Schneier on Security

Clive Robinson • September 5, 2015 12:33 AM

@ Name.withheld…,

Microsoft, as seller, has taken an adversarial stance respecting myself, business, and/or personal well being in denying me disclosure(s) that may have informed decisions made on my part respecting the relationship to the “seller” irrespective of the terms of service or licensing. It is the spirit in which the “seller” unilaterally sees its obligation(s) to the buyer.

I suspect as a legal argument it will not stand in a US court and certainly not with “Corporate Friendly” SCOTUS, because it’s a licence for an ephemeral “service” not “goods” product with existing clauses alowing service modification and revocation.

Further in many countries they have –rather stupidly in my opinion– recently signed Obama inspired US Trade deals with the nasty little dispute resolution clause that allows Corps to get judgment and significant damages against Sovereign States in US backed Courts if the state has legislation or regulation that the Corp can present as “restrictive”. As Australia has found sensible Health Care policy and attendant legislation is seen as “restrictive”… (the thought occures that now certain “drugs are legal” in the US but not in other countries how long it will be before some legal US organisation decides it’s time to “push” into other countries for easy profit, via that clause…).

The area of law where you might succeed is with “Privilage”, that is information pertaining to communications and actions between a Lawyer, Doctor, Religious Minister or Journalist and a client, have existing protection not just in civil but criminal cases. Likewise you may have existing contracts with enforcable non disclosure clauses.

In effect as a person handling privileged information, you now can nolonger use “any” Microsoft Products, that require the use of any MS supported OS… That is a US corp by change in it’s policy is knowingly bringing you and other organisations into a position of breach of duty/contract with criminal and civil legislation etc.

One thing I suspect MS is reliant on is US IP legislation that in effect says “if you collect the information you own it”, it works the other way around in the EU and quite a few other jurisdictions due to Privacy, Data Protection and Computer Crime legislation. Oh and then there is he effect it has on trade secret and Patent legislation and of course theft and espionage legislation, South Korea takes an extrodinarily dim view on all forms of espionage.

Oh and don’t forget Russian Espionage and other legislation, that allows them to carry out what they regard as judicial execution anywhere, even though the target may be in and a citizen of a state that regards it as murder or even first strike act of war… they have allready started raising questions at ministerial level as to if MS has allready broken Russian law with Win10…

As the old Chinese curse of “may you live in interesting times” appears to have come true for MS and it’s users, I guess it’s also time some are going to start digging a couple of graves…

Clive Robinson • September 6, 2015 1:57 AM

@ DaveK,

Yes it’s possible to exploit it, that much is clear from what people have said on the c’punks mail list. Which means it can be used for a MitM attack in some cases, even if in practice the method is seldom/never used in normal usage, thus ditching it all together may be the way to go as a quick fix, and fixing the standard if anybody moans it’s “essential” to stop their patch of sky falling in.

My main concern is it’s ended up in quater century or more expected lifetime embedded products (yet another excuse to bang on about NIST et al extracting their lower sphincter lodged digits and get working on “crypto frameworks” 😉

Obviously to some, the route by which this standards issue came about is of more importance than fixing it. And I have a degree of sympathy for this viewpoint. The reason is simple, back in the 90’s when this standard and the ones it is based on, next to nobody was looking for “NSA et al Finessing” (even I only started talking about it publicaly this century 😉 though I’ve been aware of it with telephone standards since the mid 80’s, I’d just assumed it was common knowledge in engineering. But more importantly nobody including the spooks knew in advance which technology was going to win out in the popularity game. Thus they may well have finessed everyting they could get away with on the assumption of covering all bases.

Thus it’s playing a game of catch up, and “knowing your enemies MO” as one way to find other crimes they have commited, a technique that is common/standard in certain LE activities.

So charecterising all possible standards attacks irrespective of if they are real or not will over time improve the standards process at the very least, and make the task of the likes of the NSA, GCHQ et al much harder in the future, or make them way more noticeable.

