Schneier on Security

Clive Robinson • April 8, 2016 7:56 PM

Something for the weekend…

Sometimes all you want on a Friday is touch of lubrication and a little light relief.

Whilst I can not help with the lubrication (buy your own booze), this might provide a little light relief,

http://www.theregister.co.uk/2016/03/18/web_ads_are_reading_my_keystrokes_and_i_cant_even_spell_propperlie/

Clive Robinson • April 9, 2016 4:18 AM

@ 65535,

With the Feds have finger printed each Tax Preparer’s computer…

I suspect this has been started due to the number of false filings by criminals etc. You would not expect significant multiple filings from individual computers, even from an accountant doing it for several people.

Without going into details there are often ways even unique electronic serial numbers can be changed because the App sits several software levels above the hardware.

Years ago the NE2000 network card was cheap and plentiful, and due to this the manufacturer had “soft MAC addresses”. For various reasons in a number of places the MAC address would be changed after the OS / Apps etc had been installed or upgraded (it helped with inventory). This worked fine untill Micro$haft decided to “get cute” with trying to tie software to hardware…

The thing is that these serial numbers that go into making the device fingerprints are often not reliable in many ways. It’s why I object to the term “fingerprinting” when used with them. If criminals know about what forms the roots of these serial number amalgamations then they can find out how to change them, and probably have.

Thus these electronic device fingerprints are not like the Typewriter Typeface Forensic fingerprints of old that could be used as reasonable evidence in a court. Something that nodoubt will at some point in the future form the basis of yet another forensic evidence scandal as has hair analysis, bullet fragment metallurgical matching, drugs traces in currency etc.

All of which is not helped by the fact that the DOJ/FBI are known to regularly cheat in the “evidence discovery” phase of a trial, especially when politicaly motivated. It’s got to the point where people should be asking if those in the DOJ should be tested to see if they are sociopaths or not, or just accept the idea that the DOJ is “an institution for the criminally insane” where “win by any means fair or foul” is the name of the game…

Clive Robinson • April 9, 2016 5:10 AM

@ 65535,

Or how about the CIA venture capital funding a “skincare” company, that has a novel way of striping the outer layers of skin off and in the process makes DNA easy to collect from an individual?

https://theintercept.com/2016/04/08/cia-skincare-startup/

Where ever you look the Feds etc have their little wrinkles that all appear to be about invading privacy and collecting personal identifying information.

Clive Robinson • April 9, 2016 11:24 AM

@ JG4,

… this interesting side-channel attack

The instance is new but the class is old 😉

The first implementation of Quantum Key Transfer used motors to change the poloriser. Thus as he was adjusting the experiment the audio side channel was telling him exactly what state both polarizers were in.

And back in the 1950’s MI5 provided GCHQ with an audio side channel into various Embassies Crypto rooms which provided fast short cuts in determaning the mechanical cipher machine settings.

Oh and the British DWS Rockex OTT Super Encryptor in NY was likewise attacked by the US during WWII, they used a dual channel scope to see the audio at the same time as the signal on the line. This enabled a keen eyed engineer to spot that there were slight differences on the hold and release times on the “adder circuit” as well as powersupply issues. Which ment they could strip of the super encipherment by one time tape and see the Typex encrypted traffic and EOW instructions.

It’s why we should realy talk about “energy gapping” not “air gapping” systems to remind ourselves that not all side channels are electrical or electromagnetic.

Clive Robinson • April 9, 2016 4:55 PM

@ Mike Barno, Albert,

Can someone with industry risk-mitigation experience provide a better understanding?

There are much better reasons to keep spares of transformers and the like on hand than maybe terrorist / hostile nation getting into the control systems. The terestial and space weather being two.

If you remember nit so long ago NYC got a little bit damp and had flooding etc. Quite contrary to many peoples expectations the local power company kept things together quite well. The reason was a short while before that they had major problems and had to put their hand in the profits to upgrade their run down infrastructure. As a result they could divert upgrade to repairs. Thus a valuable lesson was learned.

Back about a quater of a century ago a major Canadian area discovered what effect a solar storm can have when over head power cables and the transformers they feed are running at 99% capacity and get the equivalent of a hundred years of lightning in charged particles etc in just a few seconds causing things to melt like fuses.

