Schneier on Security

Clive Robinson • December 3, 2014 2:52 AM

@ Grauhut, Wael,

The first thing to remember is “bees cannot fly by the maths of aerodynamics” but nether the less we see them do it during the summer (or atleast we used to 🙁

Secondly insects have their own inbuilt quite sophisticated control systems and sensors that we “so far” have not been able to replicate (but we are getting closer).

Thirdly insects that are quite small can by rubbing their body parts together be clearly heard even by humans at tens if not hundreds of meters. The range goes up considerably in the ultra sound region. Likewise the bats that hunt them use sound for what we call radar but theirs is way way more sophisticated.

Contrary to what most people think, bird song is highly complex and has information content rates ten or twenty times that of human speech and can and does carry over hundreds of meters.

These creatures do not use fusion reactors, just simple hydrocarbon energy sources (sugars) as their energy source.

So we know it can be done as nature is doing it and a lot more around us right now. The problem is trying to work out how to do it ourselves…

But you should know by Theramin’s thing / “great seal bug” in the US embassy in Moscow that you don’t need to have a power source in the device to get data out. Likewise you should know that NFC travel / debit / credit cards likewise require no internal power source.

You might also be aware that NASA is providing funding/prizes for “ribbon crawlers” for Arther C Clark’s “space elevator” idea, and several teams have quite successfull “laser powered” systems. You might also be aware that back in the last century NASA successfully showed “power beaming” with a very high recovery rate using microwaves over a distance of a mile or so.

Also you may have heard people going on about WiFi charging whilst I have my doubts on this, it’s been known for years that even low frequency “power beaming” systems will work outside of the “near field”.

So we know micro / nano drones are possible, people have demonstrated devices about the same size as a large Stag beetles (you can even buy a tiny IR controled helicopter for Xmas). We know that “hot wire” microphones can be made very very small and very sensitive.

Thus with appropriate EM power beaming technology –that does not also fry those around it– we are very close if not past the tipping point of such devices and I suspect we may well be out of the “science phase” and into the “engineering phase” already…

Clive Robinson • December 4, 2014 7:44 AM

@ Grauhut,

As I noted above,

And for those that had not noticed the speed of working out “how to do it” is increasing rapidly.

It was the point behind my bee comment, we knew how aircraft wings and rotors worked but our knowledge could not –at the time– tell us how bees and even humming birds fly. What the told us was we had more knowledge to find (which we now think we do). It was “knowing there was a real unknown” as opposed to “imagining an unknown”, the former is a real problem, the latter who knows.

When I was young some RC aircraft still used miniture valves and reed resonators and the batteries where large. Now we have cheap toy helicopters using microcomputers and 2.4GHz or infrared that fly for minutes on coin cell rechargable batteries. 90% of this change has been in the last five years of the near half century time span.

As I’ve pointed out power for these devices need not be batteries only, you can today fire up RFIDs from hundreds of meters away, and for the likes of “parcel couriers” RFIDs are being read by hand held devices upto ten meters quite reliably.

Whilst it’s not possible currently to manufacture autonomous nano drones, you don’t need the drone to be autonomous or in most cases actually fly continuously, a human operator just needs to get it in range and settle to listen.

If you look back at my original comment, I was talking about the trade off of human -v- technology for surveillance and my last comment in full was,

I was indicating that the “drag net” techniques may well not have arisen if “nano drones” had been available, as it would have been possible to make the old fashioned STASI type techniques more effctive. That is a person following you need not be anywhere near as close to evesdrop as they once would have been. In effect the “personal service” of such surveillance would be much improved for the surveillance personnel in a similar but more effective way as shotgun / parabolic mics and telephoto lenses did for surveillance in the late 50’s to the current day.

You also need to remember how disruptive technology comes into being. It is first regarded as impossible, then as unwieldy and impractical, then practical for certain situations at which point the market general expands the price drops and inovation kicks in and the market develops more and more rapidly.

