Clive Robinson • May 12, 2013 2:45 AM

OFF Topic :

Apple has another “loony tunes” patent granted.

http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220130031009%22.PGNR.&OS=DN/20130031009&RS=DN/20130031009?ystfuv

The idea is begilingly simple, Apple want to turn you into a mobile ATM and make money, and some people think it’s a good idea,

http://www.unwiredview.com/2013/01/31/forget-digital-wallet-apple-wants-to-turn-you-into-an-atm-via-ad-hoc-cash-dispensing-network/

Put slightly less simply you have an app on your iPhone etc that helps you out when you discover your wallets empty and there are no ATMs around… The Apple view is there you are a bit short of cash so you open the app and ask for 20 dollars. The app reads your GPS location and passes your request via Apple to other iPhone users in the area. If one agrees to give you the 20dollars Apple send you the name and location of the person and you walk over. They give you 20 dollars you press the button on the app at which point Apple deducts 20 dollars from your iTunes account and a commission fee and then deposits the 20 dollars into the iTunes account of the person giving you the 20 dollars.

One first sight through Apple red tinted glasses it sounds like a wonderful idea. You get 20 dollars cash, Apple gets 20 dollars pluss commission from you and at some point the person who gave you the cash gets a 20 dollar credit note from Apple.

The problem is it’s not a good idea unless you are a criminal…

Oh and the idea is far from new, back in the 1980s when digital wallets were first being touted around a very similar concept was suggested needless to say it was fairly quickly realised just how bad an idea it was.

Clive Robinson • May 13, 2013 7:16 AM

@ Luca,

Is this possible ?

In theory yes, in practice it’s going to be difficult to the point of not possible in most cases, unless there are design flaws.

To see why think of it as it in terms of a networking stack issue.

You thus first need to first think about the “physical layer” with the following basic issues,

1, TX energy source.
2, TX power.
3, TX modulation capability.
4, TX to transmission channel coupling.
5, Transmission channel charecteristics.
6, Transmition channel length.
7, Transmission channel to RX coupling.
8, RX sensitivity.
9, RX demodulation charecteristics.

Even if you can satisfy those physical layer requirments you still need to be able to have the ability to build the rest of the network stack at both ends to get data from the malware app in the TX system to a suseptable app etc in the RX system.

However if you think about you need four exploitable vectors,

A, Initial attack vector for malware into TX system.
B, Malware app to TX system physical layer.
C, RX system physical layer to susceptable application.
D, Application that is susceptable on RX system.

If any one of these vectors is unavailable then the attack cannot succeed. But as has been ably demonstrated for well over thirty years finding these vectors is just a matter of searching software anomolies to find them…

In fact one of the earliest well known diliberate malicious exploits to the physical layer was the “Poke to destroy” attack on Chuck Peddle’s Commador PET. Basicaly if you put the wrong value in the graphics controler it would cause it to go outside the normal sync frequency of the inbuilt monitor with the result it would badly over heat and in some case burn out. A similar problem also occured with early third party IBM PC monitor cards and some monitors from the less well known far eastern manufactures, atleast one early MBR virus had this as a payload.

But even earlier in the days of “Mainframe batch computers” long before EMC standards it was well known that you could “hear the CPU” not just at the console speaker but also on an AM radio upto a hundred feet or so from the system. This was exploited for fun by atleat one system programer to play simple tunes on the radio… Likewise it was later demonstrated that the signals from early unshielded monitors could be picked up several hundred feet away and this is now known as “van Eck phreaking”.

In fact the problem with elctromagnetic interferance became so bad that legislation in various forms was brought in to reduce the effects to managable proportions. In the US the FCC has laid down requirments on electronic equipment manufactures and in Europe there are the various EMC standards and in most other parts of the world their legislation is broadly based on one or the other.

But the problem with radiated signals carrying information and being exploited goes back atleast as far as the First World War where trench telephones due to a poor design choice (see single wire and “phantom circuits”) coupled energy into the ground and also barbed wire and thus could be picked up considerable distances away to the enemy trenches and beyond. It was this explotation that gave rise to what used to be called TEMPEST and these days EmSec.

