Schneier on Security

Clive Robinson • March 5, 2016 3:46 PM

@ Bruce,

England, is actually a minke whale.

I’d forgoton about this one, there have been quite a few washups this uear already.

And yes there were jokes about it being a “manky whale” at the time, along with the old “Q: What do you call a minke singing backwards?” “A: A decomposing whale” and “When is a squid not a squid…” etc. Such is what passes for “English humor”.

On and todays anniversary in the news, is the maiden flight of the Vickers Supermarine “Spitfire”. The Type 300 Prototype K5054 first flew 5th March 1936 eighty years ago.

Although earlier designs were flown before this, it was this prototype after minor “flight trials” modifications –a “nose job” being the most noticable– that was the first to go into service. Various other changes were made during it’s service. Due to the “poor fuel” available at the time it was infact under powered this was corrected later in WWII when American “high octane” fuel became available.

The Mk1 first drew blood in a “friendly fire” incident where two hurricanes were shot down. Of the two aircraft types the hurricane was the more successful in service. But the unique looks of the Spitfire is the one “most boys know and draw” even today.

Clive Robinson • March 6, 2016 2:53 AM

Multitasking and chocolate

As many will know Women have been known to occasionaly claim superior multitasking abilities, and as most men and the confectionary industry know Women appear to have an attraction to chocolate. But is this coincidence or correlation?

It would appear there is evidence to the latter. How this and other benifits for chocolate been found?

Apparently by chance,

https://www.washingtonpost.com/news/wonk/wp/2016/03/04/the-magical-thing-eating-chocolate-does-to-your-brain/

So maybe on Mother’s day we boy’s should “step up to the plate” and in the name of scientific debate, claim our share of the chocolate cake 😉

And for all those ladies who read this blog and are getting chocolate and cards today “Happy Mother’s Day”.

Clive Robinson • March 6, 2016 10:20 AM

@ Dirk Praet, Wael,

It’s funny you should mention the “nuclear wessels” sketch from the Startrek film. I just got my son a couple of boxed sets, one being the compleate Babylon 5 collectors set, the other being a boxed set of the Startrek movies and he was just watching that very film a couple of hours ago, and was laughing that embarrassing laugh at that sketch and the hospital sketch that follows shortly there after with Bones doing his “Dear God Man…” speech at the Neuro Surgeon. Both sketeches being gloriously over acted, for the laughs.

Clive Robinson • March 6, 2016 3:39 PM

@ Figureitout,

So you’re on your own here, and this attack only makes sense when you’ve stopped all the other ones.

Not quite 😉

You are falling into the “one size fits all” fallacy. There is more than one way to open a can of “corned beef” which way is best depends on several factors.

So it is with most things in life.

As an attack on the phone in the street this attack is not very usefull. As an attack on a phone on the work bench it’s got advantages in that you can minimize the risk vectors of information loss. But more importantly not have vats of acid or solvant that will either clean you to the bone and beyond before you can stop them or explode in some way taking half the lab with you on your way to being diolute molecules in the cosmos. Then if you survive the decapping process there are the lasers to have fun with… Oh and it needs to be said that the “Acid & Laser” method has a major downside, theres not enough left of the phone for it to be considered evidence let alone reliable any longer. Thus the independence and repeatability of testing fails which gives rise to problems within the way the law works. Which is why the forensic community has been trying for some time now to give the appearence of non-destructive or only partialy destructive –small sample–testing, such that the defence etc can carry out their own tests.

Electronics gives us a problem in that respect, it’s realy not possible to have a reliable primary custodial chain with verification testing etc. Thus we go for secondary testing we “copy and test the copy” but that gives rise to how do we know the copy is sufficiently identical? The simple answer is we can not, take the example of malware that hides deep in a computers BIOS and also in the on board CPU’s and Flash Memory of the hard drive. We already know that such malware can hide it’s self from the standard interfaces of the “black box” HD assumption used by standard forensic testers. Appart from very subtle time variations on the interfaces and differences in electromagnetic emissions the only way to find such code and the secrets it hides are via “Acid & Laser” or it’s equivalent…

With a little thought you will realise that in the “intangible information” world it’s now very much that of the Emperor’s New Clothes. At some point somebody is going to stand in court and point at the prosecutor and say “cringe in you callow nakedness” and the house of cards that information forensics is, is going to fall.

Thus this quest to “know everything” is a failure before it starts. If the FBI do not know this then they are sadly delusional.

