Schneier on Security

Nick P • May 2, 2013 8:02 PM

I know Bruce has linked to Stratfor pages before. Here’s a little gem I found when I checked up on Wikileaks today. They’re putting together presentations of Stratfor’s whole operation. Should make for interesting reading.

http://wikileaks.org/the-gifiles.html

A few highlights (without spoiling too much):

“”Do not think of StratCap as an outside organisation. It will be integral… It will be useful to you if, for the sake of convenience, you think of it as another aspect of Stratfor and Shea as another executive in Stratfor… we are already working on mock portfolios and trades”. StratCap is due to launch in 2012. ”

“”[Y]ou have to take control of him. Control means financial, sexual or psychological control… This is intended to start our conversation on your next phase” – CEO George Friedman to Stratfor analyst Reva Bhalla on 6 December 2011, on how to exploit an Israeli intelligence informant providing information on the medical condition of the President of Venezuala, Hugo Chavez. ”

There was one intelligent observation I noticed. At one point, they’re trying to determine if they can get on Wikileaks’ “leak gravy train” maybe by using their counterintelligence and surveillance experience to develop leak preventing security products. Then, they say:

“Could we develop some ideas and procedures on the idea of ´leak-focused’ network security that focuses on preventing one’s own employees from leaking sensitive information… In fact, I’m not so sure this is an IT problem that requires an IT solution.”

Exactly. It’s a personnel problem. The only solution to preventing leaks is to have employees that are zealots. This usually happens in religious or political organizations, like Church of Scientology. Steve Jobs also took this approach with Apple.

Nick P • May 6, 2013 12:50 PM

@ Clive Robinson

“The upshot is that the fundemental blocks are there to make a CPU that can do all logical and arithmetic functions on data without ever seeing the data in plain text….”

This is possible. It might even be a good idea that my mind just doesn’t appreciate yet. My focus in these areas is still on tamper-detecting, secret-erasing enclosures. I think more work should go into designing enclosures (1U, 2U, 4U, safes) that can protect arbitrary electronics. Attack vectors include electricity manipulation, penetration of outside container, radiation, electromagnetic injection attacks, TEMPEST-style monitoring of EM to detect tamper circuit states, ultrasound, etc. I’d like many proven solutions to each of these problems and a way to create a different configuration per deployment. The main idea is that some things would be prevented entirely and others would be detected due to the benefit of site-specific obfuscation.

Thinking ahead, though. Let’s say we design a kit for someone to produce a rackable, tamperproof system. Let’s say it’s tamperproof in that there’s no known way to disable it once its operating. The attacks most likely to succeed will be MITM on supply chain or shipping; attacks before tamper circuitry establishes a baseline. The latter is more interesting. I was thinking that the defender will setup the system in an environment they control. It will then move through another set of environmental variables on the way to deployment and then enter yet another set once deployed. Any configuration of tamper circuitry that tries not to nuke the system during these phases might be an exploitable weakness. Just as an intruder has best IDS bypass opportunity during its training period, an attack on these systems during their pre-production phase might work.

I’m not sure of a technical solution to this problem. My solution so far to such things was trusted courier who (a) can fry it at first sign of trouble and (b) activates tamper software during installation, is present during a training period, and then activates higher security level upon leaving. Seems like it’s good enough in the event that a trusted person is allowed onsite in the untrusted area.