Schneier on Security

Clive Robinson • November 27, 2016 7:36 PM

@ The usual suspects,

A little more gristle to chew upon,

https://existentialtype.wordpress.com/2011/03/27/the-holy-trinity/

The trinity is Logic, Languages and Categories.

Clive Robinson • November 29, 2016 3:35 AM

MS Win10 upgrade PrivEsc built in

In news that will be unsuprising to those who have been around a while[1], Microsoft have blown a huge hole in Win10 security including bitlocker.

http://blog.win-fu.com/2016/11/every-windows-10-in-place-upgrade-is.html

It would appear that MS Win10 “in-place” upgrade not only alows a user to easily Privilege Escalate up to System, but it also usefully from an attackers point of view turns off bitlocker…

Just what all the kiddies will want to know for Xmass…

[1] This is almost as good as the time Microsoft had a quick and easy local Privilege Escalation attack to god using it’s version of the *nix cron utility, years after cron had fallen foul of the same issue. For some reason Microsoft have a habit of “copying others but not learning from their mistakes”. Or as was once put “Those who fail to learn histories lessons, are usually cursed to relive them”.

Clive Robinson • November 29, 2016 4:29 AM

The joys of unpublihing eMedia

Once upon a time, publishing involved paper ink and a degree of permanence that thousands of paper copies brought, thus such sage words as “The thought once writ large can not be unsaid” were considered by editors seriously.

Well technology changes all that, and it would appear encorages a little “free enterprise” largesse for editors.

It has been reported that a senior Chinese representative of a well known Chinese “communications” company –the US has accused of being a security risk– got himself “fueled up” and went for a spin in his BMW and took out a number of other vehicles on the road… Big news you would think? It was untill mysteriously the story started to disappear,

https://www.cambodiadaily.com/news/huawei-boss-crashes-news-stories-disappear-121165/

Thus it would appear that if you “splash the cash” you can make the written words of others about your actions as ephemeral as the sound of that tree falling in a distant forest.

I wonder if such largesse is covered by US anti-coruption / bribary legislation…

Clive Robinson • November 29, 2016 6:24 PM

@ Freezing,

There are still some nice 32-bit OS`s that can be run from a live CD. I would recommend Puppy Linux.

Agreed, but the problem is that they rarely make it onto the front of computer magazines where as these days 64bit Live CD ISO’s do.

Thus you have the problem of your download being intercepted by the likes of the NSA / GCHQ et al, if they consider you “a person of interest”. Like all MITM attacks the problem arises because you do not have a sufficiently reliable side channel to be able to verify what you are receiving from your Internet gateway is tamper free.

Magazine front cover disks gave you a degree of asurance, because you could go to any number of newsagents or shops thus if you went at random all the IC entities could do was either intercept the disk after you had purchased it, or backdoor every cover disk. The former would on the face of it be difficult, the latter at high risk of discovery. Thus there is a reasonable probability the contents of the magazine cover disk are as the distribution authors issued it, unlike a “home download” by a person of interest.

Clive Robinson • November 30, 2016 8:16 AM

@ Clippet,

Many distributions these days offer PGP verification of their ISOs. At least the more security conscious ones.

Yes they do, but without a secure authenticated side channel, how do you know what you are seeing is what they are telling you, or what somebody else has injrcted into your viewing/download stream?

By the way this is not a new issue, philosopers have endlessly, and still do debate a more fundemental version of the problem. Back in the 1800’s and earlier it was to most just an excercise in reasoning between philosophers, much like a chess game between two grand masters. However things changed in the 1900’s with medicine and more recently with real engineering problems that are at the root of much of the way a modern society works…

That is,

Our brains build up a world view based on the perceptions they receive from our bodies sensing organs. So how does our brain verify it’s world view is actuall, self delusional or staged by others? That is if the sensing organs are not working the way we think they do, or worse part of our brains are malfunctioning, or worse still we are in some kind of state where external entities we have no knowledge of are controlling the inputs to our sensing organs?

One example from medicine is when people have strokes, a part of the brain that deals with the ouput from the sense organs is impared. Thus if you ask the to draw a clockface they will leave parts of it out, because their brain due to the imparement effectively fills it in for the person, even though their hand has not drawn it. Another example from medicine is called “Phantom limb syndrome” where a person loses say a foot in an accident, the brain losses the sensory input and can effectivly “fill it in” thus the person may suffer a very anoying itch they have no way to scratch or in other physical ways elevate. Then there is the apparently harmless “seeing things in clouds” you might think you see a face, others might see kittens playing. Most of us do not think any further on this, but some have and we end up with “optical illusions” that by manipulating the sensory input makes our brains see something that is not actually there or see it inacurately.

