Schneier on Security

Clive Robinson • November 28, 2016 9:12 PM

@ Bruce,

I believe we are going to see the downside of our headlong rush to put everything on the Internet.

I agree, but it’s not the whole problem, the “Internet” is made of “internets” which in turn are made of smaller “intranets”. Which IoT etc devices are connected to, many of which have out of date insecure OS’s and applications.

I had a reminder of this just a day or so ago. There is a brand spanking new supermarket just round the corner from a place I frequent regularly. Being in a “new build” it only opened a couple of weeks ago. Inside it has brand new shiny “labour saving” self checkout tills just out of their scratch resistant packing wrap…

The one next to the one I was using went wrong and was rebooted through MS Win XP with Wifi networking…

Now it would of course be remiss of anyone to sit in the adjacent coffee area with say Kismet (Android PCAP) or other PenTester kit, accidently left running on their phone/tablet etc… But an ordinary scan for the coffee bar Wifi showing the store network and seeing the self checkouts etc advertising their presence does seem a little remiss of those setting things up…

Oh and I wonder how the company that makes the self checkouts are going to explain a fault in the change “coin counter” that under certain change conditions will drop an extra two pound coin to the customer…

Perhaps describing things as a “headlong rush” is a little to staid a description for the current pace of things. But also misses the point about certain rquipment types, such as “self service” devices that are ment for a medium to longterm service life (10-20years) that get slow development / upgrade at best, and thus are often sold “new” with obsolete software…

Which brings us back to the idea of “regulation”… But do we need more, or just to enforce the existing legislation?

For instance there is “consumer law” in place in many jurisdictions and goods are supposed to be sold as “fit for purpose”. Whilst in some jurisdictions B2B sales may not be covered by “retail” B2C consumer law, selling as “new” a device with “out of date” known to be insecure software, or long out of date practices such as “embedded passwords” can hardly be described as “fit for purpose” even for B2B sales in this day and age…

Oh one advantage of using existing legislation is it removes a significant time lag out of the process, where new legislation would have to build up it’s own case law etc. A process that can take decades due to the way the legal process works. Another advantage of existing law is the older it is the less likely it is to have had it’s teeth drawn by corporate lobbyists and special interest groups “needing” exceptions.

Clive Robinson • November 29, 2016 3:41 PM

@ Spaceman Spliff,

Installing IoT stuff – so simple, only an idiot would do it! The “Time to deploy!” mantra gives short shrift to security. Are we surprised that this stuff, including our light bulbs, are being hacked?

You forgot to mention another underlying problem “lack of manpower”. These “idiot boxes” have such a low “Time to deploy” because that’s “what the shareholders want”.

It has another knockon effect few vocalise, the lack of manpower givrs rise to “expert scripts” by a few experienced admins, these get “copy-n-pasted” to “me-to” sites which get cut-n-pasted by much less experienced personnel, who don’t realy understand them, but make small changes anyway.

The problem with this cut-n-paste administration is what makes life easier for quite a few admins, also makes life a lot easier for attackers…

But for some reason we appear not to learn from past issues such as the dangers of “mono-cultures”…

Clive Robinson • November 29, 2016 5:20 PM

@ Anura,

I hate to tell you this, but it is their bosses making them smile; they smile at everyone.

That’s what the bosses would like to think, but lack the empathy to test. The reality is that it’s actually quite hard to fake a real smile all day.

For some reason small children and those of more mature years tend to spot false smiles more easily than younger adults, who possibly don’t need that defence mechanism as much.

I’m also well known by the counter staff[1] in the few branches I use, partly because I’m quite recognizable[2] and partly due to swapping baking and other recipies. But also in part due to the fact I do things a certain way each time which reduces the potential for fraud greatly. Oh and in atleast one branch they had to get me carted off to hospital when I keeled over due to an annoying medical condition.

[1] I found out when wearing the green that the way to get the best out of people is to show you are genuinely interested in them, and respect what they do. Yes it takes time but it usually makes both you and them feel better in the long run.

