Schneier on Security

Clive Robinson • October 3, 2015 3:56 AM

@ Wow, Tõnis,

That article and several others make it clear it’s

1, In the Windows Driver Code.
2, For Privilege Escalation.

We need to know a bit more than that to say for definate, but if you have used another OS then you are probably OK with your micro SD cards.

Windows Drivers are a known security risk due to amongst other things their long and inglorious history and backwards compatability.

As time goes on Microsoft is steadily becoming more and more of a hostage to it’s early DOS Designers choices, where security was never a consideration. But even so many of their choices made no sense then or now.

The problem with pushing encryption code into an existing storage media stack is “at what point” for FDE the best place is below the file system code, whilst for file based encryption it’s better to have it above the file system code. But what do you do about directories and multiuser access to the same drive, well that is very OS dependent as well as being very messy, then there are journaling and snapshot issues…

Clive Robinson • October 3, 2015 5:28 PM

@ Grauhut, ianf,

Meaning IN PLAINTEXT what exactly…

It rather depends on the individuals resources and capabilities, hence my ‘appropriate “guard technique”‘ comment.

As I’ve mentioned before I use a form of ASCII armourd text file that goes into a serial guard / diode of my own design for most data transfer.

The reason for mainly using plain ASCII text in a standard format is so that you can visually inspect what is being sent and received as a payload, the armoring is multilayer and uses two dimensional check sums. This works OK for most occasions, and I try hard never to need to send non human readable data.

As I’ve advised people in the past “PAPER Paper, NEVER data” is a good way to stop unknown and possibly disastrous meta data leaking with visually formatted data, so yes “Print to paper read through scanner” is another usefull method. One I advise people to use when being forced by “discovery” etc to do. If those doing the forcing want “data” then give them a DVD or two of scanned in images, let them do the OCR and clean up etc if they want to start putting it into DBs etc to work with data mining and inference software.

The thing is that for some strange reason people make the mistake of thinking a three line memo needs a 50Kbyte Word file… My view is bin the fancy formating and send only 200bytes of human readable ASCII instead. A definate case of “Less is More” and at least that way you know what is crossing the wire…

For my sins I still use WordStar for typing up some technical documents. I have some hand cut scripts that convert the wordstar formating tags into HTML tags for other people to see on their systems. If it realy has to be “beautified” then RTF is my second prefrence, whilst not quite the universal format plain ASCII is it’s fairly close. Likewise CVS for spreadsheet data and for database records. There are simple ways to enhance these files into an armoured format with checksums etc, or if to be sent “long distance” have robust FEC added.

At the end of the day “minimal format human readable” files limit the amount of space that is available for inband side channels, thus limit hidden meta data leakage. All of which means that “Less data” is “More security” at the end of the day.

Clive Robinson • October 4, 2015 1:32 AM

@ Alien Jerky,

A pad of paper and a pen. very hard to hack,

That depends on your viewpoint, or rather that of your attacker.

One problem these days are high resolution security cameras with “long lenses”. There was a well known company that discovered that the security cameras in it’s work area could be used to “shoulder surf” passwords. Likewise the use of a pen/pencil even viewed obliquely can reveal what you are writing. This is just one of a class of “end run attacks”.

Writing under an umbrella is one way to limit the visual end runs (though watch out for reflections).

But there are other issues to do with “information leakage”, when you write in a note book you leave an impression on the other pages, thus tearing out a page and burning it does not destroy what was written, as the impression remains. Likewise jotting a note to some one and tearing it out, it will have the impression of what was written on other pages and will show up in ESDA or iodine vapour (or similar) tests.

But it gets worse, most surfaces on which people write will retain either an impression or some other trace of the writing. One way to reduce this is to “write one page at a time on glass and wipe it down”, but make sure it is glass without a coating, those with a coating such as the touch screen on your mobile devices still holds an impression.

So in addition to pen and paper, having a glass table top or big photo frame, with an OCD like cleaning habit and an urge to hide under umbrellas whilst doing it helps with writing security.

Clive Robinson • October 4, 2015 4:28 AM

Whilst the case of if a journalist is guilty of being a Hacker or stooge for Sabu is fairly dull, one bit is of interest and thus might leader to changes in the way future cases are prosecuted.

At the heart of this is the need by the prosecution to show damages greater than 5000USD, and as several know the prosecution like to fiddle the figures as high as possible because not only does it make good headlines it helps political careers as well.