You need to also remember that the NSA, GCHQ et al “drag nett” way, “was not” and still in many ways “is not” practical, for what it’s hyped up to be, that is a “preventative” technology. Yes they are getting the data but they still cannot deal with it, dragnetting even more data is not going to change that no matter what the head of the FBI et al says. Currently we just do not have the algorithms to process the data sufficiently well to make it viable, and to be honest I don’t see any “break throughs” happening on it even with all the money that’s getting thrown at it. Dragnetting is like CCTV not much use as a preventative measure against those determined to carry out their acts of social disorder, all it realy provides and then only occasionaly is “evidence after the act”. Thus it’s not going to keep you or I safe from “clean DNA” that wants to blow you up in the airport checkin que.

There is a story about Gen Keith Alexander giving a presentation on the whizz bang “three hops” analysis on peoples phone communications, and how it had found a number of important nexi. It looked good and the senior people present were impressed. It was only later that it became clear that these nexi were not radical or crime boss King Pins at the center of illicit webs of power but pizza and other fast food delivery / take aways places…

The simple fact is society is so diverse and moves sufficiently rapidly that dragnet algorithms to find these King Pins are out of date before they can even be used. Either their false positive rate is way to high, or they only discover those already known by other means. It’s one of the reasons why the drone strikes in the Middle East and West Assia have low success rates and very high collateral damage, with estimates between 25 and 250 needless deaths –many of which are children– for each supposed terrorist leader. And other views indicate that these leaders that are killed are not actually the international terrorists that are going to harm you or I but local war lords and in effect political and religious leaders.

It’s clear that electronic and signals intelligence that form the NSA and GCHQ dragnet surveillance is currently and likely to remain for the foreseable future a compleat bust for it’s supposed purpose.

Thus as this “dragnet fail” gets through to the likes of the politicos and their voters in larger numbers other avenues such as the old fashioned Human Intelligence the likes of the Stassi used are going to be used.

Thus “technotoys” are going to be developed, we already see this with the larger drones with cameras capable of viewing a whole town at six inches or better resolution in real time from a mile or so up. These cameras are made from low cost parts such as four hundred CCD cameras usually found in mobile phones.

Drone tech is getting smaller, you can buy a very light weight delta wing drone under a meter in length made from “insulating foam”, with an electric motor and very light weight foil solar cells. Virtually silent in flight it’s launched from a catapult and it can in good light conditions stay aloft for some considerable time. It uses mobile phone technology for guidence and data link back. You could build one yourself for a few hundred USD. This is a toy compared to other quad fan drones used for televised sporting events that have HD quality cameras and have been sufficiently quiet not to prove a distraction to either competitors or spectators.

I’ve modded an easily available and –relativly cheap– RC helicopter with a friend where we have striped down it’s unneeded covers and that of a 2.4GHz CCTV camera that weighs just a few grams and flown it “out of sight” a number of times. And although it can be heard on the ground it’s not very loud and certainly not enough to disturb two people having a chat whilst standing in a field even though clearly visable and recognisable via the CCTV camera. It has flown with a striped down smart phone but it was pushing the weight limit for that RC helicopter. My friend and his son are looking at striping down a Raspberry Pi B+ and camera and WiFi dongle to play with over Xmas and spring on a larger RC model, with the aim of stripping out the existing control electronics and making it a school science project. Here’s hoping Python is up to the Real Time task…

If school kids are doing this for science projects you have to ask what a small team of engineers could come up with, especialy with plenty of DHS/DoD money floating around waiting to be grabbed.

I can see most of the technology needed to make a “fly on the wall” nano drone on the internet today and quite a bit of it’s for sale or the component parts are. All that’s needed is a “market” and that to appears to be developing…

Yes the first few such devices are going to appear impractical for general use, but those “specialised cases” will expand and the technology will be developed. I recon it will be in a five to ten year time span that nano drones will be a standard surveillance investigatory tool.

Clive Robinson • December 5, 2014 5:22 AM

@ Derrick,

How can nano drones be more effective than compromised cellphones for eavesdropping?

Quite easily.

But first think on the “who” of nano drone usage. A nano drone attack as I’ve pointed out is “personal” in that not only is it targeted on an individual, but the nano drone operator needs to be relativly close. So it is only going to be used on people towards the top of the “Persons of intrest” list.

