Schneier on Security

Clive Robinson • November 19, 2016 12:31 AM

@ Darryl Daugherty,

Taking “off the peg” as the point of concern, I’d be more worried about the firmware in storage devices.

It happens, and is but one small part of “supply chain poisoning”.

The only uncertainty involved is the real “directing mind” behind who does it and why or more correctly the excuses they give when caught.

Because most Governments like to maintain atleast a little “plausible deniability” thus use “NOC” agents/contractors not Officers etc. The thing is it’s “all smoke and mirrors” an “agent” or “entity” gets very limited contact usually only via a single “handler”, the bona fides of which they have no real ability to verify. Thus the handler may say they are working for Gov X where as in fact they work for Gov Y and are running a false flag operation.

Clive Robinson • November 20, 2016 4:13 AM

@ Furloin,

The scary part is this software might be in cars. They also are backdoored. This makes no sense, why backdoor them without telemetry?

It does make sense but not from a security standpoint.

It’s roots are the same as Quality Managment and go back many decades, to the time when the Japanese started mass producing transistor radios that displaced home manufactured valve radios.

At first reliability rates were low but due to the BOM and manufacturing differential between transistors on PCBs and valves on folded metal chassis and hand soldered conponents on tag strips the profit in transistor radios was very very large. Thus shipping an extra ten or twenty percent as replacments for those that failed in warranty was a large but not significant cost, especially when many could be repaired in the home country not back in Japan, and as the valve radios had also been as unreliable there was an established repair network.

Competition in the market started to bring the price of radios down quite quickly and thus the replace cost caused a tightening of manufacturing standards which brought reliability up. However it started to kill of the home repair network. Thus repair costs started to rise, thus manufacturing standards and reliability rose. But only so far, and droping prices rapidly reduced profit, especially when warranty items had to be “shipped individually” back to a repair center. Thus the goods out shipping cost per item was a small fraction of the return for repair under warranty cost. This cost imbalance was proportional to distance, thus even a small rise in return rates could wipe out any profit.

Then in 1980 Sony started shipping the ICF2001 “synthesized” portable “Travel Radio”[1] which was the first all band Shortwave / AM / FM portable radio of it’s type. Importantly it had a cmos CPU in it with embbeded software in ROM. Thus software reliability became a new and significant issue in consumer goods as other radio manufactures raced to catch up and add more features.

In time microcontrolers and their software moved into increasing numbers of Fast Moving Consumer Electronics (FMCE) and it became the new “inhibitor” in that the software took upwards of ten times the time to develop and test than the incrementally improving hardware which benifited from reduced design times due to improvments in chip manufacturing.

The drop in the cost of electrically erasable and reprogramable memory came to the rescue much as floppy disk based software did to Personal Computers.

The problem unlike the PC was how to “upgrade” non user accessable devices like mobile radios, thus Over The Air updates were developed and standardized. The assumption was that security would not be required due to the fact the “Service Provider Owned the Network”…

The rest you can probably see for yourself, but each step on the way was only seen as a way to reduce cost and increase features, security never ever, and still does not get a lookin. At best it gets lip-service via standard libraries that are not secure (see my previous comments on AES). But nobody in the marketing department cares as long as the “SSH” etc laundry list is ticked, and manufacturing want “fast” trouble free access so hard coded passwords…

Sometimes you have to examine the individual stes of a journy to realise how the current destination was arrived at. But as with all journeys way points can and do change when external events come into play. Often this is by government regulation.

[1] http://www.shortwaveradio.ch/radio-e/sony-icf2001-e.htm