies in uniform, guns, tanks, planes, bombs and laterly nukes that defined a super power these days the reality is economic with the high counts of raw resources you control.

Both Russia and China control vast raw resources and are activly seaking control of more in other nations, realising that these are in essence the Achilles heel of an industrialised nation. Whilst China and Russia originaly had some very limited capacity to process the raw resources they have realised that the real trick is to get the organisations with the real processing know-how from the West and East Asia to setup production on their soil where they are easier targets for industrial espionage and political take over.

The Russians under Putin have shown that they are quite able and willing to “turn the gas off” on nations they want to exert political control over, just as the Chinese have shown they will not export the likes of rare earth minerals that they have a virtual monopoly on unless companies agree to set up their research and production on Chinese soil. The Chinese have also shown just as the Russians have that they are more than capable of engineering disputes with Western companies that have built large plant in China and effectivly confiscate the plant via their courts etc.

Some Western super powers are finaly waking up to the fact that their Hi-Tec weaponss systems are now totaly reliant on parts and raw resources they have no control over that come from nations that are not dependant or tied to these Western nations that are at best ‘old school’ Super Powers.

Super power status is rapidly moving to those who control the supply of resources the most important of which is energy. History shows us with the likes of “water rights wars” what is happening currently in the resource supply game and what in all likely hood will happen in the future. Quite literally the Super Power game is turning into one of “power” politics.

It also partly explains what is going on with the US/Israel and Iran. Historicaly Iran is not a warlike nation in that in the past 400 years or so they have not been the attackers but the defenders. Further Iran is very resource rich, and whilst sitting on what was and may still be the worlds largest lake of oil, the export of crude oil only accounts for something like 17-20% of it’s foreign income. Like several other middle eastern nations they know that the oil is a finite resource and are thus like many western nations looking for alternative energy resources to maintain their political independance and not fall into the trap of becoming a vassal nation that gets it’s finite raw resources “asset stripped” by super powers. For obvious reasons it’s not in the US interest to allow Iran or any other nation with raw mineral reources to gain energy independance as this removes a major form of leverage when “negotiating” for the mineral resources, now that the “point of the gun” negotiation/theft of Empire building of old is no longer seen as politicaly acceptable by the US voting citizens.

But from the Russian and Chinese view point some Hi-Tec Western Companies are not playing the game, because they are not falling into the trap of moving their research or production to their soil hence we see the rise of APT in it’s various forms. Not that Russia and China are the only nations doing APT certainly most EU countries and other WASP nations are doing it as well even if passively.

When the US war hawks jump up and down about “China APT” they are either showing bias for other reasons or their ignorance (take your pick it could be both ;-).

As I’ve indicated in the past it is well worth thinking about the route data takes to get from the US to China much of it gets routed through other places such as Japan and Australia both of which could monitor the APT traffic passively, or in fact launch attacks that look identical to that which does come from/through China. Likewise China can monitor all APT traffic that comes through them.

Much APT return traffic is in plain text or only lightly obsficated and even where it is encrypted the keys are either known or can be fairly easily got at via various MITM and other tricks. The reason this is possible is quite simply that with APT there is no “far end” “end point security” thus symetric keys are vulnerable and PK can be either subverted or by passed.

Which means that anyone sitting in the comms path of the APT return channel can passivly see the contents that has been stolen… Which brings a loverly new twist to the phrase “Who watches the watchers…”.

It is this realisation that may well have caused “the sons of Stuxnet” designers to use some of the methods they did to protect the real payload of flame and presumably other similar yet to be discovered attack vectors.

It also raises another point that I’ve not seen others discuss which is “traffic analysis” of the “return channel”. As you know the more advanced APT uses cut outs in the return channel, many assume that this is for the traditional reason of using cut outs. However consider that the network locations for these cut outs might be selected to specificaly stear the return channel away from various segments of the Internet that are known to be monitored. Analysis of where is being avoided or specificaly included may well provide information on who the actual originator of the APT is not who it appears to be.

Clive Robinson • October 9, 2012 10:26 PM

@ Nick P,

I hope we get sources that clear the connection between the bank malware & our intelligence agencies. Otherwise, there’s an implication: false flag operation.

Whilst I would not rule out a “fund raiser” we have seen them before with the likes of the FBI going out and recruiting idiots to use as “terror suspects” to show that “there is a real danger out there folks”.

I’m not certain that there is sufficient evidence to justify the “same developers” claim, mostly because as we saw with Stuxnet there were quite a few teams of people involved. So it is possible
that the original developers produced a framework that is now being used by other developers. It could even be that the original team were “freelancers” and individuals have sold/used the framework as the basis of other work or those buying originaly have sold it on to others.

Therefor I’m sort of sitting on the fence on the connection having any specific meaning (the code could have been stolen etc).

But yes False Flag / Fund Raiser is a very definate possability as you can not have a war against an enemy that does not exist, you have to make them exist even as a pale imitation of what you might claim is the enemy.

A thought occured to me some time ago when thinking about the Somali AQ connection, when the female student was shown to have been set up over the courier bombs. Just how diffficult would it be in that part of the world to run false flag operations…