Well the defence are challenging the prosecutions figures because their are at the very least “smoking gun” emails that indicate that costs have been artificialy raised to make prosecution possible…

Whilst I suspect this massaging of figures supprises no one, the fact that it’s effectivly becoming a trial before a trial is a suprise and if the defense win then there are at the very least going to be red faces on the prosecution side if not actual censure.

http://motherboard.vice.com/read/low-level-vandalism-or-high-damage-hacking-day-two-of-the-matthew-keys-trial

Clive Robinson • October 4, 2015 4:48 AM

@ Figureitout,

Over at Hacker News, somebody asked about seting up Software Defined Radio (SDR) and got some interesting replies as to kit etc,

https://news.ycombinator.com/item?id=10324755

It might be of interest.

Clive Robinson • October 4, 2015 10:57 AM

@ CallMeLate…,

Yes “Cocoa” bean / gourd from the Theobroma cacao tree, the pulp of which makes a pleasant chocolate drink. Whilst “Coca” leaves from bushes in the Erythroxylum family make an uplifting tea and an effective pain killer –sometimes used as a food substitute– and if freebased correctly gives cocaine that at one time ended up in Coca Cola which supposadly eased various digestive and lower abdominal pains (rumour has it that the tea does the same).

Oh the “Theobroma” in the name of the chocolate plant means “Food of the Gods”, but ironicaly is also used as the name of the poison in chocolate. A few milligrams of which will kill your pet dog, or cat quite unpleasently. It’s also leathal to humans if you can eat about 10Kg of chocolate bars within a relativly short period of time… however like most alkaloid poisons in small doses it has pleasent and medicaly usefull effects. If you want the sciency stuff search for “LDL50 theobromine” otherwise have look at the Wired digested article,

http://www.wired.com/2013/02/the-poisonous-nature-of-chocolate/

Clive Robinson • October 4, 2015 4:11 PM

@ Bruce,

Thanks for the replies. I guess I’m going to have to read it now 🙂

Clive Robinson • October 5, 2015 5:32 AM

@ ianf,

Are you (both) really suggesting that Ed Snowden—whom we were discussing—official asylum recipient, thus in a sense a guest of the Russian Federation, lives in danger of being sandbagged on a Moscow street by FSB thugs

We are discussing several people, Pres Putin, Ed Snowden and people working in foreign intelligence either with diplomatic cover/protection or without which the Russias call “illegals” and the US calls “Non-Official Cover” (NOCs pronounced as “knocks”).

Whilst NOCs are not “agents” –ie nationals that have been turned / traitors– they are usually either “Officers” –ie employees of one of the US Intel Orgs– or are contractors such as ex-military or IC who have in effect become the Intel equivalent of “guns for hire” and have the advantage of deniability. If the US were to try and “lift Snowden” then it is likely that the first stages would be carried out by NOCs, and it is they and any agents being used who are at risk.

As Skeptical points out in the past there have been informal rules, the reason for this is it serves both sides by not alowing escalation into open conflict. However such rules as they are have only been seen to apply where both sides see themselves as equals in “the great game”. Thus these informal rules are not the case with all countries and may not hold with either the US or Russia any more. As both sides have been ratcheting things up so they are clearly in the public eye, escalation has visibley begun.

To add to this Putin is re-establishing the old early Stalin ties to China and thus also North Korea which is going to be problematical for the US and some WASP nations.

As Europe feared back prior to Gulf War II / invasion of Iraq, rather than tie Russia economicaly to Western Europe which would further the peace, prosperity and thus stability, the US & UK have by their short sighted behaviour, driven a wedge in the Middle East. With the expected destabilization and build up of conflict spreading in the old Russian Republics and other Russian “buffer nations”.

To add to this we now have the start of a “pissing contest” in Syria, which could easily turn into a proxy war, which would mightily please the US MIC who were very against de-escalation with Iran. Further we are also edging closer to hostility issues in that other old War Hawk stamping ground of the South China Seas…

As the words of the song say “Oh the times thay are a changing…”.

With regards China carrying out operations without anesthesia, it’s fairly well known in scientific circles and has been in the likes of New Scientist and similar. Further the US are currently investigating local not general anesthesia for operations other than brain surgery where it’s been in use for some time. It’s also been shown that for very short surgical proceadures on fingers etc that an acient “binding” technique works (think about the stages of “pins&needles”).

The reason for the research –which also involves exotic poisons– is current general anesthetics are bloody dangerous and significantly reduce a patients outcomes, especially if they have a high BMI. Whilst western medicine is working towards blocking the pain paths closer to the operating site, China has investigated the use of what in the west calls “alternative medicine” such as hypnosis and electro acupuncture and various extentions to TENS etc as well as forms of cranial stimulation.