Such people can be and often are highly intelligent as such they are going to take control of what they can to protect any One-2-One contact. Thus as in the sixties and onwards, “wires” will be looked for which in this day and age means anything with a non mechanical or biological energy signiture is suspect, including hearing aids and cheap digital watches.

Simply anything electronic with battery in or not will not get taken to meetings or other activities so even the newer NFC cards will get left at home or on the person of a “alibi double”.

So the mobile phone dragnet is compleatly pointless for these people.

There are an increasing number of people who are neither mil or dip, nor for that matter gov or gov contractors who have good reason to hold meetings in SCIFs and the number is rising as more and more Snowden revelations sink in with those with money and ideas to protect from competitors.

However there are problems with SCIFs which cause some of the more intelligent people not to trust them or their operators, the most obvious reason is the security of a SCIF is like a balloon in that one tiny prick and bang it’s gone… But further and by no means least because SCIFs are in effect “fixed points” that require 24/7 guarding and thus become a rater large “red flag on a hill” that would generate much metadata even though the adversaries had not managed to run a pico sound tube or optical fiber into the SCIF.

Security has many costs most are not obvious on first sight, and for that matter to a number of –supposed– experts. Being wise after a security lapse requires not only being alive but having the freedom to learn and mitigate, such freedoms are usually only available to those with both the significant resources and legal immunity to carry them out, which is general only state level players in the upper tier (think top ten or twenty millitary nations).

Clive Robinson • December 6, 2014 6:25 AM

@ Wael,

Yup I guess squadron sounds better than plaque (as in locust).

That said the “re-charge” bit might provide an active defence… you’ve almost certainly seen those UV lamps with high voltage wires around the that “zap-bugs”… if you know what attracks a nano drone when it’s charge is low then you could build your own “zap the bug” device.

@ Grauhut,

What you are desicribing are “motes”, “mites” or “dust” and have been developed for military applications. Ross J Anderson wrote some papers on their secure comms and how to stop active Einfiltration of the resulting network.

However they are not drones as they cannot move and thus cannot move to an energy source to “re-charge” and thus don’t work in most places. An intelligent person of interest would know where they don’t work, hence the need for micro and nano drones to cover them when in those areas.

@ Derrick,

The aim of surveillance is to gather intelligence not to neutralize or more accurately murder people. Neutralizing people quickly and effectivly requires quite a lot of energy, and in the case of bombers / terrorists et al very easy to circumvent with “deadmen devices”.

Importantly the amount of energy required to ensure an “effective kill” precludes most micro drones and all nano drones. So the use of micro and nano drones for neutralization is a moot point, before you consider the other issues both political and practical.

With regards POI there is plenty of evidence of “clean DNA” that is suicide bombers etc tha are either “off the radar” or “down in the noise” and thus never become POI. Further those terrorists who do become POI usually don’t get their hands dirty, they are “staff officers” not “cannon fodder”. Killing them is usually counter productive contrary to the nonsense put out currently, due to the use of “cells within Hydra organisations”. The killing of OBL was at the end of the day a political inspired “PR stunt” timed to gain advantage over adverse home media commentary. It can be easily seen that OBL death had no negative effects on AQ and other simmilar organisations, and in fact boosted recruitment, money and other resources for such organisations.

You become a real person of interest for two basic reasons, the intel you generate or for the deterent effect your potential punishnent for crimes you have commited has on others. In the case of terrorists the “call to the flag” result that happens due to their death or detainment negates the second reason.

With regards the “no failure” viewpoint, there is also plenty of evidence of “no success” either and thus when looked at with regards the financial investment of your and my tax dollars, we would be better off as a society having betted on every loosing horse that has ever run…

Clive Robinson • December 7, 2014 2:01 AM

@ Grauhut,

With regards,

Not really. The .gov and .com surveillance industry reduces the availability of hacking talents for the “dark” markets and makes them tax generating consumers.

I think your assumptions are incorrect. Firstly the implication that there is insufficient “talent” that they can be absorbed by the .gov and .com surveillance industry. That is clearly not true, the talent is “without borders” that sort of employment “strictly within borders”, which leaves a large proportion of the talent out in the cold.