Clive Robinson • September 6, 2015 3:37 AM

@ Bruce and other academics,

The latest publishing scam to swallow up tax take by greedy publishers,

http://www.theguardian.com/higher-education-network/2015/sep/04/academics-are-being-hoodwinked-into-writing-books-nobody-can-buy

Clive Robinson • September 7, 2015 4:56 AM

@ ianf,

… by off-handedly showing him how to reply to email without laborious manua removal of automatically pasted-in inclusions (which could not be unset in preferences):

Knowing that that is one of the biggest security weaknesses in Email for several reasons, and also it’s both a real anoyance to many users and an impediment to efficient working, I was left with the thought “Why did they not make it easier/configurable?”

My thought has thus been over many years, because it makes the use of “known plaintext” so easy. That is for automated tools as well as forensics and the likes of the FiveEyes with weak crypto such as bad modes and improper stream cipher usage.

However if I had said the “FiveEyes” prior to the Ed Snowden Revelations I would have been attacked on this blog. Just as I had over my comments that under BRUSA –later UKUSA– the UK spied on US Citizens for the US whilst they spyed on UK citizens for the UK all so Politico’s could claim “We do not spy on our citizens”. Likewise when I said that “plaintext, standards and implementations” would be the routes that the NSA and GCHQ would opperate, hence my suspicion of why MS putting large amounts of known or easily guessable plaintext at the front of their propriortrey file formats.

I guess since the MS recent changes to the EULA for Win10 and the obvious spy ware, few readers here are going to argue MS is innocent of the historical charges of being helpfull beyond accident to both the IC and LEOs, especialy the old NSAkey as well…

Clive Robinson • September 8, 2015 1:56 PM

@ Nick P,

For my sins I still do SM PCB rework with,

1, A steel hat pin.
2, A pair of stainless steel “key hole surgery” locking tweezers.
3, A small nozzle “paint striper” hot air gun.
4, A selection of hand made nozzele covers and PCB shields
5, Blue-Tac to hold the shields on the PCB.
6, Canister of “dry air” spray to cool things quickly, but not to quickly.

One problem is “lead free” solder, is not of any use on reworking older PCBs as it does not “play well”. Another deficiency “Pb Free solder” has other than it’s higher temprature is it disolves copper off of the PCB traces into the molten solder, so you get a maximum of about five reworks per joint on small contact number components on light copper weight boards and sometimes “one if you are lucky” on 40 contact pluss components.

The method I use is by no means fast and you have to work with some care, but the old dogs and new tricks rule applies 😉 Mind you I’m getting to the point where it’s my eyes not my hands that are letting me down these days, and me and opticians do not get on well…

Clive Robinson • September 10, 2015 12:52 AM

@ Figureitout,

Clock recovery is a bad idea security wise, as it makes the system susceptible to various types of timing attacks. The worst of which is “transparancy” where secret data like an encryption key is encoded in timing jitter, that the following stages let through transparently to an eavesdropper.

The earliest case of this I’m aware of is with the early versions of the British Diplomatic Wireless Serveces automatic One Time Tape “Line Super Encryptor” later called “Rockex”. It used an XOR function made with “Post Office type 600 relays”. Unfortunately the “pull-in and release” times were not symetrical, and the following stages did not rectify this deficiency so it was possible using an oscilloscope to see the differences made by the One Time Tape and thus strip off the super encipherment.

I’ve been told that some of the early Crypto AG electro mechanical systems suffered from this “known” problem, and it was only fixed for some customers, not others.

It’s one reason for the TEMPEST rule of “Clock the inputs and clock the outputs”. If done properly edge jitter can not get through the system.

Clive Robinson • September 10, 2015 1:46 AM

@ Thoth,

I am looking into building my own micro- OS…

Been there, done that, don’t recomend it as it’s kind of “Catch 22” work.

@Nick P’s comment on 4/8bit CPU capabilities, and my reply about 1bit ALUs kicked off a set of bad memories.

The smaller the data width the more often a counter or pointer will either over or under carry. So for larger ranges you need two or more data widths to get the range required. So when the least significant nibble or byte count is exceeded it goes to zero and the next significant nibble or byte gets incremented. It sounds simple and it should be, but it’s not for the simple reason the carry function is not “atomic” and the two data items get updated not simultaneously but sequentialy, which means there is a time gap in which the CPU can get an interupt…

Unless dealt with correctly this can cause strange and unexplainable errors in code which can be difficult to find and fix.

The thing is few programers ever have to deal with this because the OS or driver code hides the issue away and holds the everyday programers hand via “abstraction”.

