Schneier on Security

Clive Robinson • February 23, 2013 4:58 PM

@ Petrea Mitchel,

It appears the doors are activated by RFID from the outside, but motion from the inside…

Ha, ha, ha, I haven’t even read the article and I find that very amusing.

It reminds me of the old “spoof the alarm till they turn it of trick”.

All you need to do is either find an opening like a letter box or ventilator, or drill a very small hole through. Unfold and straiten out a wire coat hanger and push it in and move it till the alarm goes off. When it does pull the coat hanger out and retire to some stratigic point. Wait for sufficient time for the keyholder to turn up talk to the poliice and go home then repeat.

At some point human nature takes over and the alarm stays turned off, then bring your truck around “jimmy the door” and load up…

You’ld be surprised at just how many people fall for this even having done “Practical Security 101″…

Clive Robinson • February 25, 2013 3:11 AM

@ Nick P,

. I’m honestly shocked this hasn’t happened before

Which bit?

We had the Brinks-MAT robbery in the UK which was back then at some 26million GBP actualy larger than this dimond hiest ( http://en.wikipedia.org/wiki/Brink's-MAT_robbery ) It also, out of interest gave rise to “fake gold bullion” made of tungstan which is a crime that currently in the bullion trade “few dare speak” about because they don’t want “to kill the golden goose”. Basically tungstan fake bars keep turning up in bullion stores, and like the bank in Brinks-MAT the banks involved have bad paperwork records.
Some people connected with the bullion industry think that anything upto half the “new bullion” that has appeared due to the economic down turn may actually be tungstan fakes, due to the way the bullion system works (as an ‘owner’ you never get to examin the gold you buy just the bank issued gold certificate…). It might also be the reason why a country decided to pull it’s very large gold reserves out of the UK and other bullion repositories…

Another UK raid (that went wrong) was for the De-Beers diamond exhibition at the Millenium dome ( http://en.wikipedia.org/wiki/Millennium_Dome_raid ). Known as the “Dome Raiders” attack (yes journalists have poor judgment) after the Tomb Raiders game, it was a ram raid style robbery with a JCB digger and nail guns with a James Bond style speedboat get away planned. Officially the total values of the diamonds that could have been stolen has not been released but just one of the stones was worth in excess of 200Million GBP at the time. And security was at best non-existant compared to the value…

The thing about high value raids especialy for cash is they are a thing that is moving into the past due in part to inflation…

Look at the Great Train Robbery of 1963 the value of the haul 2.8million at the time was immense but now look at an individuals “take” of 150,000GBP from it, in to days money, you’ld be lucky to buy a one bedroom flat for that. At the time the robbers bought a farm before hand to have a safe place to count and hide out. But when you look into the raid you will see that they had to move over 120 heavy mail sacks into a truck to do it, and actually left some behind.

And that’s the problem whilst the same amount of money is moved around, inflation has reduced it’s value immensely but not it’s weight, you just cann’t shift the stuff quickly enough to make it realy worth while.

Whilst there are one or two silly people who attempt “stick up raids” for cash on Bank Delivery vehicles in the UK there is no real money in it. Assuming you could carry it all which is doubtful for a number of reasons you’ld be lucky to clear the UK minimum wage for a year as your share of the takings and would be looking at 5-25 in jail in the very likely case that you would be caught.

However some commodities such as diamonds, platinum and gold have kept their value for weight and these are what are now beeing targeted but they are no where close to being as commonly moved as money, hence the fall in the number of “armoured car raids”.

Now the usuall thing about protecting these commodities from theft is to make them “to heavy to carry” and thus to slow to move in respect of police response times.

Thus any criminal with half a brain is going to plan around when the commodities are not loaded down by 10 tones or more of reinforced hardend steel. Likewise the security and insurance firms are going to either remove or minimise the possability.

The usual way to remove the possability is to transfer the goods in a secure area where in effect you take your safes inside another safe and make the transfer. The way to minimise is to reduce the time the goods are outside of a safe and this usually hasss side effects…

The problem with aircraft is they are light weight by design and can as has been shown on television several times be ripped open in seconds by modern cutting tools. As they have no weight their only security value is they are difficult to get at when in the air, so the insurance company transfers the high value goods literaly just before take off and this is actualy the major problem.