Further as we know .gov does not pay well, thus they don’t attract the top talent even inside the borders. Thus top talent may be attracted to the .com surveillance industry, but actually probably not. There is more money and importantly more interesting work outside of the .com surveillance industry working in other tech companies. Surveillance is not usually regarded as “sexy” by most talent, usually it’s regarded as unsavory, unclean or dirty work indicative of “peeping toms” and worse. Why do you think we see people posting remarks about NSA and LEO types sitting looking through porn all day?…

In the West and other first world nations talented people tend not to consider crime as a career option, the reason as my father pointed out to me over fourty years ago is “If you have the brains not to get caught commiting crime, you have the brains to earn considerably more money honestly”. Whilst this holds true inside most western borders it did not hold true in many other places like Russia etc, where the right type of crime can not just pay comparatively well but earn the equivalent of high level state protection.

In the old Communist Nations and other states where crime takes over, crime is seen as a valid career option because even though the risks are higher than the West the comparative rewards are even higher, and knowing the right people and keeping them looking favourablly on you keeps your own risks down well below those of the rest of the citizenry with money. It’s thus not a coincidence that the bulk of the crime malware and APT we see comes from these places. And it’s also not a coincidence that low grade graffiti type malware etc in “political support” comes from there it’s “one hand washing the other” or “scratching each others backs”.

But as we have seen you don’t need much talent for quite a bit of the malware out there, it’s thus highly competative in a throat cutting way and pricing tends to race to the bottom. That is the supply exceeds the demand at the bottom of the market and the profit is taken not by the malware writers / hackers but by more conventional crime groups that can monetarise CC details. These out on the edge malware writers and hackers are looked on in the same way as drug addicts are by dealers and above. Those that initialy made it as Pharma or Spam Kings are finding themselves exposed and are thus being picked off for “politics” as well as profit…

Clive Robinson • December 10, 2014 6:39 AM

@ Skeptical,

As far as the rules of war –actually treaties which the US were involved in the formulation of and have signed– those “under flag” have obligations the breaching of which is a “war crime” and as such they can be brought to stand and defend themselves in the international court –which the US was the major participent in setting up–.

The first rule is not to take up offencive hostil activities in a forign state. The “preventative” idiocy the US has trotted out has no standing in law.

Further making war on civilians is most definitely a no no, and has been for several hundred years. The only permisable actions are only those of defense “when under fire” or to prevent genocide or the equivalent.

Clearly the raid was in breach of these basic rulesof war and as such all those involved including the US President are in tge position of being tried on “war crimes”.

It’s not something you can argue away by saying “he was evil” you actually have to use International law to bring him to trial in what would be a neutral place and court. Anything else is unlawfull and a war crime.

The problem is the US has set a very dangerous president by taki g this action. If say Russia or China or any other country decided it was time for a US General to be killed in his own home infront of his family then this is OK by your and the US administrations reasoning.

I’m sorry you are alowing your view that “vigilanty justice” is OK when practiced “by the side you favour” just because you assume on political rhetoric somebody is “evil” from letting you see the wider implications when others you do not favour decide to follow the same reasoning…

Clive Robinson • December 10, 2014 10:59 AM

@ Nick P,

I don’t know if you watched the BBC program where they showed that AQ did not actually exist, so the US DoJ invented it to charge OBL on “conspiracy”. It made interesting watching.

With regards “common sense” it appears to be a very rare atribute, but when you get digging in this area you find that as far as the common sense view point and politicians, they see no profit in it…

Speaking of which I hear there is a six thousand page report with a four hundred and eight page summary which indicats that the CIA amongst others have been lying. And that various UK & US Intel Orgs have been playing the old “double act” of taking poorly researched info and “sexing it up” then handing it to the other side of the puddle so that it can be further churned up and returnd not as the crock of 541t it realy is but as “gold intel”….

I thought we had given up that nonsense since Colin Powel did his number with the number ten dodgy dossier…

I wonder just where we would be economicaly if the US and UK had not squandered so many resources and brave lives on an uterly pointless excercise the only tangible result of which is that Saudi Arabia still controls the oil price and the west bleads to death.

Oh you’ll love this one, the UK Gov has been claiming record numbers of people are working. However the tax take has dropped substantialy, and the cost of benifits is rising, which is a sure indicator somethings a bit crooked.

