Schneier on Security

Clive Robinson • June 13, 2016 1:45 PM

@ Blake,

My fingers are to big to play “kind hearts and roses” 😉

Clive Robinson • June 13, 2016 6:07 PM

@ Jesse Thompson,

Print it off and then scan it again?

Yes it sounds mad, but the important thing is you don’t send anything you can not see, to a potential enemy. Of which there are three you have to think about, journalists/researchers who get the files from a crackers exfiltration of what ever they can get, then those who work on the legal side for prosecutors and plaintiffs / claiments, who get judges to issue warrants and orders.

The lawyers and the judges they use have a new(ish) game which is called “electronic discovery”. Normally going through a million pieces of paper, demands resources that “beggers them” so prosecution or plaintiff / claiment lawyers used to keep discovery requests down to what they could handle within the constraints of time and manpower.

Now however with all those juicy electronic records they pull them over sight unseen and get some geek to build a “mini-google” and then go hunting. Importantly they never realy sit down and read all those files just the ones they think have usefull information that they search out. Thus it is their searches that are the key to thier success or failure, and those searches depend on the index they have to use.

But you need to realise that they have two places they can hunt with electronic files. Firstly the actual data which you see in printed form. Secondly and worth many times more the normally invisable meta data. And it’s that meta data that will sink you faster than the Titanic if they get the opportunity to use it.

So your game plan is always to deny your attackers anything at your expense, or that which will be at your expense if they can turn it into a rod for your back.

So fine if they get a judge to sign off access to your “electronic records” give them “images not words” and “disorder not order”. There is as far as I’m aware no law to make you keep anything other than financial records in specific forms.

Howerver there is a myth that has been put around by electronic data systems suppliers that there is a lot of “hidden value” in company records, if you use their systems to get at them all… The reality for most documents, is they have little or no real value unless something goes wrong, then they become either “public” from crackers exfiltration or evidence if a judge inks the paperwork.

The thing about evidence is it’s usually time sensitive as there is a clock running when someone starts legal action. Thus like crypto you want electronic records to work easily for you but not for attackers. Thus a well indexed set of apparently random ordered files in file cabinates works for you as the key to using them is the index. However those random ordered files do not work for someone else if they have to take tonnes of copies build files and then build an index to them. That is if they don’t have time to build the files and index your attackers searching will normally be minimal, and swamping defendents with such stuff at the last possible minute is a technique prosecutors still like to use in the armoury of “Rights Stripping”.

So your mission likewise is to deny an attacker access to the index and anything better than paper. An electronic image of a page as a single graphic is arguably of less use than when printed, because you can not see it and if you do it right nor can the OCR software either[1][2].

I won’t go into exact methods but if the OCR does not work, then it’s back to “periwinkle time” and lots and lots of human resources burning the candle not just at both ends but the middle as well, as they start the journy down the rabbit hole that can lead to “The Stressvile Funny Farm Sanctuary and Care Home”.

If the opposing lawyers get the court to give them more time, then that is often in your favour as well.

As with all such games it’s best to be ahead of the game so you do not get wrong footed like Microsoft and other organisations. After all think how much less damaging for SPE it would have been if those supposed attackers that stole and released all those company emails had not had them in easily searchable form…

[1] For OCR software to work well it needs nice crisp clear letters preferably in certain types of font that have the image equivalent of a large “Hamming Distance” such that errors can be detected easily and correctly corrected. Font’s that are soft curves and have almost random angles whilst still being human readable are much much harder for OCR software. But it’s not just the individual letters. If you remember back to “digital watermarking” in the late 1990s it hid information in “image noise” via the equivalent of Spread Spectrum techniques. For around two years a battleground ensued with regular skirmishes where various techniques used to beat other techniques each holding tempory ground. Then Ross J. Andersons group at the UK Cambridge labs came up with a distortion method in three dimensons that humans did not realy notice but DRM systems totaly barfed on. It won the battle and Digital Watermarking became a bit of a back water. Well OCR does not like documents distorted in that way any more than the watermarking schemes did.

[2] One of the complaints you hear from people is why the documents in the Ed Snowden trove are trickling out so slowly. Well part of the answer is that even though they were said to be well indexed from one asspect, you still have to read them in great detail and cross refrence to get all of the pertinent doccuments for a given story line lined up in the right way.

Clive Robinson • June 14, 2016 4:33 AM

@ Hmmmm,

I’m having a hard time imagining that…

What the difference between,

1, searching using a computer with simple scripts through a sequential ordered collection of textfiles with useful metadata attached.

2, manually looking through thousands of randomly ordered image files because OCR does not work on them nor do they have usable metadata attached?