Schneier on Security

Clive Robinson • November 5, 2012 10:44 PM

@ nycman,

People get all worked up over some risks and forget about others that could affect them.

Or they follow the money that keeps them and their organisation going…

I’ve said many times that the best training is generalised training that covers as broad a range of risks as possible (eg “Fire Evacuation” covers fire/bomb/earthquake/etc localised evacuation).

The proplem is since the “war on terror” started the funding has in effect only been for “anti-terror”.

And we are starting to see the knock on effects of this that effect everybody, which are only likely to get worse not better…

The US has now had a couple of “Thousand Year Storms” on it’s Eastern/South Eastern coast from Hurricanes in what is in effect a decade, the general trend in the severity of these storms is getting worse along with adverse conditions such as drought at other times of year. I don’t propose to argue why (gloabal warming / sun spot activity / etc / etc / etc) just note that it has stressed the US emergancy response capability rather harder and faster than might otherwise have occurred.

But it is not just hurricanes where weather extremes have occured. Those living in and around NYC/WashingtonDC have experianced significant power outages this year for considerable periods. Heatwaves and droughts have been more severe as well.

I don’t know what the direct and secondary death tolls are from this years outlying “tail” weather has been, but the economic cost just in increased food/fuel prices has moved a very significant proportion of the population from boarder line poverty into poverty.

What is known is that such a change in your personal and family fortunes can take ten to twenty years of of your life expectancy due to getting stuck in an ‘ill health spiral” where you don’t have the means or the support out of the “poverty trap”. Recent studies in epigenetics suggest that this effects upwards of four generations as well…

And whilst those not in such a trap might well “blaim the victim” for the position they find themselves in, they should remember that a healthy population is a necessitie for their own continued existance and good health.

That is ensuring good health in all the population is a “social good” that like a rising tide floats everybodies boat not an “individual good” that a few benifit from. This is because disease spreads more rapidly and considerably further in an unhealthy population than it does in a healthy population.

It is fairly clear to many that the “war on terror” is directing increased resources into areas where at best the resources are being wasted, at worst it is “beggering the nation” for the benifit of a chosen few.

And lets be honest the chosen few are not going to share the mis directed wealth that has come their way, for various reasons not least of all is their sense of “self entitlement” and “short term thinking” that engenders a view point that they are above society and it’s morals and laws.

We have seen this mind set amply demonstrated by the likes of Enron seniors and many Bank seniors and many major corporations seniors like major News Corporations. Clearly what they have done is not just moraly wrong but legaly wrong as well.

Sadly their “me me me” attitudes are draging the rest of society down, and not only does this cause a shrinking economy and thus an increase in povert and ill health it, in order to sustain their sense of entitlement they have to “socialy engineer” the population and politicians so that they can continue to get an ever increasing slice of the national pie to every one elses detriment. And this can clearly be seen in the way emergancy resources are appropriated currently.

Bruce might call it “Security theater” but attending the show at it’s exhorbitant price is not optional it’s compulsory, and this makes it in reality a “tragedy of the commons” which those in NYC and environs are having to currently deal with first hand, including those select few who thought themselves above such things…

Clive Robinson • November 8, 2012 5:44 AM

@ Nick P, RobertT,

You might not even need GPS. Maybe if you re define “location” to anchor-point or environmenta variables. You might have the system sniff to find network addresses, timings of a non-noisy network addresses, timings of a non-noisy channel, etc

It was the conclusion I came to a long time ago hence my two comments,

“And it’s using a side channel and secondry ocation refrences that makes you start to think for most customers why bother using GPS at all..”

And

“So Wifi and Cellular Base station proximity is one but it’s a bit fraught with issues as Google amongst others are very much aware. However this might be OK for the corporate customers you are looking at”

And it is this last sentance that is the all important one.

Basicaly if the customer has control of the area (ie it’s their office etc” then you could design a fairly simple beacon that uses the VOR principle to get a reliable direction and modified JPL Ranging Codes to get a reliable distance all of which was easily possible with 1970’s style technology. Both of these “antiquated” technologies I’ve mentioned in the past because they are easy to look up and get ideas from. I’m aware from Robert’s pevious comments on “Near Field Communications” to @ Wael he is well aware of much more moder techniques than VOR and likewise Ranging Codes.

However this only partialy solves the problem, because the use of a Beacon of any kind that “has to be installed” will leak out to an adversary on way or another (Shannon’s “The Enemy Nows The System” maxim) and thus open the oportunity for spoofing. One solution is to use a ranging code that is infact the output of a stream cipher which is in effect what the non civilian GPS uses to “authenticate”, similar can be done with the VOR signals if done with care (hey that’s waht “on frequency DSP” is made for 😉

However the customer I was working for had much more exacting requirments and very much higher expectations and having to install a beacon no matter how secure or reliable did not nor was ever going to fit in with their “in the field requirments”.

