Schneier on Security

Clive Robinson • October 27, 2013 10:56 AM

@ Figureitout,

–Someone again broke into my home the other day while I go to school…

The way to deal with persistant offenders is to hold their activities up in public for punishment be if civil / criminal prosecution or just ridicule.

The latter may be the only course of action open to you. As always I would advise against physical contact or threat as this would leave you open to civil or criminal prosecution, or even death with them claiming. “Standing their ground” as an LEO etc.

So first step is “softly softly catch your monkey”. Whilst those doing invading your space might be idiots or at best unskilled it would be wise to assume otherwise.

Thus the first rule of the game is neither over or under estimate your opponent. The second rule is you can not monitor everything.

Thus you need to limit their degrees of freedom, in aproach, entry, egress and scope of activities.

The basic tennent of physical security is limit them to a single aproach path and single point of entry/egress. There are various ways to do this but much of it depends on the specifics of your location and environment.

There are also three basic classes of non criminal intruder,

1, “Chancer”,
2, “semi-pro”,
3, “Pro”.

(Oh and there is a supposed fourth level of mythical all seeing all knowing uber/ninja pros that people talk of when doing risk analysis etc, basicaly the argument is they are so good nobody can detect them let alone catch them… so they can not be shown to exist 😉

By and large a chancer has the minimum of training and technical skill and their intrusion will more than likely be more oportunistic than planed and prone to the failings of all “spur of the moment” actions. They don’t realy know what to look for in the way of alarms and tell-tales etc and signs of their intrussion are usually fairly clear as they tend to hurry and don’t put things back the way they found them even aproximately. The chances are they will leave fingerprints or other readily identifiable evidence which would be found by an ordinary scene of crime investigator. It’s the kind of approach some LEO’s have exhibited in the past and has often lead to evidence etc being inadmissable in court…

A semi-pro will have had some reasonable level of training and skill, and is about what you would expect from a “field trained officer” or survailance trained LEO, they will plan their intrusion somewhat and will do a “stakeout” and probably do a “dry run” observation to look for routes of entery/egress, and obvious alarms or other indicators of security. Thus well placed CCTV will probably catch them when they do the dry run likewise good observation in the surround area will bring to light their vehicles etc, and quite often “stakeout signs” will be obvious enough for a “nosey neighbour” to spot with ease. The reason for this is they concentrate on hiding from the person they are watching with the result they ignore how they look to others, in a number of LEOs under training on the streets of London around Vaxhall Cross and into Victoria and Westminster around New Scotland Yard I’ve watched whilst sitting in a cafe window seat, they might as well have a “proppeler hat” on their head. Their use of technology will be minimal and often quite visable in use, though with personal electronics of good quality becoming the norm these days this is becoming harder to spot. When they do enter your premises they will have spotted obvious alarms and obvious CCTV and will take some methods of protection and won’t leave the likes of finger prints etc. They probably won’t spot less obvious CCTV or normal “tell-tales”. Again they will leave signs that they have been there because they will be in a hurry, but they won’t be easily obvious signs, that is they will put books and newspapers etc back where they were but won’t take care to correctly align them, likewise other “surface clutter” and they almost certainly won’t bother puting the contents of draws and cupboards back correctly.