To see why, lets say the FBI fail to get help from Apple, but the cough up a big wedge of cash to a research institution that using “Acid & Lasers” or “electromatic wizardry” get the first secret out of the iPhone and thus recover all the files. A lot of those files will have quite a high entropy and thus although being valid files contain sufficient uncertainty to hide sizable messages (ie stego). So you won’t know –if done properly– that there is any additional hidden information. So uncertainty abounds as you would expect and you can not “know everything”. But what if they find a near random text file that was say a draft SMS etc, what do they do with it? At this point they enter a world of hurt because if it contains valid information from an OTP they won’t be able to do anything without the key, thus a key hunt starts… Or they sensibly say “lets not follow the white rabbit” and accept they can not “know everything”.

Or a lot worse as some will suggest they will “invent plain text” to maintain an illusion, or use it against others –remember lying to suspects is allowable to get a plee deal or confession– along with tourture techniques such as “Special Administrative Isolation” etc, which at the very least deny access to legal representation etc.

The thing is that as everybody does they ignore the elephant. In this case it’s tangible physical “contact evidence”. When you make a “copy” and work on the “copy” there is no forensic evidence to say it’s a true copy, or that the suspect had knowledge of it at any time. Thus faking evidence gets one heck of a lot easier with intangible untraceable information than with tangible physical information, especially if you are alowed to destroy the original physical evidence in –supposadly– getting the intangible information…

Clive Robinson • March 6, 2016 4:56 PM

@ Albert,

You may be interested in this:

Have you looked up the LD50 in humans and their pets?

Humans need to eat around 10Kg of standard chocolate, dogs on the other hand less than 1/100th of that. Back when I was still young and in school I used to know a girl who assisted part time in a vets. She hated Easter (choc eggs) and Xmas (choc coins, tree decorations) due to the number of otherwise health pets that died.

If I remember correctly there was a civil court case over the death of a “nuisance dog”. From what I remember the owner let it dig under fences and get into a neighbors garden where it did a lot of damage to plants etc. She had alowed it to do this for some considerable time then her dog turned up dead of theobromine poisoning… She first accused the man next door and tried to have him arrested for animal crulty, and when the Police and Inspectors did not bite, she tried a civil lawsuit involving “attractive nuisance”… What the truth of the matter was I don’t know but there are laws in most jurisdictions about “animal control” and it sounded like she did not follow them.

@ keiner,

Anandamide

Ahh the Cocoa bean “tetrahydrocannabinol” (THC) analog. Then there is the quaintly named “Cocoa amphetamine” alike “love drug” phenylethylamine. But even theobromine has mood enhancing effects as a neurotoxin it first has pleasurable side effects causing both relaxation and stimulation similar to caffeine.

If you want to see the effect chocolate might have on humans give a little to a mouse and then you will see why people joke about them being “Speedies”.

The use of cannabis and amphetamine combined was known back in the hippy hangover days as the “seducers drug”. In much the same way that Absinthe was considered the “seducers drink” a century or so before that (due to the use of Wormwood, which like the more easily obtained Cleary Sage essebtial oil tends to be enhanced in effect in alcohol and is reputed to have LSD like effects).

But there are three hundred or so other chemicals in the cocoa bean extract also with known properties that give women especialy a “happy hug” feeling. But few people can stomach pure cocoa extract it’s actually quite bitter (which I like). So eating choclate is enhanced with lots of sugar (human niros-oxide) and various fats which also have mood changing effects. Specificaly the finest chocolatiers try to get the melt point just below that of body heat, thus the very seductive melting on the tongue releasing the chemicals and fine mood enhancing smells.

Continental Europe tends to have the highest cocoa extract in chocolate in the first world whilst the UK and US have so little they add the likes of caramel –just browned sugar which is a suspect carcinogen– to colour and flavour the adulterants so the lack –10% or less– os cocoa extract is not as obvious. Which might account for the stories of why the EU wanted the UK to stop calling it’s chocolate products chocolate and vegolate instead…

@ Alan,

The “chocolate teapot” is a real work of art, I like, and I know someone to give one to who will see the joke as she collects antique china tea pots and services.

Clive Robinson • March 7, 2016 5:37 PM

@ Skeptical,

My point is simple: The principle at issue in the San Bernardino/Apple case is whether a court may, under the AWA, compel a third-party My point is simple:

The principle at issue in the San Bernardino/Apple case is whether a court may, under the AWA, compel a third-party to render reasonable technical assistance in effecting a search warrant where the law is otherwise silent on the question. where the law is otherwise silent on the question.