We think of such art as fun tricks, but what about camouflage used in warfare, it uses a similar principle. But how about those advertising illusions, where the advert is painted on the pitch in such a way that when seen from the fixed position of a television camera it looks like it is standing up in the pitch? Have you ever thought what might happen if somebody painted something similar onto a large canvas or tarpaulin and put it on a road in the dark, such that someone coming around a corner gets tricked into thinking there is a large animal or maybe a child standing in the road? Would their brain say “illusion drive on” or cause them to swerve and come of the road and maybe crash?

This latter problem is one that is causing issues with A.I. Systems for driverless cars etc. But prior to this driverless trains and aircraft auto pilots. Aircraft have crashed because incorrect information arives at the computer input of the auto pilot, it treats it as real and responds and the aircraft goes outside it’s flight parameters… The same has happened with real pilots flying on instruments, somehow “pilot error” sounds more comforting and more like an “accident” than “computer error”.

In computer security we have the same problem, if I can control your computers view of the world then like the cockpit instruments it will change your view of the world and I can get you to do something you would not otherwise do, and your computer security crashes and burns.

To reduce or eliminate this you need other viewpoints I don’t or can not control. The problem is that often we invest certain security measures with incorrect meaning. One such is “code signing” I have pointed out the various flaws in it for years, and it was only sometime later with Stuxnet some people came to realise what I had been saying was unfortunately true.

I can sign my code, but what does it realy mean? Overly simply it means someone applied a large integer via modular arithmetic etc to a file or files and published the result and another couple of integers at some point in time.

That’s all nothing more… It says nothing about who used the integer, the quality of the code or actually the point in time… In effect it’s an illusion in which you are investing not just your trust but your safety as well by your assumptions, without being able to verify any of the assumptions…

Does that sound wise?

Possibly not, but with a side channel I can not control you have the potential to get a second viewpoint I can not effect. Thus you may be able to verify or refute those assumptions and discover that your computers viewpoint is incorrect and has somehow been manipulated.

What Stuxnet should have taught people is that integers are niether unique or uncopyable, thus others can use them to sign code. It should also have told people that code signing says nothing about the code that has been signed, or the security of the entire process. Further it should have rung loud alarm bells about the dangers of the assumptions surounding a single virwpoint or channel to signed code at the resulting integer.

Unfortunately the attitude was “Well it’s the only option we’ve got”, rather than “How do we improve what we have?”. One way would be honest with people and say “Go get other points of view from uncorrelated places and systems, and try to verify not blindly trust”… But for most it’s not a message they want to hear.

Clive Robinson • November 30, 2016 1:53 PM

@ ab praeceptis, Nick P,

Most importantly, though, I’m driven by the question “*can* Unix be made secure?”

Simple answer short, Yes and No.

Unix in it’s various flavours has continued to evolve, and security has received a lot of attention, more so than MS and Apple products.

The problem is that good old Achilles heal that has blighted Microsoft and it’s called “backwards compatability”. In Unix’s case it’s more a human than technological “hold back”. All those admins you mention.have a notion of “the one true unix” which boils down to the lowest common denominator of the available security features set. The three biggies being the superuser, file permissions and file tree assumptions.

All three can be changed or augmented but there is the “something will break” argument pops up every time you suggest making things more secure.

One “joke on everyone” is that because many *nix’s like FreeBSD are Open Source without any real licence preconditions. Thus, academics and others are free to make changes or augment them and they do frequently when prototyping security systems. Including advanced Capability hardware security features (Cheri on top anyone?).

So, “Yes” you can make a *nix as secure as you want including real serious hardware security support, but then, to most it would not be Unix –as they understand it– anymore, so “No”.

Clive Robinson • December 1, 2016 5:48 AM

@ Anura, Methods,

Then the public can see whether or not anything is actually there.

The real problem is not actually “methods and sources” but “false flag operations and attribution”.

Traditional forensics generaly are not about discovery of an “unknown individual”, but linking a “suspected individual” to the event under investigation.

That is the investigating authorities frequently use non scientific methods –hunches, gut feelings, “the buttler did it”, etc– to produce a limited and flawed list of potential suspects. They then use “The old fashioned beat methods” to whittle down the list. Only then, if deemed financialy justifiable, taking the “evidence” for forensic tests, to try to link one –or more– of the suspects to the event.