Look at the commercial business equivalent, when you are bidding for business tendered by another company you don’t normaly have all the meetings in areas you control like your offices.

In practice many of the most important meetings where realy sensitive info is needed on hand are the initial meetings and almost without exception some if not all will be held in places which are not under your control such as the offices of the company that is tendering. This is the equivalent of the “TEMPEST/Surveillance Traps” that your average nation state has to watch out for when entering into treaty negotiations or peace talks etc.

Obviously in such situations the sales people (ambassadors 😉 want to “Be Heros not Zeros” (or worse) and bring home the deal that is most advantageous as their future is also dependent on it. Now one asspect about heros that is not normaly talked about is that they are in fact “reckless gamblers” with their eye very firmly focused on what they consider the prize and they just will not let anything get in their way such as “Rules and Proceadures” put in place not just for their safety but the safety of the organisation.

It is these reckless gamblers who will take any throw of the dice to “Be a Hero not a Zero” who are most likely to destroy an organisations security by blatantly flouting or breaking the rules and proceadures. And unfortunatly they are the ones that generaly the organisation gives greatest leeway to as “They Get Results” in the short term (which in many non owner run organisations is all that the directors are interested in so the reckless gamblers get away with breaking all the rules over and over again…).

Thus you know from the outset that such people will go to any lengths to bypass such proceadures if they can as they also know that there is little or no downside to doing so (Think back to a CIA Director who used to let his kid surf the Internet on an agency issued machine that was used for his work which involved highly classified material, not even a slap on the wrist…). Thus as a minimum any system has to be beyond the ability of such Zero’s to bypass even with assistance from those who are more technicaly competent (but less than type I attacker) than they are.

Further the system has to be beyond the ability of not just a Type I attacker but in many cases of large organisations with multimillion to multibillion contract a Type II attacker as well. And the reality is it would be sensible if it could be beyond a Type III attacker as well if you think back to the French Secret Service cheif who on being interviewd by CNN let slip that his organisation performed commercial espionage for French companies as it was a lot cheeper than R&D…

Now if you remember back Nick P and myself have had a number of discussions as to the design of a hardware device that might accomplish keeping data away from “judicial compulsion” and we discussed ways of doing the extra jurisdictional (geographical) control such that you could also get the encrypted data through customs and other such border controls etc. A system for protecting large organisational sensitive data would have to also as a minimum do all ot that.

Now I will mention a point that Bruce and others have often made about National ID scheams and similar as putting to much faith in one single system or method, and thus giving attackers on single target to focus their suborning effots on. In effect a single strong system is more likely to fail than multiple weaker systems. However it is much worse than the normal engineering “single point of failure” because it activly encorages many many different sources of effort and we have seen this with the issues of RSA and further with CA’s and similar “top of hierarchy attacks” of recent times. It is also why the likes of *nix’s get considerably less successful attacks than the more popular MS OS’s. Thus it can be seen in the reality of human attackers that diversity is in practice considarably stronger than the sum of the diverse parts.

And this is a key point we know thhe US Civilian GPS is spoofable and in all probability the latest Mil versions with their reliance on a (supposadly) tamperproof crypto modual is also likely to be spoofable. But we also know the US GPS is not the only one… Therefore there is even in this very narrow market some diversity available. Further due to earlier use of the SA code people developed differential systems forUS Civilian GPS which if it was still used would provide a space diversity element that would make the job of spoofing GPS considerably harder.

But that still does not remove the fundemental issue of all satellite navigation systems being “clear sky” in operation and unsuitable for many urban applications as well as distinctly unreliable in indoor “closed sky” applications.

Currently all our electronic navigation systems have as their fundemental underlying mechanism the measurment of time as constrained by the speed of light (ie some relatvistic effects) to calculate distance from a point of refrence. We further know it is impractical to have a sufficiently accurate time standard in a usable device for attaching to a laptop or other easily person portable computing device such as a smart phone so an external time refrence is required.

During WWII the early electronic navigation systems used various methods. The first was to “cross beams” which as it was not realy time based as such was quite inaccurate but suitable for identifing an area of a few square miles. From that point on all systems were time based and used either a ping pong system where the plane would transmit a pulse and see a time delayed reply from the base transmitter or multiple space diversity systems at the base transmitter end. Such systems can be incredibly accurate provided allowance for the defects in the total channel are alowed for.

Now as a first guestimate in many places there are multiple cell phone services, simply placing two phone calls with different providers should provide some space diversity at the mobile end provided the different service providers are real (not virtual) and do not share transmission sites.