Pros have both a high level of skill and a lot of training, they have to it’s how they eran their living as “Contractor” and they know they are out on their own due to “deniability of employment”. They will perform a stake out, but whilst you might with care spot it a nosey neighbour won’t. Usually they will stake out the area from a distance first to get the rythm of the area so they will know who walks dogs when and where; when ,where and which companies do regular drop offs/deliveries, the makes models and registration of all vehicles where they usually park and will check ownership of them and all buildings. They will know who all the utility suppliers are, the uniforms and ID cards vehicles etc, they will know where utilities are routed and where all the control points like stop cocks, switch gear, distribution cabinets, man hole covers etc are. If possible they will “move in” to the area by “going under cover” usually not adjacent to or overlooking your property, but where they can stake out their own stake out equipment/bods to cover their backs etc. They will establish routiens to “fit in” and might even get to know the nosey neighbours dog walkers and delivery people to the point of wishing them good day or even stopping for a chat and realy good ones will do it to you. They will do many dry runs and will look for not just obvious alarms but less obvious ones they will look for and find outwards facing CCTV using “red eye” techniques and will also look for other signs of surveilance on your property by you, those protecting you or semi-pros doing it badly as normal. Good ones will also look for “inwards facing” CCTV and ground alarms and signs of “route forcing” security and will do “thermal imaging” “EM radiation” and “residual energy” scans to find nearly all electronic alarms and their associated wiring. They will do a number of dry runs that move in, in decreasing stages and will often put electronic “stake outs” in objects like vehicles and street furniture or covering foliage etc, usually they will “instill them in” such as park a car in different places moving it closer to your property on a day by day basis. They will “bug your utilities” to find out what your usage and usage patterns are, they will steal your garbage, sort through it and put it back etc. They will try to get copies of credit card and check payments. In short they will know you better than joe average knows themselves. They will intrude into your property several times good ones might even get you to “invite them in”. The first entry will be a minimal photo shoot where possible from outside the building to not only know what you’ve got but where you’ve got it. They will then probably go back to photograph one object in detail sufficient to make a copy into which they put surveilance equipment, if absolutely necessary they might risk doing this by “phoney break in/robbery”. They will then take the pulse of your activities and watch what you do when you think you are not being watched. Thus they will see you “set” obvious tell-tales and use any covert equipment or storage etc. On return visits they will search bit by bit they will photograph each item and use it to restore things as they were including photographing the insides of draws cupboards etc they won’t hurry and they will be thorough including removing all electrical face plates, the sides etc of all “white goods” and will look inside fixtures, furniture, and furnishings, including taking things away and replacing them with copies/duplicates before returning the originals etc, some will even use the equivalent of “ground penetrating radar” to look for hidden voids in walls floors and cealings. Having achieved the objective they won’t cut and run they will carry on observing for a while to see if your habits etc change in response to their visits, they will finaly withdraw slowly in easily explainable ways so not to raise any alarms in you or neighbours.

There are however some pros that are used to mess with your head, they leave deliberate clues to having been there that only you can see and if you tell people they will think you are paranoid. This is usually done as a prelude to setting somebody up for a fall such as priming/pushing them into an altercation with an LEO or simillar where the expected result is jail time. There was a lot of this in the US in the 1960s & 70s and was part of the Cointelpro stuff that you can find and read up on. Back then it lead to the deaths of quite a few innocent people “but hey they might have been carrying out anti-American activities…”. Hence my earlier warning about keeping your distance, “better to be thought a pussy than be a tigers head nailed dead on somebodies trophie wall”.

Importantly however there are somethings even the best of pros cannot do including those supposed mythical uber-pros… and this is due entirely to the laws of physics that they cant hide from, thus they can be caught in the act.

Alarm sensors for instance do not have to be electronic or emit EM fields or other energy that can be picked up by anti-surveilance/alarm sensor equipment. As an example most older houses have squeaky/creaky doors, floor boards, stairs, draws etc. You cannot use them without making a noise, if somebody attempts to “fix the squeak” they cann’t easily unfix it so you will know it’s been unexpectedly fixed. These annoying noises are produced by what are in effect unpowered physical sensors that only re-emit energy put into them by their use / activation. They emit they energy as radiated or conducted sound or vibration and that travels quite nicely around the building, not just through the air but in the walls and floors and pipe work, thus an active pickup such as a mic plastered into a wall some distance away will pick it up. With a little care these active pickups can be placed where they won’t be visable to the likes of thermal imagers and out of reach to EM energy and residual energy detectors. Likewise floors bend when you walk on them and you can get strain and balance gauges quite cheaply these days. Even re-bar in solid concreate floors “sings” and conducts sound very effectivly especialy if welded not wired together befor concreat is poured (remember the old movies where somebody put their ear on a rail to hear a train comming from miles away, it’s the same principle). Likewise even a plastic or rubber pipe of water conducts sound very well, and “under floor” heating systems are becoming popular in new homes a hydraphone attached to the system does very effectivly pick up foot falls, the main problem being filtering out “circulation and thermal expansion” noises. But this sort of non energised sensor and active pick up also works outside as well pea-grit / gravel paths/drives crunch and external decking and veranders are just like floors they bend under load and conduct the sound of foot falls.

Likewise the movment of people and the opening and closing of doors creats drafts or “preasure differentials” modern high efficiency homes are so sealed that the opening of an internal door can be detected by the preasure switches in “environmentaly friendly” air circulation/extraction systems in the roof space… Likewise the 0.1KW of heat human bodies emit can be detected by non optic heat sensors that use conduction or convection not radiation. And as they are non optical they don’t have focusing mechanisms that give 180 degree internal reflection that “red-eye” detection systems use.