This dire process often works out only because humans are creatures of habit, alibies imperfect, and –so called– physical trace or contact evidence difficult to prevent.

False flag operations are about “painting a picture” and as they say in the UK “putting somebody in the frame”. That is the objective of the attacker is not the “event” as it would be with more traditional criminals, but putting somebody else “in the frame” for the spotlight to fall on. This means that to the actual attacker the event is in effect irrelevant, any of hundreds of events will do, because the real objective of the false flag operation is to ensure the spotlight falls on the chosen “fall guy” entity, so even a “deaf dumb and blind investigator will be unable to miss them. So the attacker is free to pick and chose events that best suit their purpose. Thus for the attacker any convenient event, or events will do, which is where “circumstantial evidence” becomes very dangerous.

Part of the process of eliminating suspects off of a list where there are multiple events is to see who has contact no matter how tenuous with all the events, the first person to be shown to do so usually goes to “suspect #1 spot” and usually stays there unless the suspect can produce stronger contrary evidence. Which often is not possible because details of the case are kept away from the suspect untill it’s the shortest period possible before trial, which thus causes other issues for an entity defending themselves.

Thus you can see a trail of investagatory failure right from the start of the investigation. Not only are the investigators using non scientific methods, they’ve fallen into the trap of making assumptions based on the event(s). In miscarriage of just post mortem enquires –where innocent people have been punnished but subsequently found innocent– the common finding is that it all starts off with these assumption based mistakes and goes down hill from there. This is due to the inherent confirmation bias in “making the case”. That is the investigators concentrate on the wrong individual from the get go and spend their time trying to link the suspect rather than eliminate them, the longer the investigation takes the worse the bias becomes (the old “He has to be guilty I just have to prove it” grove).

But that is not the worst of it, because evidence suffers from entropy, corruption and polution, the longer it is between an event and the actuall evedentury examination the worse these problems. Thus the faint contrary indicator evidence starts to hit the noise floor quickly.

Further the attacker can now have hindsight work for them, if they can see or predict how the entity being framed trys to defend themselves, the attacker can then target such contrary evidence for destruction, further painting the suspect into the frame.

Now as a thought process ask yourself what happens when the false flag attacker and the investigator team are on the same side, but with the attacker effectively in a senior or overview position? They get to see much more than the the entity they are putting in the frame. Further they can selectively “report up the command chain”, thus the head of the chain gets partial misleading information, and any further downward enquires the attacker makes will cause the investigators to move all be it subconsciously in the attackers chosen direction…

In the past I’ve mentioned on this blog that “methods and sources” are neither omnipotent nor omnipresent. They are usually either a “key hole view” or a “high altitude view” by the very nature of the covertness of either the technical method or individual human source. Because of this and the fact you do not know if a false flag attacker knows about your methods and sources you make assumptions to paper over the gaps you can not see into. As I pointed out with some technical detail it’s possible for the attacker to use or create gaps to their advantage.

A simple example is, as an investigator I can see data enter a network node on one port and leave the data on a different port. Do I assume it’s just a routing node or do I try to see if it is more than that? If I don’t go with the easy assumption, how do I determin if the data is not being either stored at the node or copied out of another port I am unaware of?

The simple answer is I can not unless I effectively own the node and can see all it’s activities. But the answer is actually way more complicated than that assumption. I further have to consider the use of “Vampire Taps” and “data diodes” which conceal “instrumentation” from my view.

That is as a false flag attacker you know what physical port the data goes into the node and which physical port it goes out of the node. You can Vampire Tap and instrument either physical port and invisably to me “tee out” the data… My ability to detect your Vampire taps or data diodes that conceal your instrumentation is based on my ability to physically instrument the network ports for very subtle “tells”, that arise from the likes of cable impedence changes. To see what is involved in finding vampire taps and data diodes, look up “return loss bridges” and “Time Domain Reflectometry (TDR)… As you will find it’s both dificult to do, uses expensive equipment, and is very far from covert. TDR especially as it works on the same principle as a RADAR, and thus suffers the same failings of covertness that RADAR does.

I could go on but you should by now realise that as an attacker running a false flag attack you have most if not all the advantaged when faced with my normal flawed and limited investigatory procedures.

Thus atribution on a network system is not just difficult it’s inherently unreliable to the point of impossibility (ie proving a negative).