We were due a solar storm maximum a little while ago but it did not realy happen which means the next one could be a real biggie… Whilst over head cables can be cheap to put up, they tend to have higher maintenance costs which counteracts the initial savings quite quickly. The sort of transformers they need are neither cheap or quick to source and can have two or more years lead time, so losing four or five at the same time could through us either back to the 1920’s or have disastrous health consequences due to generator emissions (Diesel Particulates). New Zeland had an example of this a decade or so ago and the privatised supply company disappeared like thieves in the night, and there were reported increases in breathing issues and premature deaths.

The other thing to remember is that older transformers are an environmental disaster they are fulk of PCBs used as coolant. In many places they are now effectivly illegal to use. Thus transformers are having to be replaced long before their end of life time. Put simply there are no PCBs that are safe in the environment and destroying them is a very difficult task for the same reason.

As for “good old boys, getting a skin full” and shooting up transformers, that is fairly trivial to stop with appropriate walls. Likewise thrown explosives can be stopped by steaply pitched roofing or chainlink netting. Which means terrorists are more likely to attack pylons in fields etc where security is much more in their favour.

By the way, you dont need explosives to take out over head cables you can do it with as little as a lead fishing weight a catapult and thin monofiliment fishing line which you fire over the top then pull over thickish cheap polyprop rope to then pull up lengths of old chain or steel rope. When the chain gets to bridge two cables then there will be fireworks and circuit breakers will trip. Back when the PIRA were doing their “mainland gigs” back in the 1980s this was one of the attack scenarios that most worried Maggie Thatcher’s advisors after bombs under man hole covers. Which had it’s own fasical side, they decided that tack welding man hole covers down was the solution, but… The only qualified people available to do it just happened to be mainly Irish…

The simple thing is all infrastructure is vulnerable and is often poorly maintained. Have a look at California where a gas company has let millions of cubic meters of methane escape which is a major “green house gas” disaster. They are basicaly saying that they are going to fiddle the restitution they have agreed to do –to avoid potential prosecution–, so it does not cost them to much…

At the end of the day if you want infrastructure security your biggest threat is and will remain the free market and it’s share holders. It needs not “light touch regulation” but serious legislation with serious consequences for not just directors but share holders, jail time and bankruptcy and life disbarrment from any kind of office should be what they face for even minor infringments.

Draconian sounding, but it’s part of the price you have to pay to get infrastructure security with the current corporate ethos.

Clive Robinson • April 10, 2016 4:51 PM

@ Moz,

Could you provide a citation/link for that please

Look into Duncan Campbell’s investigation of the UK Operation Ore, which resulted from mainly false evidence provided by the FBI from their Operation Avalanche into the Adult Porn Gateway run by Lanslide.

Basicaly the FBI supplied evidence that the Landslide front page had a link for child porn and a mockup page demonstrating it which was shown to judges. As Duncan Campbell found out it did not nor did it ever. The only link that could be found was in an advert within an affiliates page deep down in the site. Further two LEOs provided sworn testimony that it was on the front page which means that in all probability they had purjured themselves.

You can find the LEOs names on the Wiki page for operation Avalanche and you can follow various links to get other information.

Clive Robinson • April 11, 2016 2:25 AM

@ Dirk Praet, albert, Gerard van Vooren, Thomas_H and all other EU readers.

Electrabel/GDF-Suez played it really dirty by refusing to invest in new power plants and alternative technologies, instead hanging on to cheap…

In the UK we are in the process of shutting down 9GW of “coal fired” capacity with no replacment. The UK Government wanted to build new nukes twenty years ago but the process was drawn out by bureaucracy etc much of which was caused by Maggie Thatcher “deregulating the energy market” back in the 80’s. A big chunk of which became under the control of a French Government shared/run organisation called “EDF” in the UK, for which there is clear evidence they illegaly –under EU regulation– cross subsidize the French consumers.

Well after a series of dirty tactics which I won’t bother to list because it would take forever to type in. The bids to build the new nuclear stations fell to EDF and with Chinese money. They wanted and got a massive “sweethart deal” with guarentees that they would get a significant multiple of base unit pricing… And just a few weeks ago EDF decided to pull out of the deal as it was to risky for the French… But importantly not long after the UK changed it’s biding process for “feed in” at high usage times (ie when the wind is not blowing, the sky is cloudy and we are at slack tide etc).