Well it turns out that they Government has not been encoraging real job growth, they have just been counting any body on a zero hour contract or doing 1 hour a week (not even paid) as “working”…
So change the way you count and call yourself a success, it’s the new British way….

Clive Robinson • December 11, 2014 7:16 PM

@ Sancho_P,

In real life, wherever it matters, status and power are based on wealth only.

Err no, the US has had a few examplesof this recently with what you might call “cops going bad”. That is the police have the whim of life and death over you, and if they do kill you then there is no legal action the state will take against them.

In the UK we currently have an enquiry as to how a handcuffed individual on an aircraft was killed by three “rent a cop” security guards from a private company.

I could go on the simple fact is these persons have the power of life and death over you, and they know if they excercise the latter they would not face the consiquences you would if you a a civilian killed one of them. There is no wealth involved with this enhanced status they have over you.

But you have to be carefull when you say “wealth” it is not the same as money. Quite a few of the worlds richest and most influential people have little or no money in comparison to the assets they hold. The only time these high status individuals have money of significant amounts is either when trading one set of assets for another set, but the reality is no money actually appears, just a few bits of ink on a piece of paper for valuation purposes or when paying tax to a government on the rare occasions they are forced to.

For people of low status their lives are almost compleatly controled by money as they have no assets that will appreciate, it’s why inflation is so disproportionately placed on their shoulders.

Now you may wish to call “inflation” a conspiracy if you wish, but I don’t think you will find many who would agree with you.

We could debate the how’s and why’s of inflation but at the end of the day you will find that it goes back to the cost of debt in the form of interest, and thus is the result of modern money lending which –supposadly– is the fundemental driver of the economic cycles according to economists. One major reason for debt, is for businesses it’s “tax free”, thus they have a significant incentive to borrow money at low rates of interest to stay in debt and thus untaxed, rather than what appears as the more prudent earn&save money which they would have to pay substantial tax on if it went over a tax period.

The legislation that controls this taxation avoidance can easily be seen as “bought and payed for” by lobbyists that get there money from the “elite” in who’s interest it is to have “no tax” options that also devalue money but not assets.

As has been pointed out before “The real ‘welfare momma’s’ sucking on the tax titty” are tax avoiding corporations that creat as much debt as possible, and use the money from that debt to aquire appreciating assets, outside off and protected from the debt.

Clive Robinson • December 14, 2014 7:50 PM

@ Skeptical,

Every state has an inherent right of self-defense. Pursuing, and capturing or killing, AQ leadership is an important component of US efforts to defend itself against further attacks.

Whilst every state has a right to self defence within it’s own jurisdiction it has no right to unilaterally enter another state, especialy by personnel or weaponry “under flag” to take any action of any kind. To do so is a primary initiating act of war, and as such is a war crime.

No amount of sophistry on your behalf is going to change this one iota.

As most people will realise there are good and proper reasons why the right to self defence is limited to defensive –not offencive– action only, because vigilantism is very likely to kill innocent people, and thus give rise to perpetual cycles of violence that are in general only going to escalate.

Thus if a state has reason to believe it is at threat then it aproaches an international tribunal currently the UN Security council with it’s case. That’s the rules the US signed upto after WWII and nearly every other nation has the right to expect the US to abide by them as they do.

Unfortunatly the UN is flawed in that the permanent members of the security council have veto’s. Which might be the reason that states attacked by the US don’t apply to the UNSC to have sactions raised against the US for their unlawful behaviour, and knowing this gave rise to the US breaking the rules.

However, there is another option that those involved should consider, as should anybody who might consider such illegal actions in the future. If those who have either been named or have admitted to be amongst those who invaded another state with hostile intent whilst under flag leave the jurisdiction of their home nation then they could be arrested by anybody in the jurisdiction they have traveled to and be taken befor the judiciary and thus be detained for forwarding to the international court to be tried as war criminals.

As certain Israelis have found out, people are quite prepared to do this. Whilst the effect of this is not the same as being in jail or house arrest, as GWB found it can put quite a dent in your plans and feel like you’ve been tagged for offender management purposes.