Or to put it another way Does the US have the right to force an unwilling party into servitude?

Such a thing used to be called slavery, later conscription, both are now recognised as being against the rights of the compelled party.

Trying to hide the breach of rights behind statments like “render reasonable technical assistance” in no way removes the evil of the compulsion. Or trying to hide behind spurious morals of claiming “in effecting a search warrant”.

Let us be clear the third-party was uninvolved in the crimes, in the same way a satellite car navigation system is innocent a hit and run murder.

But the court action not only casts a long shadow over the third party it can also be shown to be putting the third party at risk.

Knowing this the FBI decided to, with premeditated forethought, compound the risk to the third party by forcing the issue onto the public stage by informing the press and media. With the deliberatly aim of bringing unwarented public approbation on the innocent third party, further breaching the third parties rights.

As a non US citizen, I look on this with a considerable degree of distaste and disgust. Further it makes me think back to the last time I signed the green imigration card to gain entry into the US. There was the all important question about “Moral Turpitude”, which can be described thus,

<

ul>Moral Turpitude is a legal concept in the United States and some other countries that refers to “conduct that is considered contrary to community standards of justice, honesty or good morals”.

Tell me how you think the FBI score on Moral Turpitude?

Clive Robinson • March 8, 2016 10:33 PM

@ Wael, Dirk Praet,

At fancy parties, I usually sneak out around midnight to get me a hamburger or some kebab 😎

You and me both 😀

A little under twenty years ago a friend and I visited a quite exclusive (thus expensive) Sushi place where you get to see the whole performance of “swiming to plate” and whilst we ate well and our pockets were lightened considerably we both had the feeling of having been entertained but not realy fed (this was in my younger fitter 3.5Kcal/day days where a quick fifty or sixty miles on the bike was a way to unwind from work). We had also had a number of flasks of the warm brewed rice wine Sake (18% by vol) to finish off, so our judgment was perhaps a little impaired, as we took a short cut to the station we got hit full in the face by the smell of a Greek restaurant and were led by the nose to a full mezze etc, includibk a bottle or two of Retsina… Oh and a lesson learned, under no circumstances drink retsina after Sake the result was most dibilitating the following day, and a compleat inability to think clearly for a couple of days, which ment the bike stayed in the garage for five days, longer than it ever had for minor inconveniences like flu.

As for eggs and sperm, we do eat both look up the difference between soft and hard roe. I still occasionaly brine / smoke cods row to make tarama which will keep for a while, and then make a traditional salad of taramosalata with it. If I am feeling decadent I will use ground almonds not white bread, and whilst not quite Ambrosia is a little bit of heaven when compared to the standard pink (from beet juice) slurry you get from most shops.

As for Squid, it’s your duty to eat it by the bucket full due to the harm it’s causing (the same is not true for octopuse or cuttlefish). Due to the decline in other species man is the only serious preditor against the dangerous rise in certain squid numbers.

As for the story of the squid sperm, their life cycle is a little weird to put it mildly ( http://gilly.stanford.edu/reproduction.html ). Thus the packages of sperm the males make are long lived and have an affinity for mucus membranes. Due to the taste abd texture of raw squid I only eat it prepared and cooked, thus the issue raised by the story does not arise.

Clive Robinson • March 9, 2016 5:10 AM

@ Wael,

I looked it up, you’re right! Didn’t know that! Eeeeew

In the munching departnent it gets worse a whole lot worse… If and only it you have a strong stomach look up Offal[1] and the difference between “sweetbreads” (pancreas, spleen and similar) and “sweetmeats” (testicles etc) and the orign of the expression “Prairie Oysters”, more often called “Rocky Mountain Oysters” in the US.

If you look back in history people did not waste what was in the animals abdominal cavity it’s all edible if you want to. The guts of the animal were cleaned out and often filled with the offcuts etc to make the variety of “sausages”, black and white puddings, salamis and other regional delicacies such as the Scotish Haggis using the “pluck” and “lights” of the sheap etc (a dish I enjoy). Then there are other bits, like pigs heads where you remove the ears and cheeks –for other dishes– then slowly cook down the reast so you can lift out the bones then coarsely chop it and put it all in a dish to make “brawn” that was often given to those not upto chewing hunks of flesh, or put on bread etc. Likewise “piggs feet” when slow cooked make a realy nice but sticky dish (ever wondered where the jelly in jello and blamunch came from). Sliced “Ox tongue” braised in red wine is a realy nice dish, the hard part for the cook is getting the skin off. Another nice dish is marrow bone for which you need a special spoon. Though originally thought to be “poor mans fare” like the eggs of sturgen, smoked salmon, etc they became “high class” speciality dishes of the rich, whilst potatoes went the other way…

Oh and perhaps of some relevance to this page look up “pizzle”, some say that when cooked the right way they do taste like fried squid…

Asside from brawn Atleast so far apart from the name you are getting parts of the animal you can identify by sight… But not all names are what you think they are some are nicer take “pork butt” it’s not a cut from the pigs rear end it’s actually “pork shoulder” the name comes from the wooden barrels it was brined or transported in.