The problem is that there is only so far an OS can go at design time. For instance Unix assumed a data width of 32bits, which was fine in the late 60’s through 80’s. In the 90’s files got big and 32bit’s wether signed or unsigned is not big enough for either file pointers or time keeping… do you remember Y2K well Unix has it’s own heading to a box near you real soon now.

Whilst the fix in the OS of going to 64bits might be thought of as trivial, it will break older 32bit apps, which may not be fixable for various reasons…

Having “done the OS thing” I can tell you it’s not easy seeing into the future and getting it right.

The pain of meeting “There must be no edge cases in an OS” is not something you want to have to go through, thus modifying parts of an existing OS with a good track record may be less painfull in the long run.

Clive Robinson • September 10, 2015 9:11 AM

@ ianf,

It’s like the best and brightest of the USG never learnt from their own history of the need for ironclad separation of church& state…

Don’t make the mistake of thinking that, “Them Confederate Republicans they learned the real lesson of that real good”, and they are doing very nicely out of it. The wealth of the industrial north for some reason ends up in the south way more often than it should. Likewise ask yourself who’s picking up the tab on the refuge crisis they masterminded.

The history of US & South Korean War Hawk behaviour ever since the US defeat and subsiquent cease fire back in the 50’s should tell you a lot about what is going on.

Few people anywhere want the War Hawks, they think they are at best paranoid always looking for enemies to fight.

The real War Hawks are not paranoid, it’s a business plan, and an enemy is a way to make profit and political gain which gives more profit. The only problem they have is nations that don’t buy into their “funnel the wealth to the “good old state of Texas and it’s environs” plan and don’t spend vast amounts of money on their over priced, badly functioning and backdoored weapons and companies. So on the old idea of “where there’s no market, create one” that is what they have been doing not only via the likes of NATO but by also “creating enemies”.

Most people who could think about it who had access to the right information could see that the Iraq war was a compleate sham as one UK politician later put it “There were no terrorists in Iraq, before we invaded…” he knew that for certain as did just about anybody else who knew anything about Sadam. He also knew there were no WMD, there as did the UN Weapons Inspector and he also knew that the UK Priminister knew there were no WMD or any kind of threat from Sadam or Iraq at that time. It’s why he resigned as a UK Cabinet Minister over it. Oh and ask yourself a couple of questions, 1) Why is the Chilcot Report continuously not being published? 2) Why Tony Blair is so virulently opposed to the point of appearing mad over an MP who was anti Iraq War becoming leader of the party Tony Blair used to run? And if you can not see why have a closer look at Tony Blair’s income and thus loyalty is aligned.

From the War Hawks perspective, Continental Europe is not playing their game and “rendering unto Ceaser” since the end of the Cold War. They have continuously said these countries are not spending what they should on defence and specificaly NATO.

Thus the War Hawks need a new enemy on Continental Europes door step. So between the US and Russian War Hawks Europe now has enemies along it’s north to east border, it’s eastern border and much of it’s Southern border. Which can only be a win profit wise for the US War Hawks.

But better still is the game of “begger thy neighbor” the War Hawks knew would result from the mess they greated in the Middle East. Southern Continental Europe is being swamped by “refugees” many of whom are actually “economic migrants”, but in amongst those there are some who represent what the US loves to call “A clear and pressent danger” who will be recruiting or in time becoming a new crop of terrorists in the heart of continental Europe…

But even if those “undesirables” could be found and removed, the US War Hawks still win, not just by “beggering thy neighbour” but because those left behind in the war torn Middle Eastern countries will become more politicaly polarised and thus more susceptible to radical or terrorist overtures. So either way thanks to the US War Hawks, Continental Europe is going to have radicalised terrorists on their door stop for probably the next six to ten generations. Importantly during that time they will need to waste GDP on weapons and other paramilitary equipment the US War Hawks can profit by.

I’m sure there will be some who will take a skeptical view on the above, but to be belivable they will have to come up with a rational alternative, and they may find that a bit difficult all things give due consideration.

Clive Robinson • September 11, 2015 3:46 AM

@ John Gaut IV,

this seems to simple to be robust

Going only by what it says in the article you link to, “it is and it isn’t” sufficiently robust depending on your view point and the scope of view of an attacker.