[2] It’s not only small children that have been known to point at me and say “santa”. For some reason I’m way to memorable to people, I go somewhere new and somebody I’ve not seen in thirty years will just pop up and say hello. I’ve even had young ladies come up and hug me, and some even call me by name, and it turns out that I know their parents and some years ago I fixed their bike or favourite toy, helped them with their homework, fixed the computer or taught them to sail, canoe, put up a tent etc and even taught their grandparents how to use a computer. Even kids who are in the same school as my son call out to me and say hello when I’m shopping, or say to their parent’s “That’s Alex’s dad”, likewise the teachers nod and say hello. Even doctors, nurses, porters and other patients and their relatives, will say hello and have a chat.

Clive Robinson • November 30, 2016 1:30 PM

It would appear that “transit card” payment/ticketing is suffering a bit of the winter maladies…

This PM I’ve “had occasion” as they say to use the Public Transport Service in London…

At a South West Trains(SWT) station there are hand written notes on all the ticket machines saying that there are problems with the Transport For London “Oyster Card” system and not to “top up” as it will not register…

I know the Oyster card is a “bolt on” to the SWT ticketing, and the Oyster is the much maligned Philips MiFare system with a centralised system designed and operated by another company with a fairly poor rep as far as computers are concerned…

Time to get the comfy chair and an extra large bowl of pop corn kick back and await the results (if they dare tell the truth).

Clive Robinson • December 5, 2016 12:15 AM

@ Wael,

First, you need to identify thye exact problem

Are you going “old english” on me 😉

@ Wael, shuffler,

First, you need to identify thye exact problem. Second, you need to show how randomization achieves the claimed purpose.

From my point of view the argument for any kind of address map randomization, strength / advantage has been more an assumption than a tested tactic. Thus it has that horrible “crypto taint” that you hear occasionaly about “the creator of a system not being able –or wanting– to break their creation, assume ‘if they cannot then nobody can'”.

The main assumption of any kind of address map randomization is that “an attacker will see a different layout that is unique for each system” thus each system will require a unique attack. This argument then goes on with that assumption as a given.

But is it true?

Obviously not at two levels…

If you think about what you are doing you are taking a program and cutting it into pieces, then rearranging those pieces, therefor you are,

Firstly looking at a set of permutations not unique pieces of code.

Secondly each piece is most likely selected along some recognizable interface point not a random point (though that could be done, it is much more complex to do so).

Therefor you can take another look at the situation in memory from a finer grained “tasklet” or “thread” view…

The first obvious question is “what has this change gained you? And the answer is “not much”. All you have done is changed the attackers job from locating a vulnerability in a program to locating a vulnerability in a tasklet or thread.

Yes it sounds harder but is it?

The answer is no not realy. Many attack vectors are found not by searching the memory but by fuzzing the input. From the input perspective the address map randomization has not changed the function of the code or the order the parts of the code are executed… Thus the attack vector is effectively “still in the same place” in time/order and can still be activated in the same way.

The question then is having been activated in the same way can it be exploited in the same way. Well if the attack is based on the actuall input the answer is yes but with maybe a little more difficulty.

We know that the code space has been rearanged but what about the variable space in the stack and in the heap?

Well as the code still executes in the same order the variables will get assigned in the same order. Thus although their absolute position may well have changed their relative position with respect to each other probably has not. Thus an attack that uses an offset from some kind of base pointer will still work the same way, even though the base pointer value may well have changed…

You can keep going through like this and it will tell you as an attacker how you change things. The main point being the attacker moves from a “fixed memory map” based attack viewpoint to a “execution sequence and relative offset” viewpoint. Yes it’s different but is it that much harder?

The answer from my own experiments is it depends on factors other than the address map randomization, such as the way the code is written especially in common functions… That is code designed to be re-entrant or reusable tends to be more vulnerable due to using relative not absolute addressing, based on offsets from a base pointer which is already setup for the attacker.

The implication is that the security of making stack and heap space non-executable would be of a lot more hinderance to an attacker, and if they can get over that fence then the rearangment of the memory map will not present anything as significant.