What these raiders knew as Bruce and most of the readers of this blog know, airport security is at best a bit of a joke (But don’t tell the TSA they are known not to have a sense of humour 😉

The perimeter of your average airport is measured in miles not yards so fencing is more for show than security. Guards are likewise expensive so spread very thin on the ground (anb likely as not on close to minimum wages). Even the provision of secure loading facilities is not good for a whole host of reasons which brings us again to the major problem…

Which is that the aircraft is “mixed load”, it’s not dedicated to just carrying the high value load or just freight it frequently has passengers…

And the reason it’s a problem is it’s no big secret to find these planes that are carrying these high value loads because of the knock on effects of the security precautions (catch 22).

Basicaly the passengers are put on board first and at the last moment the high value load is put on as this takes time the passengers see a delay in their departure from the gate and the pilot will make some excuse over the intercom to cover this vehical suddenly appearing and another lugage container etc being put on. Likewise when the plane lands it often does not go direct to the gate but waits to be met and the high value load to be removed, again the pilot will put out some excuse over the air.

Now there is a problem with this first off a halfway suspicious passenger who flies regularly will realise something odd is going on. But due to the problem of fixed flight time slots it is known quite a long time in advance for regular high value loads as the checkin and gate closing time has to be adjusted accordingly so these things are obvious to those with eyes to see. ie not just passengers but terminal cleaning staff, duty free shop staff, airline staff, ground maintanence etc etc. Potentialy even those who might analyse flight data for various reasons.

Now once you know what you are looking at the next step backwards is to connect the regular high value load flight to what the high value load is. This is the part where you might need some inside knowledge but in general a smart person could work it out without having to be an insider.

However in general the criminals work the other way, that is they know high value cargo is moved from point A to point B they have to work out how. A little observation on their behalf would tell them how often and when. A little further thought and surveillance will give them the information required to know it’s by aircraft and a look at the regular flight details will give them the rest.

They can then sit at the airport for a few weeks and observe which flights have early gate closing times and at the other end which flights have delayed arivales at the gate.

They might even take one or two of the flights to confirm it…

At one time the insurance companies used to use the “flag carrier” of the destination airport where ever possible because the flag carrier is usually given prefrence in many ways at their home airport not just in ground facilities but landing slots gates and other airport facilities (it’s worth knowing this as a passenger as it usually means your flight will get prefrence at landing even in bad weather so your flight delays will be minimised).

Nowing this would also make a criminals task easier as it provides other information about where in the airport the loading and unloading of high value goods will be done.

Now assuming that the insurance companies know this and that in all probability for this theft it has been exploited they will in all probability make some changes to what they do (if they can).

But have a think about what can they change…

Now another thought as I saiid an aircraft is fragile and this attack happened at the take off end. How long before we see one at the landing end where in all likelyhood the aircraft etc is in a more open and vulnerable place…

Clive Robinson • February 26, 2013 1:00 AM

@ Nick P,

With respect to the M$ guy yeah, it’s not fun when as you say in the US you get to “Eat your own dog…” [1]

Over in the UK we used to have an expression about eating “Humble Pie” not that I ever expect anyone senior in a Dog eat Dog Corporate to be humble.

One thing I did notice though was,

Bejtlich replied, “Our best guys are better than APT1 for sure. But our best guys are probably the same as their best guys, who are the same as the Russian’s or the Israeli’s best guys.”

Is this an accidental slip of what Bejtlich thinks is the next business model after “Selling Zero Days to Gov Cyber-weapons”?

i.e. with saying ‘our best guys are probably the same as their best guys’ does he think that they are? a hacking collective who will go “Contracting Out for Government Hacking” [2]

Even if not it’s an interesting business idea };)

Mind you I’m actually glad to see in this report Russia and Israel get mentioned as APT countries not just the usual “China APT” rhetoric.

[1] I’ll leave it to others to select which GI/GO 😉 Mind you he probably earns enough to drink the “Civit Cat Expresso” so is used to the taste of GO being dark and earthy with that little animal je ne sais quo.