The real nasties are what goes into pies, “ready meal” stews curries and similar pre-made dishes. It’s not just “mechanicaly recovered meat” there are other industrial horrors where scientists have worked out what to do with bits of other animals you would perhaps chose not to eat (goat, horse, pig etc)… That is they can reduce horse skin etc down to “real meat” thickening agents and in the processes destroy the DNA traces so you can not tell which animal it came from… These thickening agents are also used in frozen poultry end stage production and for cooked meats like “York Ham” production where they are injected into existing animal flesh so that it will additionaly hold upto twice it’s weight in water… It’s one of the reasons why some Bacon not just sizzles in a hot pan it lets out clouds of steam like a boiling kettle.

I don’t know about other readers but upto ten USD for a kilo of salt water and unknown animal products is not a price I want to pay.

And some of my friends wondered why I took up charcuterie as a hobby…

[1] http://www.independent.co.uk/life-style/food-and-drink/features/offal-is-back-in-vogue-but-should-we-tuck-in-to-intestines-spleen-and-testicles-6264018.html

Clive Robinson • March 17, 2016 4:31 AM

@ Figureitout,

I can’t say w/ certainty that what I’m seeing in the debugger is the actual first code executing on the chip

That should be easy… Famous last words 😉

I’m assuming from what else you’ve said you are using some variant of a C compiler. If so then you should find a couple of –probably chip specific– “C0” files that are linked in to load at the chip reset vector and do the “sanity setup” –and sometimes setting up a minimal environment– prio to jumping to main. The other place to look is in the base C library which provides support for printf() and friends.

These are usually –but not always– “human readable” files often with a bunch of inline assembler that in theory you can change to do your own thing for IO.

If not specificaly mentioned in the documentation the “tech support” droid for the compiler should be able to supply you with info (if they will or not is another matter).

Clive Robinson • March 17, 2016 3:41 PM

@ Figureitout,

… but since this is supposed to be a wireless system, hooking up debugging equipment provides a ground path which alters how the system will function in field

I’m not sure how your system is to be packaged, but it’s generaly difficult to isolate a system
as any EMC guide will go to some length to explain.

Even putting a PCB on a wooden test bench effects the EM fields (wood typicaly is 5-20% water with disolved salts in it so is conductive from “DC to Daylight”. To see how bad it can get push a copper coated pin through the varnish and hang a 10:1 scope probe tip off of it, the level of mains humm will supprise you (I’ve seen in excess of 0.5 volts quite frequently which plays merry hell when you are doing “audio tests”).

If you are using a TTL level output you can get Opt-isolator chips that will give you galvanic isolation and limited EM isolation.

However if that does not work or you are using a much lower level I/O then you need to go abother way.

What you are therefore looking for is a “Line Isolating Network” of the balanced to unbalanced variety
these effectivly consist of two parts. Firstly a balanced to unbalunced –balun– typicaly a transformer that DC issolates, auto transformer or transmission line coax/stripline network. This usually also impedence matches the input impedence of the test equipment (50ohms for RF analysers / test receivers) to the EUT output impedence. The second part is a constant impedence balanced filter, this is often lowpass but can be bandpass as well. In the case of a lowpass filter it has both a lowpass and highpass network with the same cutoff frequency they xonnect in parallel or via a circulator, with the lowpass output going of to the balun and the highpass output going to a dummy load.

For connecting up to normal “logic outputs” I find a nine to one impedence balun of 50:450 ohms quad or trifilar wound on a suitable ferrite torroid to generaly work. With filters designed for 400-500 ohm depending on component value convenience. If you cannot “wind your own” balun go look for one of those VHF/UHF 75 ohm Belling lee connector to 300 or 600 ohm flat open line baluns in your local HiFi/TV shop (wiki has a photo of one on it’s balun page).

Which brings us on to,

I need a way to wirelessly transmit debug data or the data is slightly corrupted…

I’m not sure I get what you mean.