The main concern with what is being done in China is that operations not using conventional anesthesia are performed at much lower financial cost to the patient, and that the pain signals in the nerves are still being sent to the brain. As has been found in the past in the US the fact that a patient does not physicaly react during an operation does not mean the brain is not feeling pain and thus potentialy trauma that will be relived later.

Thus the concern that poorer patients in China may in fact just be grinding their teeth, as they need the operation, and can not aford the higher cost and likewise do not care about potential future psychological issues.

Having myself awoken a couple of times during general anaesthetic and as I’m very likely to need further operations for muscular skeletal issues, it’s a subject that is of considerable interest to me. For those that are interested, I’ve found that in my case spinal blocking causes me way less problems than general, and if the science finds that more localised or non chemical anesthesia works then I would be more than happy to go down those paths. Further being a sufferer of continuous pain and having had bad side effects of CNS pain killers I’ve found that certain techniques similar to meditation supprisingly do help quite a bit.

Clive Robinson • October 6, 2015 7:50 PM

@ Bruce,

Some years ago you commented that having centralized data bases was a bad idea as it gave a single point for attackers to get at.

Well it’s a lesson the US –and presumably other– government entities failed to heed. So in an “No 541t Sherlock” article Security Magazine points out the US Gov is the biggest Cyber-Security threat,

http://www.securitymagazine.com/articles/86681-survey-says-government-is-the-biggest-cybersecurity-t

I guess there’s no percentage in you saying “I told you so!” 😉

Clive Robinson • October 6, 2015 8:13 PM

@ Bruce, and other flyers,

You might find this Brian Krebs article of interest,

http://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass-barcode-a-lot/

It shows what quite sensitive information is contained in the 2D barcode on the boarding pass, and how it can be used to find other sensitive information, as well as alow an attacker to change your future travel arrangements.

Clive Robinson • October 7, 2015 4:07 AM

@ Wael,

What you swallowed

You missed out on the next factor down the line…

I can’t immediately remember where I read it but a few days ago there was an article about “Your Personal Germ Field”. It appears that every biological emission we make is tainted with our own –supposadly– unique bacteria etc, that hang in the air as we pass them on to others. So remember to add “What you f4rted” to the list.

But the device reminds me of an episode of Babylon 5 many years ago. Towards the end of the episode the station security chief tells one of the ambassadors that the reason they new what he was upto was they put a nano tracking device in his food and could thus know where he was. Just at the end of the episode one of the other station personnel is talking to the chief and says “Did you realy put a tracker in his food?” To which the chief says “no” the other person then asks in a puzzeld way “Well why do you tell him you did?” To which the chief replied “Just think of all the fun he’s going to have trying to find and get rid of something that isn’t there…. should keep him busy for a while”.

Clive Robinson • October 7, 2015 4:57 AM

For those who want to know a little about DSP.

If you are not a DSP programmer but want to get an idea about how and why you might want to do it,

http://sam-koblenski.blogspot.co.uk/2015/10/everyday-dsp-for-programmers-signal.html

Gives you sufficient info in a fairly painless way.

Clive Robinson • October 7, 2015 5:26 AM

First steps in keeping electric surveillance drones aloft indenfinatly.

The company LaserMotive that won a NASA prize for beaming power over 1Km with a laser has branched out into using it to keep electricaly powered surveillance drones in flight for almost indefinate periods.

Whilst currently a “proof of concept” the system kept the 8Kg Lockheed Stalker UAV aloft in LaserMotion’s wind tunnel in Seattle for 48hrs which is 24 times it’s normal maximum duration, and when landed the batteries had more charge in them than when the experiment started.

The Popular Mechanics article talks about the limitations of the drone being tethered to a point on the ground. Don’t let that fool you in a town or city it would be very easy to set up several of these charging points on building roofs, and in urban and open country areas there is no reason why the “Mother Ship” or “Milchcow” principle could not be used from a much higher altitude if the receiver is mounted on the top of the wings not underneath. This would also have the advantage of their being considerably less chance of the laser interfering with any surveillance package mounted on the drone which would be underneath and facing downwards.

http://www.popularmechanics.com/flight/drones/a7966/how-it-works-laser-beaming-recharges-uav-in-flight-11091133/

Clive Robinson • October 7, 2015 8:55 AM

@ Curious,

“Edward Snowden interview: ‘Smartphones can be taken over'”

I’ve mentioned this several times on this blog long befor the Ed Snowden revelations, because if you read the phone standards you will find it in them in nearly all national standards and all international standards.