However the issue of usable leaking signals goes back to atleast the 1870’s if not a lot earlier due to the fact that telegraph and telephone cables were not only very expensive they were also expensive to install and maintain. Thus to reduce costs single wire common ground return circuits and transformer fed phantom circuits were extensivly used and “cross talk” became common. However it was found slightly later with early “multi-core” cables another form of “cross talk” became apparent, caused not by resistive leakage of current but by either capacitive or inductive coupling. And it was soon found that the range of such coupling increased with the frequency of the signal. It was then shown that if certain conditions were met then the signals would travel through the ether for considerable distances and basic “spark gap transmitters” were developed that later became recognised as what we now call radio waves.

For all forms of cross talk to have an effect sufficient energy must be coupled from one circuit to another such that it causes meaningful interfereance within the used bandwidth of the wanted signal. However to go beyond interferance and produce an interfering signal of the same magnitude or more than the wanted signal requires considerably greater energy.

Because of various issues engineers tend to break “free space” signals into “near field” and “far field” the boundry is usually aproximated as two wavelengths from the radiating element (antenna) at which point the signal loss is considerable (around 1/50 for an isotropic radiator).

In the far field a first aproximation for the continuing decress in signal energy is based on the square law expansion of the surface of a sphear so is the inverse square of distance so needs the transmitted signal power to increase four fold for every doubling of distance in “free space”.

But the energy needs to be coupled into and out of “free space” and this happens in the “near field” and in usuall circuit design circuit traces and components are designed in ways to reduce local cross talk and thus do not radiate energy into the near field efficiently or conversly be susceptable to energy in free space. Thus the signal antenuation is quite considerable and for most computer signals in milliwatt levels the received signal level is in nano or pico watt levels in a very short distance.

Further the EMC standards put constraints on the total level of energy a compleat system can radiate outside of it’s case etc or be susceptable to. These are of necessity quite strict and are generaly defined by “masks” across the usable frequency spectrum (used to be VLF to microwave but gets expanded as technology and practical test systems improve).

Unfortunatly the mask system whilst being easy to specify and measure is also easy to cheat in various ways. As the cheating saves a considerable quantity of expensive filtering components there is considerable “profit” to be made in doing so. As some of the cheating techniques effect “system stability” they are turned on for compliance testing and often off for general use via the likes of BIOS options.

Thus for such an attack to work it needs to find a way to radiate significant energy from the TX system to a susceptable RX system. If the basic EMC standards were followed this should not be possible…

However over and above the cheating of the EMC masks the EMC standards have exceptions for “purposefull communications” which WiFi, Bluetooth and other radio communications fall into. And it is likely that it is in these devices that the attack system works.

For instance most modern laptops have WiFi and Bluetooth built in whilst some have compatability with similar Infrared communications systems found in older computing devices that used to be used to talk to printers and the like. As the desire for “connectivity” and “ease of use” increases we will see other comms added such as GSM for mobile broadband, NFC for payment and other smart cards, Zigbee and other similar standards for Personal Area and ad-hoc Networks for home automation et al.

A significant and rapidly up comming security threat is “Software Defined Radio” (SDR), it has many advantages for System on a Chip (SoC) designers. However it’s great flexability leaves it wide open to security vulnerabilities.

So as many SoC’s are manufactured within the sphear of influance of China I guess it’s safe to modify the ancient curse to say it looks like we will be living in interesting times…

Clive Robinson • May 13, 2013 5:06 PM

OFF Topic :

@ Bruce,

Due to your more recent areas of research, I think you might find this article interesting,

http://www.newrepublic.com/article/113176/science-loneliness-how-isolation-can-kill-you

It indicates that asside from the significant health issues and shortening of life loneliness can also cause significant social issues.

Some of which may explain various security issues to do with society including radicalisation, school shootings and certain types of crime.

The artical makes very interesting reading even if you don’t agree with the idea of extending it into societal security.