Schneier on Security

Clive Robinson • June 22, 2013 12:10 PM

@ Works for…,

“is webex doing this (or being forced to do this) also”?

Does it matter?, after all even if they are currently not and even if they issue denials, then the the chances are they either are or will be in the future –due to legislation secret or otherwise– and in the meanwhile are having some point in their network being monitored to that effect any way with or without their knowledge.

There are ways that someone who is appropriatly technicaly knowledgable can sit on your wire and watch the packets size and where they go to (not just during but considerably after you activly use such a software package). From this they can work out information flows and bandwidth even it the packet contents are encrypted as a modern form of traffic analysis. Which could raise a red flag, but not lower one.

The problem of course is that the minimum amount of information required to compleatly break a communications link is the end point info and any encryption key, all of which would fit comfortably inside a single IP packet. This packet could be sent at any point in time during or after you using the package. It does not even have to be sent to a different end point provided it is marked in some way or in a known position within the communications.

So yes you can find things to make you suspicious with any communications package, but conversley you can not find things to reduce any suspicions you might have.

Even if you write a software package yourself you will almost certainly write it using somebody elses code library and to somebody elses specification / protocol.

As I’ve noted many times on this and other blogs in the past it’s known that at one point all publicaly available encryption libraries for using AES on PC architecture systems had side channels that would enable the AES key to be easily found if used in “online mode” of opperating (The NSA only certifies it for “data at rest” or “offline mode” usage in their IME hardware which is a very big red flag).

Likewise I’ve said again on this and other blogs fairly repeatedly that the NSA is not realy into classical cryptoanalysis for code breaking any longer, that’s a game that kind of stopped in the 1980’s. They had moved into ensuring “fixed plaintext” and “Side Channels”. They have since moved into other areas such as “fixing standards and protocols” and playing in weaking other areas.

For instance I’ve repeatedly warned for many years now about the generation of random numbers for encryption Keying Material (KeyMat). It is increadibly easy to get wrong and we have seen research that shows it’s a very very furtile place to play. Because it does not matter how good your crypto algorithms are if the keys and nonces (“numbers used once” and relied on for security proofs) you use are predictable due to a poor random number generator.

Also the way the NSA works is not the way you think, they don’t target individuals and try to break their communications except under exceptional circumstances. They hover up everybodies comms and use various techniques to crack the 20% or so of easy stuff which when alied with “human error” accidental and deliberate gives anything up to 80% of usefull information in the longterm.

What do I mean by “accidental or deliberate” when it comes to human error… Well it’s all to do with plaintext. There are generaly two types tallked about in publicaly available cryptoanalysis texts “known plaintexts” and all others, the reality is in practical cryptography “known plaintexts” are a smaller subset of “assumed plaintexts”. Thus the reality is “random plaintexts” for which nothing can be assumed and “assumed plaintexts” for which some kind of content or structural discriminator can be used to distinquish between random and non random plain texts.

In the past such structural and content discriminators were based around language redundancy and standard form of communications such as Date, Time, To, From, Network, Subject and other standard fields.

They obviously still exist but pale in comparison with modern “File Format” and WYSIWYG meta data. With the likes of MS office and Adobe PDF etc files has vast quantities of known plaintext at known offsets.

But it get’s worse have you ever thought about the “undo” function and the how and where of it’s storage and all sorts of other meta data stored in files that you cannot see including the “unique identifiers” the likes of MS and others have chosen to put in files for author PC “identification and attribution” dressed up as “content protection”. Even the TLA’s appear to have been caught out by this and we occasionly get to hear of “redacting-errors” well it’s not just redacting which causes these errors. It’s why my standing advice to anyone having to supply copies of documents is “PAPER Paper NEVER DATA”. And if you are forced to produce electronic form “print them out and scan them back in on clean PC hardware and send the documents as simple striped image files”. That way you don’t send out information hidden in the complex file format the likes of MS and the NSA et al and those corperate shysters calling for “electronic disclosure” just love.

Oh and there is another game in town that people tend not to talk about but realy realy should and that’s “fall back”. As we know the likes of the much used and abused SSL protocol are full of “protocol / Standards” level side channels and the use of now depreciated encryption algorithms hashes etc. Now have you ever thought about what happens with software packages and the designers of them?

Well you need to remember “backwards compatability” and “ease of user use”, this causes not only all the depreciated stuff to be included but also a near invisible (to the user) “fallback” to use them to ensure that the user gets the connection established. This “fallback” occurs due to something politely refered to as “the negotiation phase” that happens before the protocol proper is used. Sadly whilst accademic and other non NSA type researchers go looking for problems in the protocols proper examining the negotion stage protocols is not “sexy”, whilst the TLA NSA and LEO types view them as rich pickings for targeted attacks.

Why because the negotiation phase is very difficult to “Armour” against either evesdroping or Man In the Middle (MITM) attacks, unless you plan to do so from day zero. The dificulty is such that so much so many consider it impossible if “backwards compatability” is to be maintained (which is a good argument for dropping full backwards compatability once and for all).

This problem is so bad I’ve actually demonstrated a few years ago a MITM attack on an encrypting software package for communications across serial comms such as modems where the MITM attack forced the comms into the lowest compatible format of unencrypted ASCII plain text, all without telling the user this is what it had done….

Most communications applications have a mode of operation that used to be called “Engineering Order Wire” or EOW which was just plain text. Software developers have the same only they would call it some kind of “test mode” and like as not it does not appear in the user interface or user manuals and it gets left in “just in case” in the release version of software. And guess what even when it does not some company like Carrier-IQ comes along and adds other software that does an “end run” arround all the other applications so that “support can be given to users and developers”….

With that going on the likes of the NSA just get a free ride…

Whilst I and others have been saying this for quite some time people live in their own world and don’t take it on board untill they find out. Either the hard way or somebody who works for the likes of these organisations becomes a whistelblower in a sufficiently public way. One of the reasons he is now called Barrack “the control freek” Obama is his attitude to whistleblowers well, from some of the revelations so far it appears that as Shakespear had it “the good that men do is oft intered with their bones, the bad lives on! So let it be with Ceaser”. But in Obamas case he has hidden away so much bad that he has done as highly clasified secrrets which is starting to come out that any good he might have done will be forgoton before the end of his term and the chances are good he will become so vilified that a new word such as Obamaradering will enter the dictionaries as his epitaphe, see Gerrymandering for a milder version or the getting slightly nearer Rachmanism (named after Peter Rachman a close associate of the violent and criminal underworld Cray Twins).