Schneier on Security

Nick P • April 27, 2016 9:00 PM

@ Ken

Good point. I’ve been working toward a solution to this problem. So, I’ll run two by you.

“Congress, what these laws ask for is to have a master key into every email, confidential letter, bank account, private home, economic secret, and so on in America. Currently, everyone handles the level of privacy and access differently. This makes things harder for both criminals and law enforcement to access their stuff without permission or notification. However, the master key would put all of that access in one place in one organization using one method. It would be like Fort Knox except a digital version of gold can be moved untraceably from any location on Earth and often without physical access. That data can be copied while leaving original intact means it would look like all the gold was untouched. All American’s information that spies and crooks find useful all in one vault to be robbed all at once by the first person that gets in.

So, how likely is that scenario? I’ve submitted government reports indicating that neither the largest corporate teams nor the likes of NSA can keep their secrets safe from hackers. Many Fortune 100 companies and defense contractors had their I.P. stolen using straight-forward attacks by hackers. These sometimes didn’t get noticed for months to years. The government has had similar problems. Even worse, the government has been unable to identify who to trust on the inside with devastating leaks: Afghanistan and Iraq war records; all State Dept cables, including many damaging diplomacy; most significant NSA operations to spy on foreigners and Americans down to names, locations, and tech involved; personnel files of everyone with a clearance and likely access to secrets like these along with 10 years worth of blackmail material to use against them. The U.S. law enforcement and intelligence agencies, along with big business, have repeatedly failed at protecting small amounts of secrets to the point their whole mission and personnel were at risk. They are not up to protecting all secrets all the time.

Further, I’ll add that I’m from the sub-field of security that aims to stop strongest attacks. Decades of work in this field has worked wonders on many aspects of the problem. Yet, since our field is relatively new, bright researchers and criminals alike discover new ways to attack systems each year. Worse, the security restrictions on systems like we contemplate means it might be hard to update them to counter attacks moving fast. The worst part, though, is what we’d be facing when we put all our golden eggs in one basket we shake at criminals and spies: every intelligence agency, organized crime, and hacking group on Earth will all target that one organization. Even high-security occasionally falls to attackers with business and government being thoroughly compromised by relatively low-skilled attackers. If they can’t take a few, how will they protect you and I’s secrets from all of them at once throwing all their brains at hacking one target?

The answer is they can’t. They won’t. They’ll fail with disasterous consequences across every political and industry sector. So, it’s best to never give them the chance. Let everyone be responsible for their own security with law enforcement simply using court-issued warrants to search or seize what they need and justify to a judge. This has worked for a few hundred years. It should work for at least a few decades more while we research answers to these security problems that are currently impossible to address.”

So, how you like that? Kind of off the top of my head and not revised. Feedback welcome.

Nick P • April 29, 2016 1:31 PM

@ Clive

“And though many of those rules are not required for computerised accounting / operation, they remain in place automated across computer systems. Thus they sit there like hiden tripwires for the unwary. ”

That’s a VERY IMPORTANT point I forgot to bring up. The legacy systems in banks have this both in just how the software works and in its security controls. They aren’t documented in a way where you can see them at the interface level. The knowledge of how to avoid tripping them is usually taught on the job as just a part of using the system effectively. Others aren’t taught at all as security team hides them. This is essentially a grand obfuscation of whole organization’s operation. History shows it’s defeatable by pro’s especially that embed into the organization. Amateurs are easily caught or don’t go near it.

“All in some strange CLI applications runing on a near unknown OS (VMS) on hardware that is effectivly unavailable for research.”

This is a point I made and keep making but the hardware part is worth elaborating on. The VMS, AS/400, and so on systems that many banks used start at tens of thousands of dollars. Getting the used ones working without support is a chore in itself. Mainframes from various vendors are leased for enough to buy a new house or mansion a year. The common, destructive hackers that learn by tinkering simply can’t afford to acquire one to tinker with and especially take risks that might brick it. So, use of such systems is quite a barrier to entry.

There is some possibility for change now that IBM and others are leasing mainframes that are inexpensive to get more people using it and developing for it. That started with the z9 mainframe for businesses that was around $100k. They have a z10 for Linux apps that’s around $50k but idk if it runs z/OS. This 18yr old bought a z890. Unisys, which owns Burroughs legacy systems, created MCP Express for people to learn MCP on a PC. That they moved their systems to x86 should increase MCP’s attack surface nicely over the 1961 models. 🙂 The price is still a barrier to entry with cheapest $325k or $900k depending on which is the MCP one. Can’t recall off top of head. Other significant ones are Bull’s, Unisys’s other OS, Fujitsu’s, and Russia’s Elbrus mainframes. Idk their status aside from Unisys’s in six digit of course.