But as is seldom mentioned “red-eye” detectors have a major failing, just like radar systems. They both emit EM energy in charecteristic ways, but they are realy quite insensitive and range limited, in that the red-eye device sensor is looking for relfected energy thus an equally as sensitive detector will pick them up long before any reflection off of the detector is seen by the red eye device’s sensor… This problem has long been known to those doing ECM/ECCM systems and for various laws of physics reasons it’s a game the prepared defender has the win/draw outcome advantage whilst the attacker has only the draw/lose outcome disadvantage…

However remember one thing when it comes to the mythical uber-pros, there is an argument made that if they know of such sophisticated alarm systems they will try to “piggy back” them to observe you in greater detail, or they build up the “system noise” slowly so that either you turn it off due to the level of false alarms or the real alarm gets burried in the false alarm noise. Whilst this has actually been seen in military ECM/ECCM and other systems in war conditions, I’ve never come across a verifiable case of “piggy-backing” nor of “gaming” sophisticated alarms (though I have seen occasional unsophisticated gaming of simple “stock” alarm systems such as putting random faults on “red-care” alarm telephone lines to control centers to deley response times).

The important think though is that you need to put in sophisticated alarm systems before you become under surveilance, otherwise the watchers will see you put them in and will thus know about them and plan counter measures before the alarms are operational let alone had time “for the paint to dry”.

Clive Robinson • October 28, 2013 4:20 AM

@ Mike the Goat, Nick P,

The first thing to say about the badBIOS reportings is that whilst they sound unbelivable and fantastical and some bits impossible sit back and have a carefull thought on it first.

Firstly we know that BIOSs can be reflashed, and if you overwrite the loader code then they are ineffect bricked unless,

1, Your overwrite is a new loader of some form.
2, You have an approropriate in circuit or over chip pin programer.

We also know that all PCI cards have provision for the storage of BIOS augmenting code and often where there, it’s stored in Flash ROM, with exactly the same issues of the mainboard BIOS Flash ROM.

Likewise we know that many designs are taken off design sheet / manufactures suggested / recomended circuits. These high function chips usuall contain either MIPS or ARM core CPUs large quantitied of RAM and eitherEE or Flash ROM to store the code. And again just like the mainboard BIOS they can be overwritten by somebody with the right knowledge.

And as we know from Stuxnet getting the knowledge and signing keys for even quite exotic systems and software is very far from impossible and in some cases probably quite easy and relativly low cost (because those responsible for the design of exotic systems don’t consider themselves targets for malware developers and assume obscurity is security…).

And it’s something discussed on this blog, prior to Stuxnet and prior to TI calculators. So it’s hard for any long term reader or commentor to say they’ve not read or discussed the issue of semi-mutable memory in PC systems and how code signing is a bit of a bust.

As for some of the other sugestions yes I can see how in some cases this can be done, but I’ll reserve judgment as to it’s actual utility. Also people carrying out any kind of investigation need to remember,

What looks like a duck,
Walks like a duck,
And quacks like a duck,
Is actually a goose.

Thus sometimes things are not quite what they appear to be at first glance, and the thinking process of the investigator ends up in a “dark cave with lots of twisty little passages running hither and vither”.

Clive Robinson • October 28, 2013 11:32 AM

@ Nick P,

Looking back at Bryan’s link, I just realized they have a whole damned stack in this thing

Come on man, keep up 🙂

Seriously I thought you knew it’s actually a lot worse than Bryan has pointed out…

Nearly all USB controlers contain MIPS or ARM cores running almost identical very flaky code. In fact quite a few memory device controlers have 3 cores in each chip all with their own memory and stacks as well as DMA into the other cores maps.

Atleast one of the cores will have a “generalised serial communications hardware interface” which will have atleast two TX and two RX shift registers of a K or so in size for each USB interface. An almost identical interface can talk to SD etc cards, various serial busses like I2C / CAN Buss / SATA / Firewire / Ethernet and Motorola and similar interfaces to DSP and DDS chips.

Basicaly inter chip “serial buses” are “the new parellel bus” often they will be differential in nature because they solve one heck of a lot of problems with PCB design as well as internal issues in chips with driver circuitry etc ( ask @RobertT for the low down on this).

Whilst the serial hardware works (fairly) well writing the in chip drivers for the CPU cores is as much if not more of a black art than it is for conventional OS kernels.