[2] Actualy if you read enough of the Stuxnet reports you see some people believe that’s what many actually may have happened with the US/Israel, they shared “bought in tallent”.

Clive Robinson • February 26, 2013 3:05 AM

OFF Topic:

It appears that the action taken against Aaron was not because he had broken any laws but a political action from the very top of the hill to maintain the status quoe for those holders of IP rights in effect stolen by force majeure because of the way over time they have manipulated the market to make such theft de facto.

http://tarensk.tumblr.com/post/44047376234/doj-admits-aarons-prosecution-was-political

Of course it should be said that these IP rights holders only maintain their grip through what most would regard as bribes to elected representatives to vote in ways that are not in the voters interests. Such is the greatest success of “representational democracy” it is neither democratic or representational of the electors or their interests.

I guess the only question is how many more are to be sacrificed on the alter of coruption that is the Federal system under various likewise tainted administrations.

Clive Robinson • February 26, 2013 2:28 PM

OFF Topic:

For Bruce and others a question / recomendation.

Have you read,

Dr Robert Altemeyer of Canada’s Manitoba University book,

The Authoritarians

If so what did you think of it?

If not you can download the PDF with the authors blessings (and reasoning given in the books intro) from,

http://members.shaw.ca/jeanaltemeyer/drbob/TheAuthoritarians.pdf

I’m about half way through and find it written in an enjoyable and easy to read way (and yes that applies to the extensive chapter foot notes as well).

I also find the case the author is trying to make to be well presented (so far).

Clive Robinson • February 27, 2013 3:55 AM

@ Wael,

If I remember correctly it was at a time shortly after I had explained something a little to graphicaly to you (about the mores of a young woman in an office) that had caused a yellow card. So I chose “to fight another day” which is what Falstaff chose to do.

The quote you gave is an incompleate statment from Prince Henry’s servant Falstaff[1][2]. The first part which you gave refers to a Nobleman sent from Henry’s fathers court on businesss with significant gravitas. The second part of the quote is,

“Shall I give him your answer?”

Which Henry had allready given which was to “pay him off, to go away and return to the queen”.

Falstaff then leaves the stage and Prince Henry then immediatly questions others to find that Falstaff has been deceitful to him about mortal combat and forced others to be likewise, which starts another plot line in the story.

So as people find out with Shakespear not all is as it seems and there are many meanings hidden in almost every line, which is why he was often used as a homophonic mem. And with such context is key, which is possably why it was used by lovers and such who had previous “out of channel” contact and thus knew the context and thus thought of it as being secure (original “security through obscurity). However as Babbage and friends proved often it was not secure by inserting false messages.

[1] Shakespear was known to have named his charecters with crude humour some more obvious such as “Bottom” in Mid Summer Nights Dream partly because he made an ass of himself. Similar with Falstaff which was more clever in that it had homophonic meanings possibly for a higher class audience [2], one that he was unwisely deceitful to his master as “False Staff” or “fool staff”, and another due to the fact that “Falstaff” is pronounced in the same way as “Full-Staff” implying with innuendo that he was a “stout stick” or in more modern parlance making a “dick” of himself.

[2] Historical evidence gives rise to a generally belief in some circles that Shakespeare originally named the character not Falstaff but “John Oldcastle” (a real person from history). And that Lord Cobham (Henry Brooke [3]) then Lord Chancellor and butt of much Elizabethan satirical humour, who was a descendant of the historical John Oldcastle treated it as a personal slight and complained, forcing Shakespeare to change the name. There would have been little real sympathy for Lord Cobham thus the reason for the homophonic name with so many meanings was a way for Shakespeare to “thumb the nose” at him, especialy by that time it would have been “court gossip”. Shakespeare further rubbed salt in the wound with a line in the play where Prince Henry refers to Falstaff as “my old lad of the castle”.

[3] In some respects history had the last laugh on Henry Brooke after Elizabeth’s death he and his “Popeish” friends and family betrayed each other over their various treasonous plots and were either executed or imprisoned in the tower and died ignoble deaths, striped of their lands, titles, honours wealth and any good name that they might have had.