If both calls were placed to a single time source then the path delay for each could be calculated realitivly easily. As audio calls are traditionaly “circuit switched” not “packet switched” changes in path latency are likely to be minimal even with modern digital systems. All that would need to be known is which base towers and down haul routes are used to calculate a curve on which the device must be on. If three or more towers could be used (and there are ways to do this using forced hand off) then a reasonably accurate position fix can be obtained. Google for instance uses a much weaker variation of this to try and get a position fix for phones that either lack GPS or currently can’t use GPS.

Now as I’ve mentioned in the past a modern “smart phone” contains all that is needed to run a drone or other autonavigating pilotless vehicle even when GPS is unavailable and RobertT has given an aproximate price for a chip set in the past. These days such chip sets usually contain not just cellular and GPS radio systems but WiFi as well, and in quite a few cases accelerometers as well.

Thus this provides a great deal of diversity in what the security system has available, so much so that spoofing would be fairly easily detected simply because the spoofer would not know which signals the security system was actively monitoring. Further the spoofer could not spoof and provide the correct aquisition and loss profiles from the RSSI detector in the system simply because the spoofer has to also be a jammer to spoof (I won’t go into details on this because I’m not sure what is and is not in the public domain etc).

One thing that cannot be reliably spoofed is the position of the jamming signals themselves and they wont be at the expected positions of the signals they are spoofing. If such a security system were to be built into a laptop or hardend case for a laptop then multiple antenna for GPS (~2GHz) Wifi (~2.5GHZ/~5GHz) and cellular (~1GHz) are fairly easily possible and at orthagonal planes to each other (think four of the six corners of two sides of a cube). It would be reasonably easily possible using a “Phase Sensing” diversity receiver to model what the expected behavior of multiple single point refrence sources should be to any given movment of the security system which would be a known to the system from the accelerometer inputs. As this movment is most definatly an “uknown” to the spoofing system it cannot compensate for the movment and would thus be liable to detection. However it would require some interesting and somewhat complex signal processing to decide what was spoofing and what was due to movment in the evironmeent of things like users, but as they say “Such a system has potential”.

So yes it is possible to build a navigation system using modern smart phone chip sets that by knowing fixed points of refrence could establish it’s possition within a hundred meters or so quite reliably even if one of the systems (GPS) was not available continuously. Thus such a navigation system could be used as part of a security device.

The main problems being knowing where the fixed points of refrence are, CPU/battery consumption and anti-spoofing technology.

As indicated Google have partialy solved the first problem, building the security system into a ruggedised clam shell case for a laptop would go a long way to solving the second problem along with providing the antenna diversity for the third problem.

The real question now becomes “is there the money/market available to take such a product forward in a viable way”.

Clive Robinson • November 10, 2012 9:26 AM

@ RobertT,

From your description of the way you are doing things I would look at definatly seperating the navigation element from the storage element and use an appropriatly protected trusted path between them.

For arguments sake make the navigation unit look like a NEMA serial device format wrapped up in some kind of signed message format sent across a USB interface implementing one of the serial protocols. This way you are reasonably assured of having compatability with several generations of laptops and those to come (and if I remember correctly the USB-Serial device is one of those “standard” interfaces that is not encumbered in the way the non standard ones are).

My experiance has taught me that the best way to do a navagation system is to layer up with the least stable localised system used as the master to which corrections are applied in an acculamative maner by the more accurate nonlocal systems.

So I’d assume you would use the localised acceleratometers to provide continuous position updates to the last known location. As and when a more accurate location fix comes in you calculate the drift average to provide future corrections and update the actual location fix.

This way you know how the drift from the accelerometers happens you can continuously make updates even when a good external refrence is not available.

Also there is a side issue if you think about how humans navagate they realy don’t care for their absolute position with respect to the earth but do need some kind of fixed refrence from time to time they can move awayfrom and backto with reasonable accuracy.

They also need a highly acurate local refrence that can be any point that is stable for the time they are chosing to navagate around it. If you look at it as moving around inside a vehical from one place to another. The person piloting the vehicle needs to know the vehicals position with respect to a fixed geographical start, destination or way point. The passengers however only need a local refrence inside the vehical as their nominal position (seat) and various object refrences such they can move around them to get to say the toilets etc. The passengers care not a jot about what point the vehical is at in the journy only the entrance position at the journy start and exit position at the journy end.

This peculiar situation arises because although humans do have a quite reasonable inertial system in their inner ears it’s used in a differential manner to keep balance not to aid navigation. Humans navigate from object to object with their senses of sight, hearing and touch with respect to a local point on the object that may or may not be fixed to another refrence.

Which brings up the notion of using a visual system to add accuracy to the navigation as some may have noticed their are now online services that try to display on their screen the same image a user sees when they point the phone at it. In theory you can do the opposite ie view the image from the camera looking for a recognisable point of refrence to take a fix.