Worse whilst you will have one core talking USB and another talking to say a harddrive controler another will be talking to the cache memory and internal block remamping tables etc. Often this low level IO code will be taken from the chip manufactures recomended design notes on the data sheet. Over this dogs breakfast of unknown code comes the dog’s vomit layer of code to hook things up together. This is often done with “MMU & DMA Ju-Ju code” written by somebody for an entirely different device a couple of years ago, they didn’t comment the code or leave documentation and have subsiquently left for a better job or longterm rest in a “locked ward” somewhere. Which means some five dollar a day expensenises code cutter fresh out of their first year adult education on an intern / work experiance scheme will get to cut-n-past it all together for the latest product oh and USBn+1 interface which is 10x times faster than the USBn interface the code was originaly written for…

Which kind of means that actually the code is very buggy but huge easily recognisable parts are the same in nearly all products no matter who sells them under whatever brand name.

For instance around twenty years ago I wrote in 8bit CPU assembler some code for phones. As was my practice at that time not only did I heavily comment the code (about 5x comment to code) I also wrote copious documentation explaining how to make it sing and dance in just about any way you wanted it to. I know (because somebody asked me to check over it) it was translated into C code and it’s still going into product today…

Clive Robinson • October 28, 2013 5:55 PM

@ Nick P,

Sounds nice cept the 5x comment to code ratio. *That* sounds like a bit of an exaggeration unless you’re embedding huge chunks of documentation in the comments at the beginning of the file. I mean, this is assembler you’re talking about and it’s renowned for taking many lines of code to do the simplest things

I guess you’ve not writen a lot of 8bit asm where an instruction might be,

LDA #00FE

And the comment for it be

Get value from serial port baud rate devisor register

And at the top of each block of code be it a function or sub aheader block saying exatly what it did what registers and memory was used for input and output to it where it was called from any subs it called and a who/when/what table of modifications.

You can pick up my assembler code source files from the time and just read the header blocks, or just the instructions on the left or the comments on the right of each instruction line and know exactly what the code was doing. If you found any disparity then almost certainly where a bug or error was.

I used to write the code by first deciding the code functionalit as blocks and write skeleton headers for the block then write the more detailed comments and then fill in individual lines of instructions.

It might not have been the fastest way to write lines of code, but it generaly worked fine as written and needed little modification due to “bugs”.

I know it sounds odd but I see my code like a picture in my head that sort of becomes a high level flow chart. I can do this because I’ve already mentaly designed the heirachical layers and API format long before deciding on specific functionality.

It all goes back to having to cut time share programs where you would punchyour code on cards or tape and only then drop them in a reader to run. So you needed to get it spot on before it was your turn otherwise you would have to wait a day to get to next run code.

Clive Robinson • October 31, 2013 3:24 AM

@ Nick P,

The irony of Seals leaving their mark on Silent Circle is not lost on me (nor the potential for puns either 😉

I suspect one of the reasons no organisation has been prepared for NSLs and their like is two fold,

1, Despite many warnings, few new what the NSL / GCHQ were upto.
2, Nobody was prepare to fix what they thought was not broken.

As we’ve seen a major problem with the Internet is “First to market” is nearly always “Winner takes all”, it applies to the protocols as much as it does to social apps/services [1]. Once established even if bad it usually remains and gets incrementaly changed [2] often not for the better. Human nature pushes “quick and dirty” faster than any other solution [3] as a delivery system to perceived market need. With the result that major legacy issues become apparent [4] and unsolvable unless there is a sufficient external to the market driver that causes sufficient users in the market to make a painful transistion.

So the question is, has the Ed Snowden revelations provided a sufficient driver to the users in the EMail market to endure the pain of change?

Especialy when they realise that it has to be a compleatly new system and for good and proper security reasons it cannot in any way be compatible with the old totaly insecure system as that will give an “end run” around the security, much to the delight of the NSA, GCHQ et al.

Oh and this problem is not just with EMail it’s with all hierachical systems used to connect one user to another, such as phones, texting, messaging etc. The design has to incorporate methods to hide routing metadata at all points except the last hop and to make that secure a recipient needs to have an anonymous and random mail drop communicated to them by another anonymous notification system.

It’s an interesting problem to solve and whilst I have some ideas… the problems of secure anonymous notification remains in a system with fluid routing issues.

[1] This is also a key indicator as to why Free Market economics fails when there is not a “distance cost” metric involved, and thus the market invariably fails to a monopolistic market rapidly, with at best a doomed “race to the bottom”. Thus the key to success is guessing what the new market is going to be and “getting in first and loud”.