To understand how it came about you have to go back in history to the 1800’s, when Nation States put themselves in charge of their Postal services, either directly or by regulation to ensure the service was fairly available to all subject to legislation. It’s one of the reasons why Post is recognised as “the lawfully accepted way to make notification” of any action etc, and why you can not ban those who deliver the mails from your property.

Having in effect established a monopoly over communication nation states extended it to all new forms of communication. It is why it seems daft for instance that the National Department of Transportation is also responsible for testing compliance on telephones untill you understand the history behind it. The First World War made it clear to most civil servents at senior level that the ability to listen in on communications was a National Security issue and thus the spooks got involved.

In the UK the tapping of telephone lines was (and still is) illegal for most (RIPA made clear who could and could not) but for “Technical and Safety” reasons the technicians and operators of what we now call the POTS had the right to “listen in”, “talk into” and “disconnect” all calls. And those old enough may remember having their local calls interupted by an operator to be informed that a long distance or international caller was trying to be connected, thus it was also for “business” reasons as well.

This right was firmly established before fully automatic dialing and digital phone standards were drawn up in the 1960’s for the core networks, thus they were included and even though phone companies might now be private entities governments retained these rights. In the 1980’s as the old insecure VHF car phones gave way to analogue cellular mobile systems the rights were again carried forwards. Likewise into GSM CDMA and other “edge of network” standards, what was in the core continued out beyond the demark.

With privatisation came the need for tighter accounting of service usage. The fact that early cellular networks could be cracked was a major concern, because of the way legislation was written (ie the consumer was only liable if the call had been placed from behind their demark).

Thus the design of all mobile systems is that the network operator controles your phone connectivity via the Subscriber Interface Modual (SIM) and to ensure it could not be easily spoofed your entire mobile device, even if you own it out right is subserviant to the SIM and the network operator can load via the Over The Air (OTA) interface download software and updates into your phone.

With the advent of Smart Phones the consumer “smart side” of the phone was never issolated in a way that would protect the consumer, only the network provider, phone manufacturer and OS vendor. Thus a smart phone is very insecure by design, and “the myth of going dark” is just that a myth. The only way you can get security is by having carefully designed end to end encryption systems that ensure they are correctly issolated from the phone and network such that the only things that can be done are call disruption/disconection.

Anyone who tells you otherwise has not sufficiently read the standards, or is misleading you for some reason.

From GCHQ and others point of view attacking the smart side of the phone has a number of advantages, firstly it gets around a lot of red tape legislation, secondly it can also get around technical limitations such as high battery usage and easily spotted RF emmissions, thirdly it gives deniability, fourthly it also works reliably across international borders… Oh and as consumers want “voice recognition” the bulk of the software the IC agencies need is their gratis all they have to do is make very minor software hook in’s (similar to the *nix shell tee command). But likewise it’s not just the voice circuits they get access to, it’s GPS, accelerometers, keyboard, camera, screen and any other peripheral like storage and the various hidden bits of flash memory including that in the batteries, so once they get easy access your phone is owned untill it’s crushed. The downside is of course the second market, not just in phone resale after upgrade but repaired and reconditioned units, something the “Factory Reset” will not remove…

Clive Robinson • October 13, 2015 6:35 AM

@ Markus, Sancho_P,

I guess the aim is to make a crupto KeyMat “Fill Gun” or “Ignition Key” device to make the loading of the KeyMat into thr encryptor device easier and in theory more secure.

The old way to do this which can still be seen on NATO equipment is with a manual draw optical tape reader.

Whilst making an optical reader is mainly a mechanical issue, actually making the tape is not anywhere as easy as it once was.

Thus I would suggest using an inkjet and semi transparent paper and use a code similar to that used on the ABA “mag stripe” on credit cards or 1D bar code etc.

However with 2046 data bits and extra for lead-in/out error correction, self clocking etc you are looking at about 800 DPI which is not likely to work at all reliably with a hand built optical reader where you would be pushing your luck with 10 DPI.

I can think of several other ways including four track mag stripe bank cards BUT…

I suspect there is an unstated need for single button push zeroing and similar.

Thus the reason in the past for using PK where each encryptor has it’s own private key known only to it and the KeyGen device not the KeyMat transportation Fill Gun or Ignition Key. In this respect many problems can be solved by the use of Smart Card / SIM Card devices.