Clive Robinson • December 1, 2016 6:13 AM

@ Anon,

…or that climate change is happening because of CO2…

If not CO2 then what? “cattle farts/burps”?

Are you trying to suggest that some unspeccified group of people have raised a faux market to doubly profit out of the “Great American Steak Dinner”?

If you are going to say something anonymously, that conficts with what others have put their name to, then you have to prove your case, not wave vagueness in the air and expect it to be treated as credible, by others than those who are congenitaly gullible.

Clive Robinson • December 1, 2016 8:22 AM

It’s not Friday but…

For those who are eternally curious but need their sense of humor tickling,

https://library.sciencemadness.org/library/books/ignition.pdf

If the comparison of the first two photos or the intro by Issac Azimov do not make you think it is worth getting into further then you are in need of a curiosity transplant.

Clive Robinson • December 2, 2016 3:42 AM

@ Ratio,

If capital leads to bargaining power and bargaining power leads to capital, the only way of preventing private ownership of capital is to make sure that private individuals never have any bargaining power.

Err no that way leads to the likes of far right or far left politics, which history suggests more often than not will end very badly and violently.

The solution that has worked in the past and still works today is to limit the capital any individual entity can deploy to change the social good / harm balance. Which is why the very rich spend so much fighting it.

It’s called “taxation” and is usually deployed in a manner where the level of taxation effectivly increases as the level of capital an entity aquires increases.

It’s a subject the likes of “tea baggers” and those who describe themselves as libiterians get hot under the collar about because they unfortunatly don’t appear to have the mental capacity or will to go beyond learning and chanting slogans.

@ Anura,

You left out why the rich get richer, mechanism that causes the inequality, and it has a pronounced nonlinearity about it (much like compound interest).

Each social unit be it an individual, family or larger, has basic needs that have to be satisfied. Thus all income below a certain level is devoted to subsistance (often incorrectly mediated by the notion of the poverty line). As a social unit gets above a certain point they have what is refered to by many as “disposable income” as it implies they have a choice of what to do with it. The two broad choices are fritter or invest. Overly simply the purchase of goods or services that do not provide capital returns and thus devalue are the basis of frittering, buying goods or services that do provide capital returns is the basis of investing.

Providing the capital gain exceeds devaluation and other charges such as taxation the gain will grow as a power law.

As can be seen devaluation appears as a consideration in both fritter and invest. It is another mechanism by which the rich get rich and the poor get poorer. For some reason it gets an inverse name of “inflation” to try and make it sound like a good thing. However if you do not invest or invest incorrectly then it is a secondary hurt you suffer as the price of what are considered essentials to life just rise. History shows that for many the increasing price outstrips their ability to increase their income thus they slide backwards towards poverty or worse poverty.

I’m not going to go into the “economics” of inflation as a measure of growth in the economy, or as a driver for growth as it has some quite flawed fundemental assumptions underlying it. It is almost equivalent to saying,

It works on alternative wet Wednesdays in the third month of years where the second month has an excess day, providing the correct umbrella is carried on alternate dry Wednesdays in every tenth month.

Where the complex verbage hides the “get out clause” thus the rule can never be disproven as it’s always somebody elses fault when it fails, not the economists…

Clive Robinson • December 2, 2016 4:06 AM

@ Bruce, and the usuall suspects,

A nice and simple very fast attack on credit card systems.

It uses a “divide and conquer” technique to build the required daya for a credit card transaction field by field. Oh and does it in aproximately six seconds…

http://www.ncl.ac.uk/press/news/2016/12/cyberattack/

Clive Robinson • December 2, 2016 4:47 AM

@ Bruce, and the usuall suspects,

Did you Realy say that!!!

It would appear that Adobe are doing it again this time with sound rather than pictures…

http://motherboard.vice.com/read/after-20-minutes-of-listening-new-adobe-tool-can-make-you-say-anything

Note the “big laugh moment” in there where they mention “digital watermarking”. Anyone remember why DWM was a failure with photographs and the like?

I Guess Adobe either don’t or are hoping you don’t.

Clive Robinson • December 2, 2016 10:12 AM

Hmmm,

:%s/do have/do not have/
:%s/revelotion/revolution/

On my above.

Clive Robinson • December 2, 2016 3:41 PM

@ ab praeceptis, Gerard van Vooren,

“greenlets” are a pain, if you do not write your own async IO, one blocks and your whole userspace process hangs.