Note: I think it’s worth revisiting this topic sometime in FOSS vs proprietary for security as proprietary’s “disadvantage” of acquisition cost is an “advantage” here in INFOSEC against many threat models.

Nick P • April 29, 2016 7:57 PM

@ Anon10

So what? There were rules against trading mortgages they didn’t own, not securing ACH, money laundering, and tax avoidance. Big banks have been caught doing all of these with only one resulting in huge fines. Which came out of taxpayer bailout.

You should do some research on banking industry corruption and bullshit from first-hand, high-level sources. It seems like yiur jaw would stay dropped whole time given you so far believe banks comply with all laws of US or always get caught when they don’t. Especially look up Goldman Sachs who just have government write new laws making schemes legal.

Note: Also look up who shutdown Wikileaks during their peak after many hackers, governments, spies, and private parties failed to. They then threatened one of America’s “Owners.” Response was swift, surgical execution of their organization by that sector’s elites.

Nick P • April 29, 2016 11:41 PM

@ Anon10

“but they make MITM attacks trivial, which can give them access to your financial accounts, e-mail, social networking, and anything on the cloud.”

trivial was the key word. Apparently, they aren’t trivial. They’re hard enough to require either going around them or a confidential way to pretend you didn’t hack them. Most likely, they subverted a bunch then use alternative methods for option B. In any case, it’s anything but trivial unless the CA isn’t worth a shit. Subversion is most likely with members of HSM vendors working with culprits. Narrows problem space quite a bit while HSM vendors get little attention from mainstream.

Nick P • April 30, 2016 1:16 PM

@ Anon10

Thanks for the link. Even if I take it off my list, we still have the anonymous data collected from banks themselves in other one saying half of them have been hit with cybercrime and two thirds with internal attacks. Reports like that, including Verizon’s data breach report, say they also underreport breach damage by marking them as a cost instead of a loss from fraud. That’s what bankers I know told me as well. Doesn’t that contradict the overall claim that U.S. banks are safe from hackers and/or internal threats like spies? Do we really need more data past their own admission that 2/3 got compromised in a single year?

Also, I have first-hand experience in these issues outside of what bankers and pentesters that work for them tell me. A Fortune 100 company outside of banking I worked for did the same shit despite SEC regulations, etc. They bought a solution for, what I was told, was about $300 million across the whole company. I know it had to be at least $50mil for equipment alone. It didn’t work at all & actually disrupted operations anytime it was used. They were fooled by a referral from another huge company that publicly labeled it as an expensive, but successful, investment to save face. Guess what my employer did? The same, fucking thing. The annual report mentions high costs that year while talking about strategic investments for growth. Investors assumed that’s where money went. They also mention the system as one of their successful initiatives. To this day, they still invest millions a year in maintaining and expanding it. It still doesn’t work and any employee will tell you they ignore it in favor of manual alternatives unless their bosses are watching them.

This sort of thing isn’t an exception: it’s the rule among big companies whose CEO’s and such want to maintain their image. They cover the hacks and other big failures where-ever possible. They will never make the sacrifices necessary for a true, high-security operation. You can’t have IBM mainframes, Windows NT servers, or web access for that as nearly every product in existence failed security analysis or pentesting. The 0-days & misconfigurations are there waiting to be found. Survey data and security services (eg Verizon) reports indicates they’re being hit constantly. Yet, only a handful of damaging reports make it into the news each year. Kind of strange inconsistency, eh? 😉

Nick P • May 6, 2016 10:12 PM

@ Anon10

If cybercriminals haven’t compromised Verisign’s private key or certificate creation process, it’s because there’s not a cybercriminal in the world with the ability to do so.”

People used go tell me the same thing about the NSA compromising thousands of computers and subverting dozens of products. There wasn’t public evidence of it. So, it wasn’t happening. Despite my models saying certain outcomes were likely due to the nature of target and attackers. We saw who came out right then.

I have no idea whether a specific CA is compromised or not. I just know individual techs theg depend on have historically been beaten inexpensively. And many others with stacks of defenses lost TB of data without knowing it. So, what trust level to put into Verisign’s stack of defenses? Higher than many maybe? (Shrugs)