Schneier on Security

Clive Robinson • March 25, 2015 9:18 AM

Now here is an interesting admission,

In a written statement, though, it did say that some of the documents obtained by CBC News were dated and do "not necessarily reflect current CSE practices or programs."

Hmm that can be read as "used to be true" at or before the time of the documents....

Clive Robinson • March 25, 2015 10:45 AM

This sort of comment,

Back in 2011, CSE envisioned creating a "perimeter around Canada" to better defend the country's interests from potential threats from other countries and criminals, raising the prospect the agency was preparing a broad surveillance program to target Canadians’ online traffic.

kind of annoys me when they say "perimeter", it gives entirely the wrong impression of what's involved not just from the defence but attack positions. It makes many politicos and others take up "magical thinking" thus they nolonger see things the way they should and thus they will make mistakes that the IC will take significant advantage of.

When you are dealing with a network where anyone can connect to not just in the Canadian jurisdiction but out side as well there is no perimeter... Thus every host with a connection is a potential defender or attacker, and can not be told apart untill an attack vector is used against it or from it, even then it may just be one link in a long chain, where identifing other connectivity to an attacking host is not realistic.

This much should be clear from well before the first usage of APT getting on for a decade ago.

If I got into a host six months ago and changed the BIOS or other Flash ROM in IO devices the chances are you have zero knowledge it is there. If I chose to put it in the HD controler then I can likewise store a whole load of pay load out of sight where you can not find it. Thus when a time or other event triggers that payload the first you will know is when side effects start happening. Now multiply this by between ten thousand and a couple of million systems --as has been seen with bot nets-- that all kick off at the same time then you can see why the only realistic defence is to harden every host you can. Non deployed attack weapons will not be realy of any use, because it's to late for them to do anything...

I'll let other people think through the strategic consequences of this for themselves, but the result is not going to be pretty...

Clive Robinson • March 27, 2015 6:16 AM

@ Wael,

No worries my friend! I've got my share as well. Judging by the number of posts, I'd say it must be a common thing these days....

It's a trend I've seen here for quit some time, and I'm not sure if it applies to the number of reads as well.

I've thought of a number of reasons, including but not limited to,

1, A chilling effect.
2, Other formats.
3, Increasing numbers of blogs.
4, Paucity of subject matter.

From memory the second "banking crisis" certainly appeared to have an effect, in that "work time" posts were diminished but the general daily level of posts was not diminished as much. The chasing of wikileaks by the US and other governments likewise appears to have had an effect as has BO's hounding of whistleblowers. But Ed Snowden's revelations also appear to have had rather more than a subtle "chilling effect".

But humans move on and more inane methods of communication arise as "opiates of the masses", FaceCrook and T'whitless have become the "instant in crowd" of near vacuous thoughtless commentary, and thus unsurprisingly of more recent times significant civil and criminal sanctions.

There is also the "wanabe me to" mentality, when Bruce started his public activities via Cryptogram etc, blogs did not realy exist, yes there were and still are newsgroups and lists, but the blog format was later. As an early adopter Bruce did not have much competition and thus was "one of the few games in town". Now however there are well in excess of several thousand security related blogs, so much so we get "top 100 lists" [1] to guide us... and it does not take long to realise that many are biased in some way to carve out a niche much like "shock jocks" etc have done in the past.

Then there is the question of "contents" back in the early days it was real "technical meat" you could sink your teeth into, good papers were appearing like autum leaves chased by a blower. Now commentary is such that a month or more will go by without an academic paper of interest and technical comments are mainly "re hashed/heated" from past technical comments.

As others have no doubt noticed even my comments are a lot shorter than they used to be and I'm a tads more cautious about what I say.

However Bruce has likewise shortened his posts, and makes few comments outside of the obvious facts any more, and "snake oil" slithers by. Now there could be several reasons for this --I've mentioned a few in the past when people have asked why I don't have my own blog-- but it leaves regulars with a disconected feeling... and as we have seen quite a few nolonger post, or I suspect even read this blog.

[1] http://ddosattackprotection.org/blog/cyber-security-blogs/

Clive Robinson • March 27, 2015 10:49 AM

@ Wael,

"Work Pressure / Stress" is a form of "chilling effect", in that if you feel you have to devote more hours and effort to an employer than you are either paid for or have to stop being a normal human to forefill just to keep "bread on the table" then you are without doubt being both exploited and oppressed. And your only likely reward is a painful path to an early grave...

There is also the aspect of "being busy to keep your mind off of things", it might be --questionably-- benificial for those with strong negative emotions but, what if it's stopping you realising you are being oppressed and having your freedoms stolen from you and those you love...

Whilst there is "good stress" that spurs you on at critical times, unless you deal with it carefully it becomes health damaging bad stress. Which is why there is a degree of truth in the "work hard play hard" saw. You need the physical excercise to burn out the stress hormones etc irespective of if the stress was constructive or destructive.

There are three basic parts to life and they should be in balance, you need to rest, work and play in health appropriate amounts. I know from bitter experiance what happens when you don't and you eventually have to pay the price for ignoring it twenty years or so down the line, when those little aches and pains you thought you could run/work through in your twenties or thirties come back as crippling auto immune issues.

You hear pundits saying that as we live longer we cost more in health care etc. What they don't get around to talking about is the three ways to die. The first is an unfortunate event such as an accident, there is little you can do to avoid this. The second way to die is to just get old in good health untill a very short period befor you die, this is the way nature designed you to go. The third and health care wise the real cost problem is a long slow and painful death over months or years, usually caused by life style issues triggering individual suseptabilities. Some of these life style issues you have control over such as smoking / drinking / eating / mental & physical excercise etc. But many you don't, such as hidden environmental issues, many of which are suspected or known by a select few but vested business issues conspire in many ways to keep them hidden from you. The problem with this is trying to differentiate proven scientific fact from unproven untested ideas, because like it or not the placebo effect is real, like it or not, which suggests there's a lot more to know about "mind over matter" when it comes to health.