[2] What happens is that the “first to market” is usually at best rough around the edges and distinctly lacking in various areas of user functionality. However if there is a need for the market the app solves there are sufficient first users to get it going, and irrespective of if closed or open source it evolves and the surface rough edges disappear and usability in other areas gets “bolted on”. However the core Internet functionality usually remains the same along with all it’s failings in the security area which is one reason the NSA, GCHQ et al have been so successful at getting in and staying in.

[3] It is at heart the need for a new market being realised in one or more individuals heads that drives a quick hack “proof of concept” which then alows this to get major market share, and unfortunatly nearly all additions remain quick hacks even long after market dominance and the monopolistic position well established [4].

[4] Often the product evangalists / marketers are the last to see when they have sufficient market dominance to switch from bug ridded “feature creation” to “stay ahead” of the competition, share holders and other investors, to cleaning up the mess so far produced and establishing stability and then possibly security. And often it’s “car crash politics” that finaly pushes the change, by which time legacy issues have become a major problem not just for the developers but public relations as well, so often security gets sacraficed entirely to supposed compatability.

[]

Clive Robinson • October 31, 2013 9:36 AM

@ Mike the Goat,

The problem with interfacing to the current email system is as we know it’s compleatly vulnerable at almost every level due to it’s design and usage.

Thus there are many attacks that can be made against it, which in effect puts an end run around any more secure system both technicaly and also due to human user issues.

As @ RobertT noted the otherday you have no control over the far end in any way.

However that asside there are very real other issues the first of which is how do I find your details to communicate with you without that being monitored in some way by GCHQ, NSA et al?

The first way is I meet you in person and hand you my business card with some kind of contact point PubKey etc encoded on it. Obviously this means that I’m effectivly giving out the equivalent of my name (PubKey) and addreess (contact point) unless I generate a new set, one for each and every individual card.

The second way is through a “trusted” intermediary or courier, but trusted or not they still provide a link back that various types of survielance will reveal.

But both have the issue of knowing where you are physicaly located at some point in time, which is likely to leave “digital breadcrumbs” or other traceable information.

Most other methods you might consider suffer from these failings.

However there is a way around it to see it you have to think back in time when the world was considerably less technology blighted.

The worlds largest machine was –and may still be– the telephone network each entity has a unique identity (phone number) and a bunch of non unique data (name address etc) which when combined together provided another unique or near unique pointer to the phone number. Now back some time ago running a dial in “directory service” was expensive and thus most phone service providers sent each and every subscriber a printed directory every year or six months. In effect it was a “broadcast” service with “memory” and multiple access points. Now these printed directories were not in any way monitored and were also freely available in thousands of places. Ine effect the directory service worked on the “Broadcast” model with “memory” in the form of a “multiply replicated” “data base” that was “widley distributed” with “multiple access points” for any user.

Thus provided you were not already under very intense surveilance looking up a persons phone number was a compleatly anonymous process.

Thus if we build a directory database and put it in multiple places within a suitably anonymous mix network with a couple of extra features we can replicate the old fashioned anonymous paper telephone directory.

I could go on to describe how to do other bits.

However two points arise, firstly all users computers have to be part of the mix network, there should be no “entry or exit” points and each node should use fixed rate encrypted communications to other nodes with both “null traffic” and “traffic padding” and fixed sized burst of traffic to many nodes which are randomly rotated. This fixes one or two of TOR’s problems. Secondly each user needs fully distributed and multiply replicated storage within the mix net where by letters / messages and other information can be held for them in ways that are difficult if not impossible for the various authorities to deal with.

One such way is as a sender I randomly select a virtual node and it gives me a random but unique identifier. I then put the encrypted object at that virtual node under that identifier and I give it a time to live. I then send you via your directory identity and public key the virtual node identifier, random object identifier and the decryption key through the mix network. What I put in that encrypted object is upto me but the minimum amount of information the better. As the recipient and knowing the encryption key and identifiers you can change the content of the file to provide other contact info such as another private network identifier and non public public key which can then be used to further communication.

There are a few augmentations that can be added to decouple the communications path further but hopefully I’ve given you the general idea of a starting point for such a Dark-mixnet service.

Getting this highlevel protocol correct and making it form a framework flexible enough that many different lower level protocals can be used in a Plug-n-Play way without losing security should be the number one part of the design.