So in the UK we are now looking around for new emergancy supply… Which will fall to old inefficient and therefor cheap inefficient and potentialy dangerous gas stations and killer Diesel plant which may well double the UK’s current 40,000 early deaths each year caused by diesel combustion products…

The question then is where the feed stock of gas and oil comes from, which means the UK is going to become a hostage to another probably unfriendly Government. But of course there are the underlying issues of the EU energy market to consider that would realy bite very hard if the UK left the EU via Brexit.

All of this is not helped by the UK Chancellor “white lines” George “Gidiot” Osbourn who has a “Madam Butterfly” complex and want’s to sell as much of the UK as possible to China…(a real life Manchurian Candidate perhaps?). Oh his supposed “Coke” habit has even been joked about in Parliment when it was live broadcast for the recent budget debate. Gidiot has decided that “sugar laiden fizzy drinks” such as a well known brand of cola are the main cause of obease children. So he has only singled out the fizzy drinks companies for his new “sugar tax”[1]. It prompted one MP to ask the smug looking Gidiot during the budget debate if the “new sugar tax would help the Chancellor curb his own coke habit”… He was, not as smug looking and the broadcast director quickly switched to a different camera, where unfortunatly was an over head shot of the government front benches, where Theresa May was sitting leaning forward with a very low cut red top and those watching were treated to a view that will haunt many of us for years to come… Now I appreciate this might be TMI but to use another Americanism “Naaastee”.

[1] There may be another reason for “only fizzy drinks” but it would take to long to go through. Anyway as it currently is the “sugar tax” will not make fat people slim.

Clive Robinson • April 11, 2016 4:21 AM

@ Figureitout,

RE: emacs on android
–Doesn’t it have a bunch of hot keys? How would that work…

I’m not entirely sure, but those who have done it have loaded a “programmers keyboard” or use a BT external keyboard (I’ve a roll up rubber one that I sometimes use with this phone and a stand for the phone, okay on a flat surface like a pull down table but not when “strap hanging” which I do rather more of).

The basic Termux keyboard uses the volume control if you push it down and press a letter it gives you the ctrl equivalent, push it up and it gives other missing keys like Tab etc. As I’m left handed I can do this easily with my right thumb on a phone, but it would be a pain on some larger devices.

On chatting with my son he’s decided it’s a good idea and put Termux on his phone last night, along with nano and python (for doing school work at lunch break etc, as you can not get on the library computers). I’ll keep an eye on how he progresses with it.

Which if it works well might persuade me to “upgrade” this phone for a new one.

As I said I’m an Old Timer, with not only the whiskers to prove if but a fondness for WordStar and still use it on an 8086 640K RAM two floppy –lugable– portable computer. Also on several other very old 486 systems I use as multi serial port terminals with development boards (the term program has a built in editor that uses the WordStar keying). Did you ever use Borlands SideKick or AutoDesq DesqView, they could do task switching. SideKick was a Terminate and Stay Resident (TSR) PIM which could keep several tasks in memory on a 486, DesqView could also “swap” to disk. I ended up writing my own task switching and swapping TSR to take advantage of “extended paged memory”, and it still shuffels along to this day (though I never did get IPC memory pipes working). I won’t say “Happy days” but it did give me a lot of extra productivity.

Although I can and do use it I never liked vi (OK so flame me already 😉 prefering to use sed/ed (for that real old “KSR” TTY teleprinter experience, not that “new fangled” CLI experience).

My VGA terminal usage habit in *nix has caused comment/anoyance in younger –ie most– colleagues who want IDEs and multiple Xterms on a desktop where they can see them.

As for working at one place back when 486’s and MessDross and Windoze were the engineering mainstay, and the emulator board head end software wanted MS-DOS all to it’s self, engineers would end up with three or four PCs on their bench and fighting each other to get another one when not doing the sneekernet thing… When the place got burgled and nearly all the computers stolen, they were quite supprised when I brought in a 486 with an IEEE controler, eight port serial card and Unix with DosMerge from my “home lab” and sat there using six emulator boards a printer, a plotter and VT220 terminal, pulling up scope traces etc from the commfort of my desk or work bench and importantly not getting back ache from working on several keyboards and VGA displays all at different hights… I heard both the “Real Men don’t…” and “Snot Fair” comments from envious colleagues, who had slipping project dead lines, even though I had brought in a couple of other computers to help fill the emergancy gap caused by the theft…

Clive Robinson • April 11, 2016 3:19 PM

@ r,

PIM…?