Basicaly the method is a simple hand substitution cipher based on a grid, usually used to make a simple substitution table [1], and a “faux random walk”. Such hand ciphers have been around for hundreds of years and are fairly easily broken by hand if,

1, The ciphertext is sufficient in length,
2, You have several messages under the same key to give you sufficient length,
3, You have sufficient plaintext at a known position in the ciphertext.

In the case of this “system” the resulting ciphertext is going to be short, and thus well below the unicity distance(1). However the corespondence in length between the ciphertext and the service name would be a bit of a give away(3). And finally if someone can see what you type in for several services then they may get sufficient length(2).

For the system as described in the article the bit about the top row of the Linotype printing press keyboard is more padding than meat [2].

Further as given the system has the same flaw as bio-metrics, in that you can not change the password… Which may or may not be a problem for many people.

[1] Such alphabet grids are usually formed with a pass phrase from a poem or saying that is easily remembered or selected from a book both the sender and receiver have. Often all you do is write the numbers in first in a fixed pattern, then remove the duplicate letters from the phrase, then write in the “a sin to err” letters in the order they appear in the phrase, then the rest of the letters in the order they appear in the phrase, finally followed by the remaining unused letters of the alphabet in alphabetical order. Importantly you then “reorder” the table by two digits one for vertical one for horizontal and write the result down underneath the alphabet and numbers to make your substitution table [3][4].

[2] The reason for pulling the EATOIN to the top of the grid and top row of on a Linotype keyboard is the same as the reason those same letters are the shortest to send in Morse code… they are the most frequently used in English at the time. You can remember the order these days with “eat on irish” then remove the duplicate ‘i’ for “eatonirsh” then –depending on who’s frequency table you use– swap the second and third letters in from the ends for ETAONISRH. You could then remember to add “lid” to the phrase to get ETAONISRHLD for the frequency order for the majority of the most used letters in English.

[3] The last stage of transposing the rows and columns of the grid is more usefully applied to the plain text of a message. That is you write out the message in grids and then read it out in a secret way, thus transposing the plaintext making many “known plaintext” attacks at best difficult.

[4] If you write the table out verticaly twice it’s sometimes called a “rod” if you make four rods and put them in a “slide” frame you can make a paper analog of the Enigma cipher machine. Such a slide frame and pre-made rods were used extensivly by the allied maritime forces during WWII, unfortunately they did not use them in a sufficiently secure manner.

Clive Robinson • September 11, 2015 9:13 AM

@ Figureitout,

First a bit of background.

The first rule of TEMPEST is to “reduce emissions” this is primarily done by reducing both power and bandwidth to any unintended signals that might be “emitted” from the system. However you also need to “break synchronicity” such that signals that are emitted carry little or no information that can be cross correlated with other signals that might be emitted by the system to reveal information.

The rules of EmSec include all of the TEMPEST emission rules and a whole bunch of rules to reduce “susceptance” to signals that might be targeted against the system either inadvertantly (proximity in use) or directly (illumination) by an attacker. Many of the susceptance rules are effectivly the same as the emission rules, which is not that suprising when you consider the majority of transducers are bidirectional. However some rules are due to the nature of the attacks. TEMPEST attacks are all “pasive” in nature and the attacker effectivly has no influance on the system they are “listening” to. EmSec attacks however include the TEMPEST listening attacks, active disruption attacks, and the more subtal attacks that alter the functioning of a system whilst it is in use.

Whilst there are many formal “hard” rules –such as how far cables are to be appart– these are generaly aimed at technicians and operators not design engineers. Those designing equipment have more general “soft” rules that can be better expressed in even more general “informal” rules. The hard and soft rules are usually “classified” or considered secret the informal rules in general are not. All the rules wether clasified or not can be derived from basic principles, much of which will be found in the open literature. The reason for keeping rules classified can be seen in a couple of books Peter Wright’s “Spy Catcher” and Gordon Welchman’s “Hut Six Story”. Essentialy the idea is the “genie in the bottle” principle, Spy Catcher tells you about “Theremins Thing” or “The Great Seal Bug”, the use of LF/MF to “jump the hook switch” in old style telephones and the coresponding “audio side channels” whereby listening to the sound made by mechanical devices like the old cipher machines leaked keying information, thus if the genie escapes from the bottle fairly easy preventative steps can be taken by potential surveillance targets. Likewise Gordon Welchman talked about the principles of “traffic analysis” and it does not take much serious thought in that direction to see the deficiencies of many communications systems including quite modern ones like ToR.