If you mean conecting appropriate isolated test kit causes data coruption then there is something seriously wrong with the layout of the system.

If however you mean as a way to distance the test kit then try the line isolating network first.

If your debug data rate is low then consider sending it as either pulse width modulated, Manchester encoded or other form of modulated waveform thus DC isolating is not an issue.

It’s difficult to give hard recomendations when I effectivly know nothing about your setup. That said the above advice generaly works when normal test kit usage fails.

The most drastic I’ve had to do is with TEMPEST kit where the debug port was a striped bare fiber optic cable through a pin hole in the screened case, screened with RG174 coax with the inner pulled out. Expensive and a right royal pain in the “sit upon”.

Oh one thing to remember when dealing with RF follow the “single earth” policy. Otherwise you will get “RF loops” which are the EM equivalent of “audio howl around”. RF thus gets in everywhere and causes all sorts of nasties in the EM spectrum as well as general instability, messy messy messy…

Clive Robinson • July 20, 2017 3:24 AM

@ Figureitout,

It’s a hard field, I’d want the real RF/signal processing guys/gals.

Yes it’s hard, but I can give you plenty of examples where the “RF/signal processing guys/gals” were most definitly not up to the job, not even close.

Back in the early 80’s we were making systems based on a Z80 and fast RAM/ROM that were beating hands down what the SigProc bods needed 68xK CPUs and multiple highend –for then– DSP chips for. Their solution took over 150W and two 2U 19in racks, ours ran on batteries or a 9V “wall wart” and fit in a 1.25in high 4x6in alli case, oh and had a 16dB better sig to noise margin and way better fade margin figures…

As I’ve mentioned before I designed a digital I/Q 10.7 IF using a PIC to load a fast –less than 5nS– SRAM chip and a couple of 74F counters and DPLL which Direct Converted to baseband and also could do a complex digital modulation scheme demodulation.

Likewise for instrumentation, I designed a highly linear Pulse Count Demodulator using two 14pin 74S TTL chips that beat hands down the analog or DSP solutions and cost cents not hundreds of dollars and required no re-cal maintanence.

These things are not difficult when you have grasped the trick/ability to think sideways.

When you look at say a Direct Digital Synth all it is is an adder set up as an accumulator and this drives a sinewave ROM that then feeds a D-A converter (that often then drives a PLL due to The DDS AM/PM issues).

The thing is if you look up Walsh Sequence generators they do not have anywhere near the problems you get with a sinewave ROM.

But if you think a little further you can use a larger ROM and put in a complex digital modulation mapping in there. Thus you have a compleate modulator and very fine variable frequency capability. Which majkes it highly desirable for any mobile system where dopler effects are an issue but predictable such as a satellite uplink TX. Oh and if you replace the ROM with a high speed SRAM and a cheap microcontroler to load it with the required mapping then most digital modulation schemes are just a mater of working out the “map to load”.

Clive Robinson • July 21, 2017 12:14 AM

@ Rachel, Figureitout,

Trunked radio services look good on paper and in theory atleast have the ability to improve things.

However “when the rubber meets the road” they have quite serious issues. Not least of which is they behave in a non intuative way when used in untested or unexpected ways. Often they are a back door way to reduce spectrum use, which is generaly fine in ordinary usage, but when an emergancy arises and traffic rises they tend to fail and fail a lot harder than older “analog” systems.

A big failing is the crypto and authentication. There are plenty of cases where users turn off the crypto to get some kind of comms going which can have appaling consequences when the user things their comms is secure but is not.

The much touted ability for multiple first responder agencies to link up in an emergancy usually fails due to both crypto and authentication failures. Thus the guys and gals at the coal face rapidly come to distrust trunked radio systems.

In the UK the Met Police have a trunked radio system and it is detested by users for a multitude of reasons. Which is why you get a significant usage of mobile phones instead. Which of course work the way the users expect them to and why some beat officers have more than two moile phones on them.

The future of trunked systems is looking doubtfull in the face of mobile phone usage, which in all but the most dire of emergancies work and work well. In such emergancies trunked systems would in theory be the perfect answer. But in practice the old analog radio systems for all their other short comings still work better with marginal signals. And importantly they are simple and thus ad hock systems can be set up by any moderatly intelligent person with little difficulty and very quickly. Unlike trunked systems that need not just intelligence but a great deal of knowledge as well as the right crypro keys and authentication tokens…

Also AM systems tend to work better in marginal conditions than FM systems. Which is one reason aircraft systems still use them, even though they are more prone to interference.