Personal Information Manager.

Borland SideKick was rather more than just a task switcher, it also loaded in a calander, address book, diary and meeting schedular and note taking at the touch of the right key combination. And a few more things besides if my jaded old memory serves (if not it’s bound to be on Wiki somewhere).

Clive Robinson • April 12, 2016 9:22 AM

@ Dan,

It probably wouldn’t protect against fingerprinting. To stop fingerprinting, you would need some kind of browser plugin that stops the sending of information that isn’t absolutely necessary

I Think you and I are talking slightly at cross purposes.

I was talking about an Application running on the computer, not a webbrowser, which As you note can be fingerprinted from within due to javascript pulling information from various sources, many which are due to browser functionality (cookies, fonts, lastpage etc etc) not hardware functionality or OS supplied info.

But it does point out that fingerprinting occurrs at all levels of the computing stack.

Clive Robinson • April 12, 2016 11:59 AM

@ Dan,

As @Figureitout has poinyed out,

there was a thread here awhile back, where it was said that electrically frying a chip, still retained data

Trying to zap/fry a chip on it’s pins does not work. The basic reason is the contact pad on the chip in effect has two high current diodes to either power supply rail to act as ESD protection. Not only do these turn on in fractions of a pico second thus clamping any transient to within 0.7V of the rail protecting the internal circuit, the clamping effect causes the IR heating effect to fall into the bonding wires between the chip and the package. Thus the bond wires blow faster than even the best of “fast blow” non explosive assisted fuses.

But there is another issue with chips to consider and it even effects RAM, it is a form of “burn in” where even is erased the longterm storage of a value leaves a trace that can be measured.

Thus to protect secrets you are looking to use battery backed up a nanopower CPU and RAM. The CPU moves the “secret” aroind in RAM after it has encrypyed it, with an encryption key that changes from the likes of a TRNG. The simplest way to think about it would be a stream cipher using a card shuffling algorithm where by each XOR is done with the XOR of the old Encryption key and the new encryption key, thus simultaniously decrypting and reencrypting the secret without it ever being in plaintext form in RAM storage.

Obviously this combination of CPU and RAM needs to be made physically tamper proof and needs foolproof triger inputs.

All of this has been discussed on this blog a long time ago, including the use of Thermite to cause the packaging and the chip it holds to be brought above the temprature of molten iron and remain that way for several minutes. As this can cause an explosion as the package gasifies a more modern method uses a tiny anvil and explosion driven hammer to shatter the chip to dust.

Such are the joys of protecting secrets in electronic storage.

Clive Robinson • April 12, 2016 5:54 PM

@ CallMeLate…,

Thermite is stable and not easily ignited. But once it ignites, you don’t want to be near it. Bucket of water? Hose? Fire extinguisher? Forget it!

You are talking of aluminium and iron oxide thermite, as is used for “rail welding” and the like. But there are other mixtures…

uminium and red lead oxide is another thermite mix, and if you worked in a paint shop realy fine powder aluminium and red lead was not difficult to get hold of.

Now there is a third chemical you can get quite easily which is Ferric Chloride and it’s used for amongst other things etching copper clad board (PCBs).

What most people dont know is that a mixture of aluminium and ferric chloride when dry is sort of stable, however add even a small amount of water and you get the start of a very exothermic reaction.

Mix the three chemicals together in varying proportions such that you go from the ideal thermite combination into the ideal exothermic mixture, and you end up with a thermitr mix that can be started with just a little water.

Further few people realise that aluminium bar will burn and once started is almost as difficult to put out (a large pile of sand works if you don’t mind having a lump of glassy like substance in the middle). So if you drill out a large bar of aluminium and add the above mixture you can end up with a very serious aluminium fire on your hands with just a very very small amount of water as I discovered.

All good fun as a young teenager, but it could have had very serious consequences.