Whilst those who have got down and dirty with assembler and device driver code grok what needs to be done to “play nice” most code cutters have to learn the painfull way.

To a certain extent the Sun Green Team anticipated this –in their java user space thread library–, they over estimated the ability of the code cutters…

As for Garbage Collectors, it was pointed out to me many many moons ago that “BASIC needs GC because as Dijkstra has identified such (ab)users had been permanently tainted beyond redemtion”[1].

Again those who have had to get down and dirty with assembler on embedded microcontrolers with only 256bytes of RAM and a couple of registers to play with understand the managment of memory in a way few others ever do…

Such programers are very rarely the product of a graduate CompSci course, they tend to come from the hard science and engineering courses, where the undergrads have to build their own test equipment as an aside to their actual course/project work.

Much as I like Wirth’s work, his idea like that of the original Dartmouth BASIC developers was to provide an abstract environment that hid the real details of a computer away from students. I know that in all likelihood I will get howls from certain quaters but C was likewise designed to abstract away the real details of the underlying hardware for I/O etc. However the level of abstraction where memory was concerned was different –because of the linker– it needed a hardware MMU to give a virtual linear memory space to all but “down and dirty” IO bit bashers and kernel hackers. Other, stack based languages did not need an MMU just a sensible way to use base pointer indexed memory. People tend not to know that Forth was also it’s own operating system and with minor tweaks was comfortably multitasking in a Real Time way.

At the end of the day the push in languages has generaly been to abstract away any kind of real detail and cocoon programers in a safe and secure “play pen” environment where they don’t have to think about such detail. The downside is no play pen is 100% safe or secure, and when things do go wrong such coseted programmers often do not have a clue why, nor how to get out of the hole they find themselves in. Often this leads to “my best guess cludges” that more often than not hide other horrors to await the maintanence cycle.

For those that can and do get down and dirty, the abstractions and safety mechanisms are often not just something you can ignore but a real impediment to getting work done.

The example I usually quote is “pointers” to an assembly level programmer these are simply memory addresses to a piece of memory that is in effect “a bag of bits” container that the programmer knows how to use. To many C programmers pointers are a nightmare because of what the compiler does with data types (abstracted containers) and thus the hidden pointer arithmetic.

I must admit my usual answer when someone presents me with a pointer arithmetic issue is to tell them to “cast to void then come back and talk to me”… For some reason I tend not to see them come back 😉

[1] The actual Edsger Dijkstra quote has been recorded for posterity as,

It is practically impossible to teach good programming to students that have had a prior exposure to BASIC, as potential programmers they are mentally mutilated beyond hope of regeneration.

Clive Robinson • December 3, 2016 2:28 AM

@ Ratio,

I hope I at least finally got my point across.

Oh which one, your affinity for “reductio ad absurdum” as the phrase originaly ment?

Clive Robinson • December 8, 2016 2:02 AM

@ Serious about Circuses?,

Our infrastructure will be built by more than one paranoid person living in a faraday cage

More than you think work in faraday cages developing the communications equipment the next few generations of the internet will use (it’s a legal requirment not paranoia).

Speaking from experience working in a faraday cage can be oh so much more peaceful than the standard cubical, all you have to do is remember to “schedule a meeting with yourself in the calender”. It’s actually better than having your own office as people tend to take the “Do Not Enter” notice way more seriously than a shut office door.

But a serious question how do you as an untrained person tell the difference between “paranoia” and “security”? I’ve worked in environments where the security was way beyond that a diagnosed paranoid would dream up and repeatedly tested…

Oh and that idea of the “mad professor” type inventing in a secret lab… It’s actually a requirment in most countries to take measures to protect your design with secrecy to actually get a patent…

When people actually take the time to look, they find the difference between a castle and a prison is often just a mater of viewpoint as with many a guilded cage.

Clive Robinson • December 8, 2016 4:12 AM

@ Wael,

You worked in an asylum, too! Cool! But I gotta tell you, it’s a bit*h to work in straitjackets.

Hmm the “too!” says rather more about you than it does the places I’ve worked. Though occasionally seen as “mad houses” they were not officially –at least– “asylums”.

As for “straitjackets” do you mean the articals of clothing, or the ones of “uniforms” at every door with guns and itchy fingers?

The former can be seen as “relaxing” where as the later never can if you know anything about mechanics and authoritarian followers that lack the imagination to be anything other than “the mechanism of the machine”. It’s why I talk about “Directing minds” not the “tools” they use as cut outs.