That said, back to your question,

So do you mean having a separate crystal for in and out? If so how do they synchonize? Or done by same one? I want to do it w/ a micro, 1 micro suffice or minimum of 2? Ah, and how can you be sure you’ve done it properly?

All things in engineering are “trade-offs” the trick is to find the right “sweetspot” for what you are doing, and obviously one input into this matrix is your “security threat” risks considerations.

The problem with risks is you neither know them all or give them the nor give them the correct weighting. So you can never be sure you’ve don it properly… Get over it smile and get on with what you can do and quit worring about what you can’t do, otherwise you will end up like a bird in a Swiss clock 🙂

The general informal rule for clocks in EmSec is “one or none” when you look at individual blocks within a system or groups of blocks that make up a system. If you feel your brain has just started to turn into a corkscrew on reading that don’t worry that’s normal with the rules and why there are rather less EmSec engineers than there might otherwise be. Don’t worry I’ll explain more in a way that should hopefully straighten things out in a soothing manner.

You gave a link to a web page and I’ve quoted the first couple of sentances,

Whilst this is a “communications engineer’s” view of the world it’s not an “EmSec enigineer’s” view of the world, they would stop at “sampled”.

In EmSec you don’t want to be working with edges of signals at an input because that makes you open to “Synchronization Attacks” and “Jitter Attacks” which not only make your system transparent to data leakage, they also alow an attacker to improve “Power Analaysis” and “Fault Injection” attacks, all of which you are trying to avoid.

Further in EmSec you also would like two often opposing things in input signals,

1, The signal to be “asynchronous”.
2, The signal should be “free of DC components”.

The problem is that the in most cases eliminating DC components means putting it on some kind of synchronous AC signal…

The classic example of this is to generate an RS232 data signal and phase reverse key it with a clock signal where the baud rate is the same as the clock rate (ie one full cycle for each bit period for RS232). Whilst there are other signaling methods that don’t have the same clocking issue, they are usually grossly inefficient in some other respect (“You nary get ‘ought f’ nought”).

But let’s stick with RS232 asynch signaling for the moment and not worry about DC offsets. Very clearly the waveform has “edges” and likewise in a non asynchronous connection the pulse width is a little indeterminate. If you look up “bit banging software” the way it works is an edge triggers a timer and after a period of time that is aproximately half the baud duration the level on the line is sampled. Provided the length of the message is short –usually 10baud or less for RS232– you only need trigger the timer once and sample after half a baud period, then at every full baud interval there after for the duration of the message. So if the timer runs around 10baud you sample at every odd multiple of 5baud (5,15,25,35…).

The thing about such sampling is you can extend the length of the message by making the sampling quasi synchronus but with ditther to break the synchronisity further into the system block where it does most harm from the EmSec perspective.

To make the clock quasi synchronus you “measure and average” that is you adjust your next sample point by the corrected average of the preceading baud periods. To break the down stream synchronisity you add a “ditther signal” to move each actual sample point upto plus or minus a quater of the baud period on a random basis.

You also use “store and forward” / buffering techniques as this vastly reduces the bandwidth available to tricks involving moving the asynchronus messages in time. Obviously storing messages before processing them adds latency to the signal proportional to how much you have stopped down the message bandwidth.

With regards the informal TEMPEST/EmSec rule of “one or none” on system clocks you can see that the above sampling techniques breaks any clock dependence from the signal transmitting block to the receiving block. So each system level block can have “one” independently clocked input block used to “re-time” it’s onward message transmission. If you have several “trusted” blocks in succession within one trusted system then provided the first block decouples the data and untrusted data clock at it’s input the successive stages within that trusted part of the system block can use the same clock.

I hope that gives you enough to productivly think about for now.

Oh one last informal TEMPEST / EmSec rule “Fail hard and long on error”, it’s another way of shutting time based side channel leakage down, as well as stoping some fault injection attacks. If done correctly an attacker will find their bandwidth reduced even further, which is part of the aim of the TEMPEST/EmSec game.