As I’ve mentioned in the past thermite is not an explosive, that is it does not have rapidly expanding gases. However a steel high preasure bottle of propane gas with a suitably aranged thermite charge will heat the propane to a very high temprature before the steel bottle fails, at which point you end up with a Boiling Liquid Expanding Vapour Explosion (BLEVE) which you could call “a poor man’s FAE”. If you search Utube you will find examples of BLEVE’s and slow motion FAE’s so you can compare them.

The difference is that a BLEVE only burns at the surface of the expanding vapour which is well below the speed of sound, an FAE however uses a primer charge to mix the Fuel and Air to approximately the right combustion mix prior to ignition to obtain maximum brisance, thus the cloud ignites super or hyper sonicaly producing a very pronounced over preasure wave causing even more rapid burning at the shock wave interface due to density changes. As some experiments have shown, it’s possible to make FAE’s with shockwaves similar to that you get from tactical nukes…

Clive Robinson • April 14, 2016 3:44 AM

Journalist accused of hacking under CFAA gets two years.

The journalist Matthew Keys has been found guilty under the 1986 ludicrously prosecutor friendly CFAA and sentenced to two years. He and his lawyer are appealing.

http://techcrunch.com/2016/04/13/matthew-keys-sentenced-under-cfaa/?ncid=rss

Clive Robinson • April 15, 2016 7:01 PM

@ Wael,

Me: Fine! Explain to me how “something” can come out of “nothing”?

I Said,

My use of “if you accept” I would have thought is a clear indicator I do not believe “you can get something from nothing”

Additionaly,

I would have thought reinforced the point I don’t believe “you can get something from nothing”…

I went on to say how others tried to get around this issue by either putting some kind of bound around it by saying you can not reach back beyond a certain point, or by saying you get a positive and a negative of equal magnitude where some tiny fraction –our universe– has so far escaped being sumed back to zero for some reason (unstated).

Thus they have given themselves a get out clause, I however have not given myself one because I see no validation for them.

Thus whether I like it or not I have limited myself to an eternal continuum or our current understanding of the way “nature” works is wrong. Of the two the latter seems to be the more likely. Because as the old saw has it “Natural Philosophy is a series of lies, each more accurate than it’s predecessor”.

That said, as it should be clear I don’t believe in $DEITIES, I see no reason for them[1], except as “lies to children” that are used to hide the fact we adults don’t have all the answers, thus lose face over “why are we here” type questions.

Which appears to cause you an issue when you say,

You applied this eternal attribute to the wrong entity! The creator is the one who possesses this characteristic.

That is you have in no way established a need for a “creator” eternal or otherwise.

All I’ve talked about is “causes” and their “effects” and pointed out if there is an identifiable effect logically there must have been a “cause”. Further I’ve also pointed out that in all probability there is a “negative cause” or “inhibitor” otherwise we would have perpetual motion etc and our universe would not be as we know it.

I do not ascribe any kind of need for an entity intelligent or otherwise with a consciousness to bring about either type of “cause”. That is I see no need for “intelligent design” or a creator, as there is no proof that one is needed. All I indicate is that there needs to be something that can have a change of state, that is there can not be “nothing”. I don’t even require the something to have a physical state as we understand it just that there is something.

As an outfield comment for consideration, let’s assume that our tangible physical universe with it’s energy/matter constrained by forces and the speed of light, is in fact a subset of an intangible information space in which physical universes can exist in parallel or sequentialy (ie Swiss Cheese or Sausage String models). Our universe could have come about because the interaction of information by some random process, which was the cause that created the initial unbounded “laws of nature” of our physical universe. Which in turn with the coalescing of matter/energy gave us the starting point for our bounded laws that need the forces and the limits of the speed of light and the passage of time to provide stability.

[1] I’ll leave out the explotative excuse of “Divine Right” used by those in the “King Game”, which needs the invention of a $DEITY to work to brook any kind of dissent from the masses.

Clive Robinson • August 18, 2016 11:16 PM

@ Wael,

Yes we do need to continue at some point in the near future.

Just not at the moment, I’m on my sick bed yet again and nearly ended up in hospital 🙁

I joke about getting a “Time Share” deal on a hospital bed, but the simple truth is being ill is a major disruption in life. Even simple things like “food shopping” become major logistical hurdles, and mind numbingly exhausting.

So I’m not at my best right now.